Patent filing, 2025.08

User Behavior Anomaly Detection/Automatic Response Method and System Based on Behavior Profiling in Cloud Computing Environment

This patent application addresses attacks in the cloud where stolen credentials are used to make API calls that look normal, which static rules or single metrics struggle to catch and which usually get no automatic response. Cloud API event logs are collected by a serverless function, and each user's behavior is profiled with three probabilistic models: a sequence pattern model (HMM), a temporal pattern model (KDE and an exponential distribution), and an access pattern model (TF-IDF and SVD embeddings with a GaussianHMM). When the weighted average of the three scores exceeds a threshold, the system temporarily revokes the user's permissions through cloud IAM and restores them automatically after a set time. Joonho Seo is a co-inventor with Prof. Yoon-Ho Choi. The application was filed with the Korean Intellectual Property Office on August 6, 2025, by Pusan National University's Industry-University Cooperation Foundation (application no. 10-2025-0108357, with a request for examination).

Where

Korean Intellectual Property Office (KIPO)

My role

Co-inventor (Yoon-Ho Choi, Joonho Seo)

Status

filed

Application no.

10-2025-0108357