Patents are a good information resource for obtaining the state of the art of deep learning for cybersecurity technology innovation insights. I. Deep Learning for Cybersecurity Technology Innovation Status Patents that specifically describe the major deep learning applications in cybersecurity are a good indicator of the deep learning for cybersecurity innovations in a specific innovation entity. To find the deep learning for cybersecurity technology innovation status, patent applications in the USPTO as of May 31, 2020 that specifically describe the major deep learning applications in cybersecurity are searched and reviewed. 31 published patent applications that are related to the key deep learning for cybersecurity technology innovation are selected for detail analysis. II. Deep Learning for Cybersecurity Technology Innovation Details Patent information can provide many valuable insights that can be exploited for developing and implementing new technologies. Patents can also be exploited to identify new product/service development opportunities. Industrial IoT Cyber-Attack Detection/General Electric Malicious Code Detection/Royal Bank of Canada

1. 1
©2020 TechIPm, LLC All Rights Reserved http://www.techipm.com/
Deep Learning for Cybersecurity Innovation Insights from Patents
Alex G. Lee1
Patents are a good information resource for obtaining the state of the art of deep learning for cybersecurity
technology innovation insights.
I. Deep Learning for Cybersecurity Technology Innovation Status
Patents that specifically describe the major deep learning applications in cybersecurity are a good indicator of the
deep learning for cybersecurity innovations in a specific innovation entity. To find the deep learning for
cybersecurity technology innovation status, patent applications in the USPTO as of May 31, 2020 that specifically
describe the major deep learning applications in cybersecurity are searched and reviewed. 31 published patent
applications that are related to the key deep learning for cybersecurity technology innovation are selected for detail
analysis.
Following figure shows the deep learning for cybersecurity patent application landscape with respect to the
innovation entity. As shown in the figure, deep learning for cybersecurity innovation entities are Oracle, IBM, Intel
Microsoft, NEC, Accenture, BAE Systems, Bank of America, Boeing, Cisco, Deep Instinct Ltd, Electronics and
Telecommunications Research Institute, ESTsecurity Corp., Fortinet, Inc., F-Secure Corporation, General Electric,
1
Alex G. Lee, Ph.D Esq., is a CTO and patent attorney at TechIPm, LLC.

2. 2
©2020 TechIPm, LLC All Rights Reserved http://www.techipm.com/
Infoblox Inc., Royal Bank of Canada, Samsung Electronics, Saudi Arabian Oil Company, Shape Security, Sophos
Limited, Trend Micro Incorporated, UT-Battelle, LLC, and ZingBox, Inc..
Oracle
10%IBM
6%
Intel
6%
Microsoft
6%
NEC
6%
Accenture
3%
BAE Systems
3%
Bank of America
3%
Boeing
3% Cisco
3%
Deep Instinct Ltd
3%
Electronics and
Telecommunications
Research Institute
3%
ESTsecurity
Corp.
3%
Fortinet, Inc.
3%
F‐Secure
Corporation
3%
General Electric
3%
Infoblox Inc.
3%
Royal Bank of Canada
3%
Samsung Electronics
3%
Saudi Arabian Oil Company
3%
Shape Security
3%
Sophos Limited
3%
Trend Micro Incorporated
3%
UT‐Battelle, LLC
3%
ZingBox, Inc.
3%
Other
29%

3.
©
F
t
c
T
T
©2020 TechIPm,
Following fig
technology in
cybersecurity
Tenant Model
Threat Detect
Data Securit
4%
False Tenant Mod
3%
IoT
Device
Security
3%
Malic
D
LLC All Rights Re
gure shows the
nnovation field
technology fo
l, IoT Device
tion, and Thre
Attack Activit
Detecti
13%
ty
del
cious Webpage
Detection
3%
Security Alerts
3%
eserved http://ww
e deep learnin
d. As shown i
followed by N
Security, Ma
eat/Vulnerabil
ty/Event
ion
%
Security
Information
Analysis
3%
Th
ww.techipm.com
ng for cyberse
in the figure, M
Network Secur
alicious Webp
lity Assessme
Ne
reat Detection
3%
Th
/
ecurity patent
Malware Dec
rity, Attack A
page Detection
ent.
etwork Security
23%
hreat/Vulnerability
Assessment
3%
application la
tion is the mo
Activity/Event
n, Security A
y
andscape with
ost innovated
Detection, D
Alerts, Security
Malware Decti
39%
h respect to th
deep learning
ata Security, F
y Information
on
3
he key
g for
False
n Analysis,

4.
©
A
e
c
d
t
©2020 TechIPm,
A patent coun
evolution of t
cybersecurity
date (priority
the deep learn
LLC All Rights Re
nting for grow
echnology inn
technology in
year) and the
ning for cyber
0
2
4
6
8
10
12
14
16
NumberofPatentApplications
eserved http://ww
wth in patentin
novation. Foll
nnovation gro
publication d
rsecurity techn
2016
ww.techipm.com
ng over a perio
lowing patent
owth trends. S
date by around
nology innova
2017
2018
Priority Year
/
od of times ca
t application a
Since there is u
d two years, th
ation activity
2019
an be a good m
activity chart
usually a time
he patent app
is in rapid gro
Deep Learn
Application
measuring too
shows the dee
e lag between
lication activi
owth stage.
ning for Cybersecurity
s
ol for monitor
ep learning fo
n the initial ap
ity chart indic
y Patent
4
ring the
or
plication
cates that

5. 5
©2020 TechIPm, LLC All Rights Reserved http://www.techipm.com/
II. Deep Learning for Cybersecurity Technology Innovation Details
Patent information can provide many valuable insights that can be exploited for developing and implementing new
technologies. Patents can also be exploited to identify new product/service development opportunities.
Industrial IoT Cyber-Attack Detection/General Electric
Industrial IoT control systems that operate the industrial asset systems (e.g., power turbines, jet engines,
locomotives, autonomous vehicles, etc.) are vulnerable to threats, such as cyber-attacks (e.g., associated with a
computer virus, malicious software, etc.). Current methods primarily consider threat detection in Information
Technology (such as, computers that store, retrieve, transmit, manipulate data) and Operation Technology (such as
direct monitoring devices and communication bus interfaces). However, cyber-threats can still penetrate through
these protection layers and reach the physical domain of the industrial asset systems as seen in 2010 with the
Stuxnet attack2
. Such attacks can diminish the performance of an industrial asset and can cause a total shut down.
US20180159879 illustrates a desirable method to protect an industrial asset from such cyber-attacks in an
automatic, rapid, and accurate manner.
Following figure shows a high-level architecture of the cyber-threats protection system 100. The system
includes a "normal space" data source 110 and an abnormal or "threatened space" data source 120. The normal
space data source 110 stores, for each of a plurality of "monitoring nodes" 130, a series of normal values over time
that represent normal operation of an industrial asset. The threatened space data source stores, for each of the
2
https://www.mcafee.com/enterprise/en-us/security-awareness/ransomware/what-is-stuxnet.html

6. 6
©2020 TechIPm, LLC All Rights Reserved http://www.techipm.com/
monitoring nodes 130, a series of threatened values that represent a threatened operation of the industrial asset (e.g.,
when the system is experiencing a cyber-attack).
Information from the normal space data source 110 and the threatened space data source 120 are provided to a
threat detection model creation computer 140 that uses these data to create a decision boundary that separates
normal behavior from threatened behavior. Then, the decision boundary is used by a threat detection computer 150
executing a threat detection model 155. The threat detection model 155 monitors streams of data from the

7. 7
©2020 TechIPm, LLC All Rights Reserved http://www.techipm.com/
monitoring nodes 130 comprising data from sensor nodes, actuator nodes, and/or any other critical monitoring
nodes. Then, the threat detection model 155 calculates the deep learning features for each monitoring node based
on the received data, and "automatically" output a threat alert signal to a remote monitoring devices 150, and then
to a customer.
Following figure shows an autoencoder 1400 that is used for the deep learning features.

8. 8
©2020 TechIPm, LLC All Rights Reserved http://www.techipm.com/
An encode process turns raw inputs 1410 into hidden layer 1420 values. A decode process turns the hidden layer
1420 values into output 1430. Note that the number of hidden nodes can be specified and correspond to number of
features to be learned. The autoencoder estimates values for W-matrix (weight matrix) and b-vector (affine terms)
from a first group of training data. The W-matrix and b-vector can then be used to calculate the features from a
second group of training data. A non-linear decision boundary can be computed to the feature vectors. Then, the
threat detection computer 150 uses the decision boundary to classify whether a feature vector of new data
corresponds to "normal" or "attack" data. For high speed detection, a De-noised Auto-Encoder ("DAE") can be
used. For example, the DAE learns features from normal and abnormal data sets. Through the input of many
examples of normal data, the DAE algorithm learns a representation of the data set in reduced dimensions
exploiting the PCA (Principal Component Analysis). This representation can be a non-linear transform of the raw
data that encapsulates the information of the original data.

9. 9
©2020 TechIPm, LLC All Rights Reserved http://www.techipm.com/
Malicious Code Detection/Royal Bank of Canada
US20180285740 provides a deep learning application for detection of malicious code. Malicious code, like all code,
is a form of language having concepts such as grammar and context, but has its own idiosyncrasies built in. Thus,
the Natural Language Processing (NLP) of deep learning technology can be used to detect malicious code as a
language processing problem.
Following figure shows deep learning system 10 for detection of malicious code.

10.
©
T
g
i
(
w
r
X
s
r
w
c
t
d
3
a
©2020 TechIPm,
The text edito
generator to e
input text.
The neu
(RNN/LSTM)
where the ith
represents the
X=(e1, e2, . . .
size |F|, and w
regularized ou
with dimensio
classification
the input text
database 180
3
The neural netw
and a sequence
LLC All Rights Re
or 102 submits
extract a featu
ural network 2
) and a classif
row represent
e character (on
, eT), a convo
with sequence
utput F. Next,
on equivalent
layer, in this
is malicious c
for additional
work analyzes t
length of 1300 c
eserved http://ww
s code segmen
ure vector. Th
20 includes th
fication layer
ts the ith lette
ne-hot encodi
olutional layer
length T'. At
, a bidirection
to the numbe
case a sigmoi
code or benig
l analysis.
the input text on
characters.
ww.techipm.com
nts received a
hen, the proce
hree types of l
112. Before i
er of the samp
ng). Beginnin
r is applied, re
this point bat
nal LSTM is e
er of LSTM hi
id function. T
gn code. The n
n a per-character
/
across a netwo
ssed code seg
layers: convo
input, the inpu
ple, and each c
ng with the inp
esulting in a n
tch normaliza
employed resu
idden states. F
The classificati
neural network
r basis, not word
ork 150 to the
gments is prov
lutional layer
ut text is conv
column is of v
put of a seque
new set of fea
ation 106 can b
ulting in two h
Finally, these
ion layer perf
k data can be
ds or commands
e input proces
vided to the ne
s 108 (CNN),
verted into a 1
value 0, excep
ence of one-ho
ature vectors F
be applied, re
hidden state v
features are p
forms a determ
stored on a d
s. There is a voc
sor and featur
eural network
, recurrent lay
1300 x 80 mat
pt for the colu
ot encoded ve
F=(f1, f2, . . . ,
esulting in a
vectors [ , ],
provided into
mination of w
ata storage, su
cabulary of 80 c
10
re vector
k 20 as a
yers 110
trix3
,
umn that
ectors
fT′) of
, each
a
whether
uch as
characters

11. 11
©2020 TechIPm, LLC All Rights Reserved http://www.techipm.com/