Amazon patent detects abnormal network activity using traffic analysis

ChangeBridge: Patent Grants - Networking (H04L)

Published March 31st, 2026

Detected March 31st, 2026

Summary

USPTO granted Amazon Technologies, Inc. Patent US12592946B1 covering methods for dynamically detecting abnormal network activity through traffic analysis. The system extracts key features from monitored network traffic, aggregates data by dimension (such as region), generates statistical distributions, and applies thresholds to identify anomalous behavior that may indicate malicious activity.

View original document View source feed page

What changed

USPTO issued Patent US12592946B1 to Amazon Technologies, Inc. on March 31, 2026. The patent describes a method for monitoring network traffic and identifying potentially malicious behavior by extracting key features from network data, aggregating them across dimensions such as geographic regions, generating statistical distributions for those values, and applying thresholds to detect anomalies. The approach scales with traffic volume and resource numbers, handling large-scale environments.

This is a patent grant notice with no compliance requirements or deadlines. Technology companies, network operators, and cybersecurity solution providers should review this patent to understand Amazon's intellectual property position in network traffic analysis and anomaly detection. Competitors developing similar technologies should assess potential patent overlap considerations.

Source document (simplified)

← USPTO Patent Grants

Dynamic detection of abnormal network activity

Grant US12592946B1 Kind: B1 Mar 31, 2026

Assignee

Amazon Technologies, Inc.

Inventors

Catherine Watkins, Wayne Alan Fullen, Jared Sylvester, Patrick Collard, Evripidis Paraskevas, Jacob Nguyen, John Paul Schweitzer, Luke Kenneth Schubert, Michael Lowney, Parnavi Tamhankar, Stephen Goodman, William Kupersanin, Ravi Karnam, Sai Srinivas Vemula, Sameer Anil Murudkar

Abstract

Approaches presented herein relate to the monitoring of network traffic, and identification of potentially malicious behavior, in a networked resource environment. Values for key features of interest can be extracted from monitored network traffic. This data can be aggregated for one or more data dimensions, such as for a given region, and modeling can be performed to generate distributions for those values in that region. A threshold can be applied to this distribution to identify anomalous activity, where the same threshold can be applied to distributions for different regions and the values that meet or exceed that threshold will differ across regions based at least in part upon different levels of activity or different behavior. Such an approach scales with changes in the amount or type of traffic to be monitored, and can handle very large numbers of resources and volumes of traffic. If potentially malicious behavior is identified, one or more remedial or mitigation actions may be taken.