Detecting anomalous values in multimodal distributions using empirical cumulative distribution functions

Abstract

The invention relates to detecting anomalous values in a multimodal distribution using an empirical cumulative distribution function. A method for detecting anomalies is provided. The method receives data and organizes the data according to a plurality of time periods and a number of updates for each of the plurality of time periods. The organized data approximates a first unimodal and a second unimodal. The first unimodal and the second unimodal have a first peak and a second peak, respectively. The method identifies dimples across a plurality of time periods and determines a density of the dimples. The density is compared to a predetermined threshold to determine whether the recess is in a selectable configuration. A unimodal analysis is then performed on the first unimodal and the second unimodal in response to the depression being a selectable morphology. The method also determines whether the second single modality is abnormal based on the single modality analysis, and discards updates associated with the second single modality when the second single modality is abnormal.

Description

[0001] Priority claim

[0002] This application claims priority to U.S. Provisional Application Serial No. 63 / 537,296, filed on September 8, 2023, the entire contents of which are incorporated herein by reference. Technical Field

[0003] Examples of the present disclosure relate generally to systems for detecting potential malicious attacks on computing systems, and more particularly, but not by way of limitation, to systems for verifying computing system updates. Background Art

[0004] Typically, when a developer develops a software application, the software code used to run the software application may be stored at a developer platform. In addition to storing the code used to run the software application, the developer platform may also be used to track and control changes made to the software code. Version control may be used to track and manage code changes.

[0005] When the first user submits the code change to the developer platform, the second user can review the code change and determine whether the code change is appropriate. In addition, when the code change is submitted, the code change can include metadata associated with the code change. The metadata can reflect when the code change was submitted to the developer platform, who made the code change, and the scope of the code change.

[0006] Typically, when code changes are submitted at the developer platform, patterns may emerge. For example, if a developer typically works during core hours between 9am and 3pm, code changes may typically be submitted to the developer platform during these working hours. However, code changes may be submitted outside of these core hours, such as at 4am. When code changes are submitted at unusual times, this may indicate a malicious code change. Summary of the invention

[0007] According to one aspect of the present invention, a method for detecting anomalies in a system is provided, the method comprising: receiving data and organizing the data according to a plurality of time periods and the number of updates in each of the plurality of time periods, the organized data approximating a first unimodal state and a second unimodal state, the first unimodal state having a first peak, and the second unimodal state having a second peak; identifying depressions across the plurality of time periods; determining the density of the depressions; comparing the density of the depressions with a predetermined threshold; determining whether the depressions are optional forms based on the comparison; in response to the depressions being optional forms, performing unimodal analysis on the first unimodal state and the second unimodal state; determining whether the second unimodal state is an anomaly in the system based on the unimodal analysis; and discarding the updates associated with the second unimodal state.

[0008] According to another aspect of the present invention, a non-transitory machine-readable medium is provided, having instructions thereon, the instructions being executable by a processor of a machine to perform operations, the operations comprising: receiving data and organizing the data according to a plurality of time periods and the number of updates in each of the plurality of time periods, the organized data approximating a first unimodal state and a second unimodal state, the first unimodal state having a first peak, and the second unimodal state having a second peak; identifying depressions across the plurality of time periods; determining the density of the depressions; comparing the density of the depressions with a predetermined threshold; determining whether the depressions are optional forms based on the comparison; in response to the depressions being optional forms, performing unimodal analysis on the first unimodal state and the second unimodal state; determining whether the second unimodal state is an anomaly in the system based on the unimodal analysis; and discarding the updates associated with the second unimodal state.

[0009] According to another aspect of the present invention, a device is provided, comprising: a processor; and a memory, the memory comprising instructions, which, when executed by the processor, cause the device to perform operations, the operations comprising: receiving data and organizing the data according to a plurality of time periods and the number of updates in each of the plurality of time periods, the organized data approximating a first unimodal state and a second unimodal state, the first unimodal state having a first peak, and the second unimodal state having a second peak; identifying depressions across the plurality of time periods; determining the density of the depressions; comparing the density of the depressions with a predetermined threshold; determining whether the depressions are optional forms based on the comparison; in response to the depressions being optional forms, performing unimodal analysis on the first unimodal state and the second unimodal state; determining whether the second unimodal state is an anomaly in the system based on the unimodal analysis; and discarding the updates associated with the second unimodal state. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The various figures in the drawings depict only examples of the present disclosure and should not be considered limiting of its scope.

[0011] Figure 1 is a network diagram illustrating a network environment suitable for preventing malicious attacks on server devices and developer platforms according to some examples.

[0012] Figure 2 is based on some examples to prevent Figure 1 Methods of malicious attacks on server devices and developer platforms.

[0013] Figure 3Received data organized as a function of number of updates over time is shown according to some examples, wherein the received data has a first unimodal state, a second unimodal state, and a third unimodal state, each having a first peak, a second peak, and a third peak.

[0014] Figure 4 Shown are unimodal patterns of updates received during multiple time periods that initially appear as multiple unimodal patterns, according to some examples.

[0015] Figure 5 is a block diagram illustrating the architecture of software for implementing social network initiated lists according to some examples.

[0016] Figure 6 A machine is shown as an example computer system having instructions that cause the machine to implement a social network initiated list according to some examples. DETAILED DESCRIPTION

[0017] The following description includes systems, methods, techniques, instruction sequences and computing machine program products that embody the illustrative examples of the present disclosure. In the following description, for the purpose of illustration, many specific details are set forth in order to provide an understanding of the various examples of the subject matter of the present invention. However, it will be apparent to those skilled in the art that the examples of the subject matter of the present invention may also be put into practice without these specific details. Typically, known instruction instances, protocols, structures and techniques are not necessarily shown in detail.

[0018] Examples relate to preventing malicious attacks on computing systems. Specifically, methods and systems can maintain the security of computing systems by determining when a system update is actually a malicious attack. The determination can be made by determining when a peak of updates is received over a given time period. A score is assigned to the density associated with each peak. Each score is compared to a threshold, and based on the comparison, it is determined whether the malicious attack corresponds to one of the peaks.

[0019] Data related to updates may be received during a plurality of time periods. The data may include metadata including an entity that submitted the update, a time and date when the update was received, an author of the update, and an update type. The data may be organized according to the plurality of time periods and a number of updates for each of the plurality of time periods. In an example, the organized data may approximate a first unimodal state and a second unimodal state across a first time period and a second time period in the plurality of time periods.

[0020] A unimodal state may correspond to updates received over a time period. When the number of updates received increases over time, this may be associated with a positive slope of the unimodal state. When the number of updates decreases over time, this may be associated with a negative slope of the unimodal state. The transition point where the positive slope becomes a negative slope (i.e., when the number of updates received begins to decline) may be defined as the peak of the unimodal state. Therefore, the peak of each unimodal state in a plurality of unimodal states may be defined by the peak number of updates received at a particular time period in a plurality of time periods. For example, a first peak of a first unimodal state may be in a first peak time period during a first time period, and a second peak of a second unimodal state may be in a second peak time period during a second time period.

[0021] In addition, an optional morphology (hereinafter referred to as a dip or potential dip) can be identified at a third time period between the first unimodal state and the second unimodal state based on the number of updates received at the dip. A potential dip can be identified based on when a negative slope becomes a positive slope (i.e., the number of received updates begins to increase after decreasing). In addition, a dip can be identified when the slope is zero after a negative slope, which can be associated with when the number of received updates remains constant (i.e., the number does not change within a given time period).

[0022] The density may be calculated for each of the unimodal states and potential depressions. A logarithmic function may be applied to the density to confirm that the potential depressions are actual depressions and to confirm that the updates associated with each unimodal state correspond to legitimate updates that are not malicious.

[0023] If the score of the potential depression is greater than a threshold, the potential depression may be an actual depression. In addition, if any of the scores of the unimodal states is above a threshold, the unimodal state with a score above the threshold may be considered malicious. Specifically, an update received in a unimodal state with a high score may actually be a malicious update. If one of the first unimodal state or the second unimodal state is determined to be a malicious update, the malicious update may be discarded.

[0024] Figure 1 1 is a network diagram illustrating a network environment 100 suitable for maintaining security of a server device 102 and a developer platform 104. The server device 102 can receive updates (e.g., software updates) to be implemented by the developer platform 104. The developer platform 104 can be a platform that allows users to create, store, manage and share code. When an update (e.g., an update to the code) is received from a first user 106 and a device 108, the update can be stored at the developer platform 104. A second user 110 can review the update at a device 112 and implement the update or make a decision not to implement the update.

[0025] Devices 108 and 112 may be any computing device suitable for use by a user. For example, devices 108 and 112 may be desktop computers, tablet computers, portable media devices, or smart phones belonging to users. Devices 108 and 112 may interact with server device 102 using client 114. Client 114 may be a web browser that allows communication between devices such as devices 108 and 112 and server device 102 and developer platform 104. Client 114 may be an application client, which may be a stand-alone application that can run on one or both of devices 108 and 112 and communicate with server device 102 to employ services on a remote server via a network, such as a Bluetooth client application, etc.

[0026] The network 116 may be any network that enables communication between or among machines, databases, and devices (e.g., device 108 or device 112). Thus, the network 116 may be a wired network, a wireless network (e.g., a mobile or cellular network), or any suitable combination thereof. The network 116 may include one or more portions that constitute a private network, a public network (e.g., the Internet), or any suitable combination thereof.

[0027] Examples relate to maintaining the security of server device 102 and developer platform 104. More specifically, malicious attacks may occur at server device 102 and developer platform 104. The malicious attacks may be in the form of seemingly innocuous software updates received at server device 102 and developer platform 104. However, the seemingly innocuous software updates may be received at times not traditionally associated with receiving updates.

[0028] To further illustrate, an entity may work between 7:00 am and 7:00 pm. Therefore, when an entity submits updates to the server device 102 and the developer platform 104, these will generally occur between 7:00 am and 7:00 pm, with peaks occurring at various times. When these updates are received, the entity can access these updates and implement them as needed. However, seemingly harmless updates that are actually malicious attacks may be received during non-working hours (e.g., at 3:00 am). When an entity accesses these seemingly harmless updates, malicious attacks may be released on the server device 102 and the developer platform 104. The example determines that seemingly harmless updates may be malicious based on the distribution of the received updates (e.g., the number of received updates) by analyzing the morphology associated with the time period in which different updates are received, and then discards the updates if there is a possibility that seemingly harmless updates may actually be malicious, thereby preventing these potential malicious attacks and maintaining the security of the server device 102 and the developer platform 104.

[0029] In an example, an empirical cumulative distribution function (ECDF) may be used to calculate a cumulative distribution function (CDF). The first unimodal state and the second unimodal state may occupy an area on the distribution. The first unimodal state and the second unimodal state may have a density corresponding to the number of commits (COMMITs) received during the time interval associated with each of the first unimodal state and the second unimodal state, the commits may involve updates. The CDF may be calculated to confirm that fewer commits are received in time intervals different from the time intervals associated with the first unimodal state and the second unimodal state.

[0030] To calculate the CDF, the following formula can be used:

[0031] F x (x) = P (X ≤ x) Formula (1)

[0032] Here, P(X≤x) provides the probability that a continuous random variable is less than or equal to a certain value. It accumulates the probabilities of all values ​​up to a certain point. X is the variable of interest, and x is a certain point.

[0033] The CDF can be a step function that increases by 1 / n at each datum of n data points. The ECDF can be used to estimate the CDF for a point specified by x. In particular, the ECDF can be used to calculate the probability density associated with each datum. The ECDF can be defined as follows:

[0034]

[0035] Here, w i F i (x) can involve a separate distribution F i (x) (or component) and its associated weight w i combination.

[0036] As described above, the example implements a detection method such as a dip (Dip)-empirical cumulative distribution function outlier detection (ECOD) to generalize anomaly detection to multi-peak data sets. It can be assumed that an outlier peak such as the above-mentioned unimodal peak can be a rare event in which an update may occur in a low-density region of a probability distribution. ECOD can use information about the distribution of updates to determine where the update is less likely, and therefore has a higher probability of being an outlier and may be a malicious attack rather than an update. ECOD can be used to estimate ECDF for potential dips. When calculating ECDF for potential dips, a logarithmic function can be applied to ECDF to determine whether the potential dip is an actual dip. In addition, ECOD can estimate the ECDF of each variable in a unimodal peak that occurs at an unexpected time (e.g., at 3:00 a.m.). ECOD can be used to calculate the outlier score of a unimodal peak or potential dip that occurs at an abnormal time. ECOD can calculate the score by calculating the tail probability of each variable associated with a unimodal peak or potential dip that occurs at an abnormal time. Then, ECOD can multiply them together, where the logarithmic function can then be applied to generate a score.

[0037] Now refer to Figure 2 , a method 200 for preventing malicious attacks on a computing system is shown. Initially, during operation 202, data that may be related to an update may be received. The received data may be organized according to a multidimensional parameter. In particular, the first parameter may include multiple data instances, and the second parameter may include multiple time periods. The data may be organized according to each parameter in the multidimensional parameter, wherein the first parameter of the multidimensional parameter may be mapped relative to the second parameter of the multidimensional parameter. In an example of several data instances and time periods, the data may be organized so that several data instances in the plurality of data instances may be mapped relative to time periods in the plurality of time periods. When the data is organized during operation 202, the organized data may approximate a first unimodal state, a second unimodal state, and a third unimodal state. Each of the first unimodal state, the second unimodal state, and the third unimodal state may have a first peak, a second peak, and a third peak, respectively, wherein the first peak, the second peak, and the third peak may be defined according to positive slopes and negative slopes as described above.

[0038] As an example of method 200 and referred to herein as "illustration", refer to Figure 3 , Figure 3Organized data 300 corresponding to data received at the server device 102 and the developer platform 104 during operation 202 is shown. The illustration may relate to a situation in which an individual provides an update to the developer platform 104. The developer platform 104 may use the method 200 to determine whether the update is valid. The developer platform 104 may receive the data 118 and then organize the data 118 into the organized data 300 during operation 202. As described above, during operation 202, the developer platform 104 may also organize the data 118 according to a plurality of time periods 302 along a time axis. The organized data 302 may approximate a first unimodal state 304, a second unimodal state 306, and a third unimodal state 308. In the illustration, the first unimodal state 304 may have a first peak 310, and the second unimodal state may have a second peak 312, while the third unimodal state 308 may have a third peak 314.

[0039] Each of the peaks 310 to 314 can be associated with a peak number of updates received in a time period in the plurality of time periods. The first peak 310 can occur at a first time period 316, which can correspond to 10:00 a.m. The second peak 312 can occur at a second time period 318, which can correspond to 12:00 a.m. In addition, the third peak 314 can occur at a third time period 320, which can correspond to 3:00 p.m. The first peak 310 and the third peak 314 can occur at recurring time periods that are typically associated with receiving new updates (i.e., 10:00 a.m. and 3:00 p.m.). In addition, the second peak 312 can occur at a time that is typically after or before the recurring time period.

[0040] Return to attention Figure 2 After receiving and organizing data during operation 202, the method can proceed to operation 204, where potential dips can be identified across multiple unimodal states and across multiple time periods. In a first example, component decomposition can be used to identify dips. In a second example, dips can be identified by determining midpoints between peaks of the unimodal states.

[0041] When using calculated slopes to identify depressions, peak intervals outside the slopes of adjacent unimodal states can be identified. The slope can include the steepest slope of the unimodal state. The slope can be identified by examining the morphology of the left portion of the unimodal state and the right portion of the unimodal state adjacent to the unimodal state whose left portion is examined. The depression can be inferred based on the identified peak intervals. The midpoint between the slope of the left portion and the slope of the right portion can be identified. The midpoint can correspond to the point where the negative slope of the left portion of the unimodal state turns into the positive slope of the right portion of another unimodal state. Although the left side and the adjacent right side are described, the opposite situation can also be used, that is, the right side and the adjacent left side can also be used.

[0042] When using the midpoint example, the midpoint between the peaks of adjacent unimodal states can be determined. The mid-point can be a half-way point between the peak of the first unimodal state and the peak of the second unimodal state. Thus, if the peak of the first unimodal state is at 9:00 am and the peak of the second unimodal state is at 3:00 pm, the mid-point can be noon, which is the half-way point between 9:00 am and 3:00 pm. Thus, a potential depression can be identified as an extension of the first unimodal state and an extension of the second unimodal state, where the extension can reach an extreme at the mid-point.

[0043] In the illustration, during operation 204, a midpoint 322 may be identified between the first peak 310 and the second peak 312. The first peak 310 occurs at a first time period 316, which corresponds to a time of 10:00 a.m. The second peak 312 occurs at a second time period 318, which corresponds to a time of 12:00 a.m. Thus, the midpoint 322 may correspond to 5:00 a.m.

[0044] Still using this illustration as an example, during operation 204, midpoint 324 can be identified between first peak 310 and third peak 314. First time period 316 corresponds to a time of 10:00 a.m., while third peak 314 occurs at second time period 320, which corresponds to a time of 3:00 p.m. Therefore, midpoint 322 can correspond to 12:30 p.m. In the illustration, each of midpoint 322 and midpoint 324 can be identified as a potential depression.

[0045] Once potential depressions are identified during operation 204, operation 206 may be performed in which the tail probability of each data point may be determined. The tail probability of each data point is identified using an estimated cumulative distribution function (ECDF). An estimate of the underlying cumulative distribution function may be estimated based on the observed data. In the case where the observed data is related to updates provided to the developer platform in a given unimodal state, the distribution estimator may involve estimating the number of updates that have been received in a given unimodal state. In addition to the cumulative distribution function (e.g., kernel density estimation), various data clustering techniques (e.g., vector quantization) may be used with various non-parametric methods to determine the density of each of the unimodal state and the potential depressions.

[0046] After the density of the potential depression is determined in operation 206, the density can be compared to a predetermined threshold during operation 208. In operation 210, a comparison can be performed to determine whether the data point is an anomaly. To perform the comparison, a logarithmic function can be applied to the density, which can produce a score for the data point. The score can be compared to a predetermined threshold. The predetermined threshold can correspond to a value where a score above this value may indicate an anomaly of the data point. If the score is below this value, then the data point is not an anomaly.

[0047] When a potential depression is not identified as an alternative morphology, then the unimodality adjacent to the potential depression is not a separate unimodality defining a multimodal distribution. Instead, the adjacent unimodality is in fact a single unimodality. For further explanation, and referred to herein as a "unimodal representation", refer to Figure 4 .

[0048] In the unimodal representation, the kurtosis may include peaks 400 and 402 and potential depressions 404. The density of potential depressions 404 is calculated using the above-described technique, and then a logarithmic function is applied to the calculated density. The resulting score is compared to a predetermined threshold. In the unimodal representation, the score is below the threshold. Therefore, the potential depression is not an optional morphology. In addition, peaks 400 and 402 do not define a separate unimodal state. Instead, peaks 400 and 402 and potential depressions 404 are part of a single unimodal state 406.

[0049] Return to the diagram and Figure 3 , since midpoint 322 and midpoint 324 are identified as potential depressions, during operation 206, the density associated with midpoint 322 and midpoint 324 can be determined. A logarithmic function can then be applied to the determined density to obtain a corresponding score, and the corresponding score is compared to a predetermined threshold during operation 208. In this illustration, it is determined that the corresponding score is above the predetermined threshold. Therefore, during operation 210, the depressions associated with midpoint 322 and midpoint 324 are determined to be selectable morphologies.

[0050] After determining that the depression is an optional morphology, operation 212 can be performed, in which a unimodal analysis is performed on the first unimodal, the second unimodal, and the third unimodal. When determining the optional morphology, it can be assumed that the received data is multimodal rather than unimodal. Therefore, a unimodal analysis can be performed on each unimodal rather than a single unimodal analysis on all received data. In addition, the above-mentioned ECDF technique can be used to perform a unimodal analysis during operation 212. The unimodal analysis can be performed to determine the density associated with each unimodal.

[0051] After performing the unimodal analysis in operation 212, a logarithmic function may be applied to each result of the unimodal analysis to generate a score for each unimodal state during operation 214. In particular, the logarithmic function may be applied to the result of the unimodal analysis performed for the first unimodal state, the result of the unimodal analysis performed for the second unimodal state, and the result of the unimodal analysis performed for the third unimodal state. Thus, a first score for the first unimodal state, a second score for the second unimodal state, and a third score for the third unimodal state may be generated.

[0052] After the scores are generated, each of the first score, the second score, and the third score can be compared to a predefined threshold to determine whether any of the first unimodal state, the second unimodal state, or the third unimodal state is an anomaly. An anomaly can be defined as data corresponding to a potential malicious attack. In addition, during operation 216, those unimodal states identified as anomalies can be discarded. Discarding can include ignoring any data received during a time period associated with the unimodal state to be discarded.

[0053] Returning to the illustration, during operation 212, a unimodal analysis is performed on each of the first unimodal state 304, the second unimodal state 306, and the third unimodal state 308 using the ECDF technique. During operation 214, a logarithmic function is applied to the unimodal analysis results for the first unimodal state 304, the second unimodal state 306, and the third unimodal state 308 to generate a first score, a second score, and a third score. In addition, during operation 214, each of the first score, the second score, and the third score is compared with a threshold, wherein the first score and the third score are lower than the threshold. However, in the illustration, it is determined that the second score corresponding to the second unimodal state at the time of 12:00 am is an anomaly. Therefore, it is assumed that the update received during the second unimodal state 306 is related to a malicious attack. In particular, in the illustration, the update received during the second unimodal state 306 may be malware, which may cause a security vulnerability at the server device 102 and the developer platform 104 when downloaded. Therefore, during operation 216 , updates received at the second unimodal state 306 are discarded, thereby maintaining the security of the server device 102 and the developer platform 104 .

[0054] Figure 1 Any of the machines, databases, or devices shown may be implemented in a general-purpose computer that is modified (e.g., configured or programmed) by software to be a special-purpose computer to perform the functions described herein for that machine, database, or device. Figure 5 and Figure 6A computer system capable of implementing any one or more of the methods described herein is discussed. As used herein, a "database" is a data storage resource and may store data structured as a text file, a table, a spreadsheet, a relational database (e.g., an object-relational database), a triple store, a hierarchical data store, or any suitable combination thereof. In addition, Figure 1 Any two or more of the machines, databases, or devices shown in may be combined into a single machine, database, or device, and the functionality described herein for any single machine, database, or device may be divided among multiple machines, databases, or devices.

[0055] Figure 5 is a block diagram 500 illustrating a software architecture 502 that may be installed on any one or more of the devices described above. Figure 6 is merely a non-limiting example of a software architecture, and it will be appreciated that many other architectures may be implemented to facilitate the functionality described herein. Software architecture 502 may be comprised of, for example, Figure 6 5. The hardware implementation of a machine 600 of FIG. 5 includes a processor 602, memory 604 and 606, and I / O components 610 to 614. In this example, the software architecture 502 can be conceptualized as a stack of layers, each of which can provide specific functionality. For example, the software architecture 502 includes layers such as an operating system 504, a library 506, a framework 508, and an application 510. In operation, according to some implementations, the application 510 invokes an application programming interface (API) call 512 through the software stack and receives a message 514 in response to the API call 512.

[0056] In various implementations, the operating system 504 manages hardware resources and provides public services. The operating system 504 includes, for example, a core 520, a service 522, and a driver 524. In some implementations, the core 520 acts as an abstraction layer between the hardware and other software layers. For example, the core 520 provides functions such as memory management, processor management (e.g., scheduling), component management, networking, and security settings. The service 522 can provide other public services for other software layers. The driver 524 can be responsible for controlling the underlying hardware or docking with the underlying hardware. For example, the driver 524 may include a display driver, a camera driver, a Bluetooth driver, a flash driver, a serial communication driver (e.g., a universal serial bus (USB) driver), a Wi-Fi driver, an audio driver, a power management driver, etc.

[0057] In some implementations, the library 506 provides a low-level common infrastructure that can be utilized by the application 510. The library 506 may include a system library 530 (e.g., a C standard library) that may provide functions such as memory allocation functions, string manipulation functions, mathematical functions, etc. In addition, the library 506 may include an API library 532, such as: a media library (e.g., a library that supports the presentation and manipulation of various media formats, such as Moving Picture Experts Group 4 (MPEG4), Advanced Video Coding (H.264 or AVC), Moving Picture Experts Group Layer 3 (MP3), Advanced Audio Coding (AAC), Adaptive Multi-Rate (AMR) audio codec, Joint Photographic Experts Group (JPEG or JPG), or Portable Network Graphics (PNG)), a graphics library (e.g., an OpenGL framework for rendering in two dimensions (2D) and three dimensions (3D) in a graphics environment on a display), a database library (e.g., SQLite that provides various relational database functions), a web library (e.g., WebKit that provides web browsing functions), etc. The library 506 may also include various other libraries 534 to provide many other APIs to the application 510 .

[0058] According to some implementations, the framework 508 provides a high-level common infrastructure that can be utilized by the applications 510. For example, the framework 508 provides various graphical user interface (GUI) functions, advanced resource management, advanced location services, etc. The framework 508 can provide a wide range of other APIs that can be utilized by the applications 510, some of which can be specific to a particular operating system or platform.

[0059] In the example, the application 510 includes a home application 550, a contact application 552, a browser application 554, a book reader application 556, a location application 558, a media application 560, a messaging application 562, a game application 564, and a variety of other applications such as a third-party application 566. According to some examples, the application 510 is a program that executes the functions defined in the program. Various programming languages ​​such as object-oriented programming languages ​​(e.g., Objective-C, Java, or C++) or procedural programming languages ​​(e.g., C or assembly language) can be used to create one or more of the applications 510 constructed in various ways. In a specific example, the third-party application 566 (e.g., an application developed using an Android or iOS software development kit (SDK) by an entity other than a supplier of a specific platform) can be a mobile software running on a mobile operating system such as iOS, Android, Windows Phone, or other mobile operating systems. In this example, the third-party application 566 can activate an API call 512 provided by a mobile operating system (e.g., operating system 504) to facilitate the functions described herein.

[0060] Certain examples are described herein as including logic or multiple components, modules, or mechanisms. Modules may constitute software modules (e.g., code (1) on a non-transitory machine-readable medium or (2) implemented as a transmission signal) or hardware-implemented modules. Hardware-implemented modules are tangible units that are capable of performing certain operations and may be configured or arranged in a certain manner. In an example, one or more computer systems (e.g., stand-alone, client, or server computer systems) or one or more processors may be configured by software (e.g., an application or application portion) to operate as hardware-implemented modules that perform certain operations as described herein.

[0061] In various examples, hardware-implemented modules can be implemented mechanically or electronically. For example, a hardware-implemented module may include dedicated circuitry or logic that is permanently configured to perform certain operations (e.g., as a dedicated processor, such as a field programmable gate array (FPGA) or an application-specific integrated circuit (ASIC)). A hardware-implemented module may also include programmable logic or circuitry that is temporarily configured by software to perform certain operations (e.g., as included in a general-purpose processor or other programmable processor). It will be understood that the decision to implement a hardware-implemented module mechanically, with a dedicated permanently configured circuitry, or with a temporarily configured circuitry (e.g., configured by software) may be driven by cost and time considerations.

[0062] Therefore, the term "hardware-implemented module" should be understood to cover tangible entities, i.e., entities that are physically constructed, permanently configured (e.g., hardwired), or temporarily or provisionally configured (e.g., programmed) to operate in a particular manner and / or perform specific operations described herein. Considering an example in which a hardware-implemented module is temporarily configured (e.g., programmed), each of the hardware-implemented modules need not be configured or instantiated at any one time. For example, in the case where the hardware-implemented module includes a general-purpose processor configured using software, the general-purpose processor can be configured as different hardware-implemented modules at different times. Therefore, the software can configure the processor to, for example, constitute a specific hardware-implemented module at one time, and constitute different hardware-implemented modules at different times.

[0063] The module of hardware implementation can provide information to the module of other hardware implementation and receive information from the module of other hardware implementation.Therefore, the module of described hardware implementation can be regarded as being coupled in communication.In the case of multiple such hardware implementation modules simultaneously, communication can be realized by the signal transmission (for example, by suitable circuit and bus) that the module of hardware implementation is connected.In the example that multiple hardware implementation modules are configured or instantiated at different times, the communication between the modules of such hardware implementation can be realized, for example, by storing information in the memory structure that the modules of multiple hardware implementations can access and retrieving information in the memory structure.For example, a module of hardware implementation can perform operation, and the output of the operation is stored in the memory device that the module of this hardware implementation is coupled to.Then, the module of other hardware implementation can access the memory device at the subsequent time, to retrieve and process the stored output.The module of hardware implementation can also start the communication with input or output device, and can operate on resource (for example, the collection of information).

[0064] The various operations of the example methods described herein may be performed at least in part by one or more processors that are temporarily configured (e.g., by software) or permanently configured to perform the related operations. Whether temporarily configured or permanently configured, such a processor may constitute a processor-implemented module that operates to perform one or more operations or functions. In some examples, the modules mentioned herein may include processor-implemented modules.

[0065] Similarly, the method described herein can be implemented at least in part by a processor. For example, at least some operations in the operation of the method can be performed by a module implemented by one or more processors or processors. The execution of some operations can be distributed in one or more processors, not only resides in a single machine, but also can be deployed across multiple machines. In some examples, one or more processors can be located in a single location (for example, in a home environment, in an office environment, or as a server group), and in other examples, the processor can be distributed across multiple locations.

[0066] The one or more processors may also operate to support execution of related operations in a "cloud computing" environment or as "software as a service" (SaaS). For example, at least some of the operations may be performed by a set of computers (as an example of a machine including a processor) that are accessible via a network 108 (e.g., the Internet) and via one or more appropriate interfaces (e.g., an application program interface (API)).

[0067] Examples may be implemented in digital electronic circuitry, or in computer hardware, firmware, software, or a combination thereof. Examples may be implemented using a computer program product, such as a computer program tangibly embodied in an information carrier, such as a computer program in a machine-readable medium, for execution by a data processing apparatus (e.g., a programmable processor, a computer, or multiple computers) or for controlling the operation of the data processing apparatus.

[0068] The computer program may be written in any form of programming language including compiled or interpreted languages, and the computer program may be deployed in any form including as a stand-alone program or as a module, subroutine, or other unit suitable for use in a computing environment. The computer program may be deployed to be executed on one computer or on multiple computers, the multiple computers being located at one site or distributed across multiple sites and interconnected by a communication network.

[0069] The computing system may include a client and a server. The client and the server are usually far away from each other, and usually interact through a communication network. The relationship between the client and the server is generated by means of a computer program that runs on each computer and has a client-server relationship with each other. In the example of deploying a programmable computing system, it will be understood that both the hardware architecture and the software architecture need to be considered. Specifically, it will be understood that the choice of implementing a specific function in a permanently configured hardware (e.g., ASIC), in a temporarily configured hardware (e.g., a combination of software and a programmable processor), or in a combination of permanently configured and temporarily configured hardware can be a design choice. The hardware architecture (e.g., machine) and software architecture that can be deployed in various examples are described below.

[0070] Figure 6It is a block diagram of a machine, in which instructions can be executed to make the machine perform any one or more of the methods discussed herein. In one example, the machine can be any of the above-mentioned devices. In an alternative example, the machine operates as a stand-alone device or can be connected (e.g., networked) to other machines. In a networked deployment, the machine can run as a server machine or client machine in a server-client network environment, or run as a peer machine in a peer (or distributed) network environment. The machine can be a personal computer (PC), a tablet PC, a set-top box (STB), a personal digital assistant (PDA), a cellular phone, a web device, a network router, a switch or a bridge or any machine that can (sequentially or otherwise) perform instructions specifying the action to be taken by the machine. In addition, although only a single machine is shown, the term "machine" should also be understood to include any collection of machines, which individually or jointly perform a set (or multiple groups) of instructions to perform any one or more of the methods discussed herein.

[0071] The example computer system 600 includes a processor 602 (e.g., a central processing unit (CPU), a graphics processing unit (GPU), or both), a main memory 604, and a static memory 606 that communicate with each other via a bus 608. The computer system 600 may also include a video display unit 610 (e.g., a liquid crystal display (LCD) or a cathode ray tube (CRT)). The computer system 600 also includes an alphanumeric input device 612 (e.g., a keyboard), a user interface (UI) navigation device (cursor control device) 614 (e.g., a mouse), a hard disk drive unit 616, a signal generating device 618 (e.g., a speaker), and a network interface device 620.

[0072] The drive unit 616 includes a machine-readable medium 622 on which is stored one or more sets of instructions and data structures (e.g., software) 624 that embody or are utilized by any one or more of the methods or functions described herein. The instructions 624 may also reside in whole or at least in part within the main memory 604 and / or within the processor 602 during execution thereof by the computer system 600, the main memory 604 and the processor 602 also constituting machine-readable media. The instructions 624 may also reside within the static memory 606.

[0073] Although the machine-readable medium 622 is shown as a single medium in the example, the term "machine-readable medium" may include a single medium or multiple media (e.g., a centralized or distributed database, and / or associated caches and servers) storing one or more instructions or data instructions 624. The term "machine-readable medium" should also be considered to include: any tangible medium capable of storing, encoding or carrying instructions 624, or any tangible medium capable of storing, encoding or carrying data structures utilized by or associated with these instructions 624, which are executed by the machine and cause the machine to perform any one or more of the methods of the present invention. Therefore, the term "machine-readable medium" should be considered to include, but is not limited to, solid-state memory and optical and magnetic media. Specific examples of machine-readable media include non-volatile memory, which includes, by way of example: semiconductor memory devices, such as erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), and flash memory devices; magnetic disks, such as internal hard disks and removable disks; magneto-optical disks; and CD-ROM and DVD-ROM disks.

[0074] Instructions 624 may also be sent or received over network 116 using a transmission medium. Instructions 624 may be sent using a network interface device 620 and any of a number of well-known transmission protocols (e.g., HTTP). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), the Internet, a mobile telephone network, a plain old telephone (POTS) network, and wireless data networks (e.g., Wi-Fi and Wi-Max networks). The term "transmission medium" shall be taken to include any intangible medium that is capable of storing, encoding, or carrying instructions 624 to be executed by the machine and includes digital or analog communications signals, or other intangible media that facilitates communication of such software.

[0075] In various illustrative examples, one or more portions of network 116 may be an ad hoc network, an intranet, an extranet, a VPN, a LAN, a WLAN, a WAN, a WWAN, a MAN, the Internet, a portion of the Internet, a portion of the PSTN, a Plain Old Telephone Service (POTS) network, a cellular telephone network, a wireless network, a Wi-Fi network, another type of network, or a combination of two or more such networks. For example, network 116 or a portion of network 116 may include a wireless or cellular network, and connector 682 may be a Code Division Multiple Access (CDMA) connection, a Global System for Mobile Communications (GSM) connection, or another type of cellular or wireless connector. In this example, the connector can implement any of various types of data transmission technologies, such as single carrier radio transmission technology (1xRTT), evolution data optimization (EVDO) technology, general packet radio service (GPRS) technology, GSM evolution enhanced data rate (EDGE) technology, including 3G third generation partnership project (3GPP), fourth generation wireless (4G) network, universal mobile telecommunications system (UMTS), high speed packet access (HSPA), global microwave access interoperability (WiMAX), long term evolution (LTE) standard, other standards defined by various standard setting organizations, other remote protocols or other data transmission technologies. Although the examples have been described with reference to specific examples, it will be apparent that various modifications and changes can be made to these examples without departing from the broader spirit and scope of the present invention. Therefore, the specification and the drawings should be considered illustrative rather than restrictive. The drawings forming part of this article are illustrated in a non-limiting manner and illustrate specific examples of the subject matter that can be practiced. The examples shown are described in sufficient detail to enable those skilled in the art to practice the teachings disclosed herein. Other examples can be used and derived therefrom so that structural and logical replacements and changes can be made without departing from the scope of the present disclosure. This Detailed Description, therefore, is not to be taken in a limiting sense, and the scope of various examples is defined only by the appended claims, along with the full scope of equivalents to which such claims are entitled.

[0076] For convenience only, the term "invention" may be used herein to refer to such examples of the subject matter of the present invention individually and / or collectively, and if more than one invention or inventive concept is in fact disclosed, it is not intended to actively limit the scope of the present application to any single invention or inventive concept. Therefore, although specific examples have been shown and described herein, it should be understood that the specific examples shown can be replaced with any arrangement intended to achieve the same purpose. The present disclosure is intended to cover any and all adjustments or variations of the various examples. For those skilled in the art, after reviewing the above description, the combination of the above examples and other examples not specifically described herein will be obvious.

[0077] An abstract of the present disclosure is provided to comply with 37 CFR § 1.72 (b), which requires an abstract that will enable the reader to quickly determine the nature of the technical disclosure. The abstract is submitted with the understanding that it will not be used to interpret or limit the scope or meaning of the claims. In addition, in the foregoing detailed description, it can be seen that various features are combined together in a single example for the purpose of streamlining the present disclosure. This approach to the present disclosure should not be interpreted as reflecting the intention that the claimed examples require more features than those explicitly listed in each claim. On the contrary, as reflected in the appended claims, the subject matter of the invention lies in less than all the features in a single disclosed example. Therefore, the appended claims are thereby incorporated into the detailed description, wherein each claim independently serves as a separate example.

[0078] The terms "machine-readable medium," "computer-readable medium," and "device-readable medium" mean the same thing and are used interchangeably in this disclosure. These terms are defined to include both machine storage media and transmission media. Thus, these terms include both storage devices / medium and carrier / modulated data signals.

Claims

1. A method for detecting anomalies in a system, the method comprising: Receiving data and organizing the data according to a plurality of time periods and a number of updates for each of the plurality of time periods, the organized data approximating a first unimodal state and a second unimodal state, the first unimodal state having a first peak value, and the second unimodal state having a second peak value; identifying depressions across the plurality of time periods; determining a density of the depressions; comparing the density of the depressions with a predetermined threshold; determining whether the depression is a selectable morphology based on the comparison; In response to the depression being a selectable morphology, performing a unimodal analysis on the first unimodal state and the second unimodal state; determining whether the second unimodal state is an anomaly in the system based on the unimodal analysis; Updates associated with the second unimodal state are discarded.

2. The method according to claim 1, wherein: The first single peak spans a first time period among the multiple time periods, the second single peak spans a second time period among the multiple time periods, and the depression spans a third time period among the multiple time periods, wherein the first peak is defined by a first peak number of updates received at a first peak time period in the first time period, and the second peak is defined by a second peak number of updates received at a second peak time period in the second time period.

3. The method according to claim 2, wherein: The third time period is between the first time period and the second time period, and identifying the notch includes identifying an extension of the first single peak across the first time period and an extension of the second single peak across the second time period.

4. The method according to claim 2, wherein: The organized data approximates a fourth unimodal state across a fourth time period of the plurality of time periods, the fourth unimodal state having a fourth peak value defined by a fourth peak number of updates received at a fourth peak time period of the fourth time period.

5. The method according to claim 4, further comprising: determining a fourth number of updated densities at the fourth unimodal state; performing a unimodal analysis on the fourth unimodal state; Based on performing the unimodal analysis on the first unimodal state and the fourth unimodal state, determining to perform the first number of updates and the fourth number of updates is performed.

6. The method according to claim 2, wherein: The data includes metadata associated with the update, the metadata including: the date and time associated with when the data was received; and The author of the update in question.

7. The method according to claim 6, wherein: The first time period occurs during a recurring time period associated with receiving a new update, and the second time period occurs after the recurring time period.

8. The method according to claim 1, wherein: determining a first number of updated first densities at the first unimodal state; determining a second number of updated second densities at the second unimodal state; and An updated third density of a third number at the depression is determined, and the method further includes comparing each of the first density, the second density, and the third density with a threshold, wherein comparing each of the first density, the second density, and the third density with the predetermined threshold further includes applying a logarithmic function to each of the first density, the second density, and the third density to generate a first score, a second score, and a third score, wherein each of the first score, the second score, and the third score is compared with the predetermined threshold, and when the third score is above the predetermined threshold, the depression is determined to be the optional form.

9. A non-transitory machine-readable medium having instructions embodied thereon, the instructions being executable by a processor of a machine to perform operations comprising: Receiving data and organizing the data according to a plurality of time periods and a number of updates for each of the plurality of time periods, the organized data approximating a first unimodal state and a second unimodal state, the first unimodal state having a first peak value, and the second unimodal state having a second peak value; identifying depressions across the plurality of time periods; determining a density of the depressions; comparing the density of the depressions with a predetermined threshold; determining whether the depression is a selectable morphology based on the comparison; In response to the depression being a selectable morphology, performing a unimodal analysis on the first unimodal state and the second unimodal state; determining whether the second unimodal state is an anomaly in the system based on the unimodal analysis; Updates associated with the second unimodal state are discarded.

10. The non-transitory machine-readable medium of claim 9, wherein: The first single peak spans a first time period among the multiple time periods, the second single peak spans a second time period among the multiple time periods, and the depression spans a third time period among the multiple time periods, wherein the first peak is defined by a first peak number of updates received at a first peak time period in the first time period, and the second peak is defined by a second peak number of updates received at a second peak time period in the second time period.

11. The non-transitory machine-readable medium of claim 10, wherein: The third time period is between the first time period and the second time period, and identifying the notch includes identifying an extension of the first single peak across the first time period and an extension of the second single peak across the second time period.

12. The non-transitory machine-readable medium of claim 10, wherein: The organized data approximates a fourth unimodal state across a fourth time period of the plurality of time periods, the fourth unimodal state having a fourth peak value defined by a fourth peak number of updates received at a fourth peak time period of the fourth time period.

13. The non-transitory machine-readable medium of claim 12, the method further comprising: determining that the second unimodal state and the second time period are outliers among the plurality of time periods; as well as It is determined whether the second time period occurs before the first time period or after the fourth time period.

14. The non-transitory machine-readable medium of claim 10, wherein: The data includes metadata associated with the update, the metadata including: the date and time associated with when the data was received; and The author of an update in the updates, wherein the first time period occurs during a recurring time period associated with receiving new updates and the second time period occurs after the recurring time period.

15. The non-transitory machine-readable medium of claim 9, wherein: determining a first number of updated first densities at the first unimodal state; determining a second number of updated second densities at the second unimodal state; and An updated third density of a third number at the depression is determined, and the operation also includes comparing each of the first density, the second density, and the third density with a threshold, wherein comparing each of the first density, the second density, and the third density with the predetermined threshold further includes applying a logarithmic function to each of the first density, the second density, and the third density to generate a first score, a second score, and a third score, wherein each of the first score, the second score, and the third score is compared with the predetermined threshold, and when the third score is above the predetermined threshold, the depression is determined to be the selectable morphology.

16. A device comprising: processor; as well as a memory including instructions that, when executed by the processor, cause the device to perform operations including: Receiving data and organizing the data according to a plurality of time periods and a number of updates for each of the plurality of time periods, the organized data approximating a first unimodal state and a second unimodal state, the first unimodal state having a first peak value, and the second unimodal state having a second peak value; identifying depressions across the plurality of time periods; determining a density of the depressions; comparing the density of the depressions with a predetermined threshold; determining whether the depression is a selectable morphology based on the comparison; In response to the depression being a selectable morphology, performing a unimodal analysis on the first unimodal state and the second unimodal state; determining whether the second unimodal state is an anomaly in the system based on the unimodal analysis; Updates associated with the second unimodal state are discarded.

17. The device according to claim 16, wherein: The first single peak spans a first time period among the multiple time periods, the second single peak spans a second time period among the multiple time periods, and the depression spans a third time period among the multiple time periods, wherein the first peak is defined by a first peak number of updates received at a first peak time period in the first time period, and the second peak is defined by a second peak number of updates received at a second peak time period in the second time period.

18. The apparatus according to claim 17, wherein: The third time period is between the first time period and the second time period, and identifying the notch includes identifying an extension of the first single peak across the first time period and an extension of the second single peak across the second time period.

19. The apparatus according to claim 17, wherein: The data includes metadata associated with the update, the metadata including: the date and time associated with when the data was received; and The author of an update in the updates, wherein the first time period occurs during a recurring time period associated with receiving new updates and the second time period occurs after the recurring time period.

20. The apparatus of claim 16, wherein: determining a first number of updated first densities at the first unimodal state; determining a second number of updated second densities at the second unimodal state; and An updated third density of a third number at the depression is determined, and the operation also includes comparing each of the first density, the second density, and the third density with a threshold, wherein comparing each of the first density, the second density, and the third density with the predetermined threshold further includes applying a logarithmic function to each of the first density, the second density, and the third density to generate a first score, a second score, and a third score, wherein each of the first score, the second score, and the third score is compared with the predetermined threshold, and when the third score is above the predetermined threshold, the depression is determined to be the selectable morphology.

Images