83 results about "Anomalous behavior" patented technology

Detecting anomalous behavior of nodes in a hierarchical cloud deployment, including: gathering data describing a cloud deployment as a hierarchy of a plurality of nodes; presenting a graph depicting behavior at a particular hierarchical level of at least a subset of the plurality of nodes; and determining whether behavior associated with a particular node deviates from normal behavior based on a hierarchical portion of plurality of nodes including the particular node.

A risk determination method constituted of: receiving incident information associated with an item, the incident information comprising information regarding detected anomalous behavior in the item or information regarding a detected vulnerability in the item; based at least in part on the received incident information, identifying one or more attack steps of one or more attack paths, each of the one or more attack paths associated with a respective one of a plurality of assets contained within the item; and for each respective asset, adjusting one or more respective risk levels based at least in part on the identified one or more attack steps associated with the respective asset.

A system and method for detecting anomalies and malicious processes by analyzing current consumption profiles is disclosed. The technique involves generating current consumption profiles that characterize the expected power draw for known software applications operating in various modes on a target device. At runtime, the current being consumed by actively running applications is measured and compared to the total expected current draw determined from the individual profiles. Deviations between the observed and expected consumption indicate potential interference from malware or other unwanted processes. Additionally, current fluctuation profiles are generated to model the characteristic transient current behavior when applications transition between operational modes. By comparing runtime current measurements during state changes to these expected transitional profiles, the system can identify aberrations indicative of background malware triggering during the transitions. The current monitoring approach provides an efficient way to detect anomalous behavior from unwanted processes with minimal overhead.

Methods and systems for detecting anomalous software behavior by monitoring frequency spectrums emanating from an electronic device are provided. A method includes storing frequency spectrum profiles for software applications and operational modes on the device. During execution of a software application, the real-time emanating frequency spectrum is measured and compared to the stored spectrum profile for that application and operational mode. Deviations between the real-time and reference spectrums indicate anomalous behavior from unknown software executing. The device determines a deviation exists and performs remedial actions like alerting the user, disconnecting from the network, shutting down, or switching application execution to another device. Frequency profiles are measured for new applications installed and stored to keep the data updated. Monitoring real-time frequency spectrums emanating from a device provides a computationally lightweight technique for detecting malicious software behavior without requiring complex analysis of application code.

Systems and methods of handling sessions between client devices and one or more server based on session classifications are provided. A device identifies a time series of security metrics corresponding to requests received during a session established by a client device to access a resource provided by one or more servers. The device generates security features from the time series of security metrics based on one or more time windows. The device classifies the session as one of anomalous or genuine using the security features generated from the time series of security metrics based on the one or more time windows. The device handles subsequent requests received during the session based on the classification of the session as the one of anomalous or genuine.

A method includes generating a product knowledge causal graph based on causal relationships between multiple sensors in one or more manufacturing systems, parts data of a plurality of parts of the manufacturing system, and equipment constant data of a plurality of equipment constants of the manufacturing system. The method further includes determining a causal strength index matrix. The method further includes, responsive to identifying an anomalous behavior in at least one of the plurality of sensors, determining a root cause of the anomalous behavior using at least one of the causal strength index matrix or the product knowledge causal graph. The method further includes identifying, based on at least a subset of the parts data corresponding to the root cause of the anomalous behavior, or a subset of the equipment constant data corresponding to the root cause of the anomalous behavior, at least one corrective action for the anomalous behavior.

A computer-implemented method of configuring an anomalous behavior detector includes updating a distribution used for modeling anomalous behavior in telemetry data with information associated with observed anomalous behavior to generate an updated distribution representative of the observed anomalous behavior where, prior to the updating, the distribution is representative of theoretical anomalous behavior. The method further includes computing a threshold for a detector operable to alert on anomalous activity using the updated distribution. The method also comprises computing a divergence between the live telemetry data monitored by the detector and the anomalous behavior modeled by the updated distribution. Responsive to a determination that the divergence is above a critical threshold, the method comprises enabling the detector to continue to monitor the live telemetry data in the application.

Methods, apparatus, and processor-readable storage media for detection of anomalous behavior on online platforms using machine learning techniques are provided herein. An example method includes obtaining a set of machine learning models configured to detect anomalous behavior associated with users interacting with an online platform and performing an incremental machine learning process on one or more of the machine learning models in the set. The incremental machine learning process may include obtaining data related to interactions of users with the online platform, updating at least one of the machine learning models in the set based on the obtained data, comparing the machine learning models, and selecting one of the machine learning models from the set to be used by the online platform based on the comparison. The method may further include determining, utilizing the selected machine learning model, that a given user is exhibiting anomalous behavior on the online platform.

A system, method, and computer-program product includes obtaining, via an application programming interface (API), a test object that includes application usage data of a deployed AI application for a target time span, executing, in real-time by one or more computer processors, one or more application behavior tests that assess an operational behavior of the deployed AI application, detecting, by the one or more computer processors, that a misbehavior occurred in the deployed AI application during the target time span and one or more deviant features contributing to the misbehavior in response to executing the one or more application behavior tests, and returning, by the one or more computer processors, the one or more deviant features contributing to the misbehavior to a subscribing entity associated with the deployed AI application.

Methods, apparatus, and processor-readable storage media for detection of anomalous behavior on online platforms using machine learning techniques are provided herein. An example method includes obtaining a set of machine learning models configured to detect anomalous behavior associated with users interacting with an online platform and performing an incremental machine learning process on one or more of the machine learning models in the set. The incremental machine learning process may include obtaining data related to interactions of users with the online platform, updating at least one of the machine learning models in the set based on the obtained data, comparing the machine learning models, and selecting one of the machine learning models from the set to be used by the online platform based on the comparison. The method may further include determining, utilizing the selected machine learning model, that a given user is exhibiting anomalous behavior on the online platform.

Methods, systems, apparatuses, and computer-readable storage mediums described herein are configured to detect anomalous post-authentication behavior with respect to a user identity. For example, one or more audit logs that specify a plurality of actions performed with respect to the user identity of a platform-based identity service, while the user identity is authenticated with the platform-based identity service, are analyzed. The audit log(s) are analyzed via an anomaly prediction model that generates an anomaly score indicating a probability whether a particular sequence of actions of the plurality of actions is indicative of anomalous behavior. A determination is made that an anomalous behavior has occurred based on the anomaly score. In response to determining that anomalous behavior has occurred, a mitigation action may be performed that mitigates the anomalous behavior.

Techniques for detecting anomalous behavior of an Internet-of-Things (IoT) device in an IoT network. IoT events of an IoT device are captured and analyzed to identify periodic activities of the IoT device. The periodic activities of the IoT device are tracked over time, and variations in the periodic activities are analyzed to assess potential threats to the IoT network.

Disclosed herein are techniques for detecting anomalous computing environment behavior. Techniques include fusing computer code parameters with hardware performance data associated with at least one device to form a kernel, the computer code parameters being associated with computer code configured for the at least one device; inputting the kernel to a trained model configured to detect execution performance anomalies of the at least one device, the trained model having been trained with a plurality of reference data patterns; and receiving, from the trained model, a detection output based on the kernel, the detection output indicating an anomalous behavior.

The invention relates to the technical field of behavior monitoring during operation, in particular to an execution exception monitoring system and method based on IPD13. According to the execution exception monitoring system and method based on IPD13, through accurate mapping of instruction blocks of execution logs and execution records and jump control flows, an execution path diagram can be effectively constructed, and each detail in program operation can be accurately captured; the method comprises the following steps of: identifying a potential jump path and an abnormal behavior, comparing execution paths segment by segment through a graph neural network, and calculating the similarity, so that not only can the paths which are not matched with a standard graph structure be accurately identified, but also the abnormal paths can be marked in time, thereby preventing the influence of potential system abnormality on stability and performance, and improving the reliability of the system. Through acquisition of the execution frequency and calculation of the node frequency deviation, the nodes showing abnormal behaviors in the system can be identified in time, the nodes are clustered into the abnormal behavior segments, and the abnormal nodes are further generated, so that early warning of the abnormal behaviors is ensured, and the probability of serious faults is reduced.

To provide a method for detecting anomalous behavior.SOLUTION: Operations include extracting a depiction of a person and associated movement of the person from a first video clip of a first training video included in a first domain dataset. The operations further include superimposing the depiction of the person and corresponding movement into a second video clip of a second training video included in a second domain dataset to generate a third video clip. The operations also include annotating the third video clip to indicate that the movement of the person corresponds to a particular type of behavior, the annotating being based on the first video clip also being annotated to indicate that the movement of the person corresponds to the particular type of behavior. Moreover, the operations include training a machine learning model to identify the particular type of behavior using the second training video having the annotated third video clip included therewith.SELECTED DRAWING: Figure 1B

A data enrichment method, the method constituted of: receiving incident information associated with an incident in a target of interest; based at least in part on the received incident information, analyzing data associated with the target of interest to identify: an effect of the incident within the target of interest, and existing one or more mitigations associated with the incident; and outputting information regarding the incident, the output information comprising the identified effect and identified one or more mitigations, wherein the incident information comprises information regarding detected anomalous behavior in the target of interest or information regarding a detected vulnerability in the target of interest, and wherein the analyzed data is based on a plurality of sources.

Detection of anomalous computing environment behavior using glucose is described. An anomaly detection system receives glucose measurements and event records during a first time period. Missing events that are missing from the event records during the first time period are identified by processing the glucose measurements using an event engine simulator. An anomaly detection model is generated based on the missing events during the first time period. Subsequently, the anomaly detection system receives additional glucose measurements and additional event records during a second time period. Missing events that are missing from the additional event records during the second time period are identified by processing the additional glucose measurements using the event engine simulator. Anomalous behavior is detected if the identified missing events that are missing from the event records during the second time period are outside a predicted range of missing events of the anomaly detection model.

The application relates to an abnormal behavior detection method, device and equipment and a storage medium. The method comprises the following steps: acquiring a process operation behavior sequence, dividing the process operation behavior sequence into a plurality of to-be-detected sequences, each to-be-detected sequence comprising a plurality of user process operation behaviors, and each user process operation behavior comprising a plurality of field information; performing feature extraction based on the attribute values of the plurality of field information of each process operation behavior in the to-be-detected sequence to obtain a feature vector corresponding to the to-be-detected sequence; performing abnormality detection on the feature vectors corresponding to the to-be-detected sequences, determining an abnormal feature vector as a feature vector detected as abnormal; determining the abnormality degrees of each dimension feature in the abnormal feature vector; determining the feature items existing in the abnormal feature vector based on the abnormality degrees of each dimension feature in the abnormal feature vector; and the application can improve the accuracy and efficiency of user abnormal behavior detection.

Various embodiments of the present technology generally relate to industrial automation environments. More specifically, embodiments include systems and methods to detect malicious behavior in an industrial automation environment. In some examples, a security component monitors an integrated design application and generates feature vectors that represent operations of the integrated design application. The security component supplies the feature vectors to a machine learning engine. The security component processes a machine learning output that indicates when anomalous behavior is detected in the operations of the integrated design application. When anomalous behavior is detected in the operations of the integrated design application, the security component generates and transfers an alert that characterizes the anomalous behavior.

Disclosed herein is a method for use in detection of anomalous behavior of a device of a computer system. The method is arranged to be performed by a processing system. The method includes deriving values, m1, . . . , mN, of a metric, M, representative of data associated with the device; modeling a distribution of the values; and determining, in accordance with the distribution of the values, the probability of observing a more extreme value of the metric than a given value, m, of the metric, wherein the probability is used to determine whether the device is behaving anomalously. Also disclosed is an equivalent computer readable medium and anomalous behavior detection system

The present disclosure relates to a system for determining anomalous behavior. The system comprises a processing device that is configured to generate first segmentation information and second segmentation information from the video feed, the first segmentation information corresponding to a first potential occupant and the second segmentation information corresponding to a second potential occupant. The processing device further configured to determine that the first segmentation information and the second segmentation information correspond to actual occupants based on the first segmentation information and the second segmentation information, and generate a first bounding box associated with the first segmentation information and a second bounding box associated with the second segmentation information. The processing device further configured to determine an intersection over union (IOU) region for the first bounding box and the second bounding box, identify anomalous behavior based on the IOU region, and generate one or more alerts identifying the anomalous behavior.

Detecting and mitigating anomalous system behavior by providing a machine learning model comprising a knowledge graph depicting system entity relationships, and modeling behavioral correlations among system entities according to historical time-series data, receiving real-time time-series data for the system, detecting an anomalous system behavior in a system locale, according to the real-time time-series data, according to the machine learning model and multivariate sensor metrics, diagnosing the anomalous system behavior according to an upstream portion of the knowledge graph and a statistical behavior model for the system locale, and mitigating the anomalous behavior by deriving a recommended action according to the anomalous behavior and generating a work order to implement the recommended action.

Embodiments of the invention provide an abnormal behavior detection method and device, and a storage medium. The method comprises the steps of collecting a to-be-detected behavior set belonging to the same session in a preset time window; adding a tag to each behavior in the to-be-detected behavior set, and obtaining tag features of the to-be-detected behavior set according to the tags of all behaviors in the to-be-detected behavior set; according to a preset embedded feature extraction model, mapping the tag features of the to-be-detected behavior set into embedded features; and judging whether the to-be-detected behavior set is abnormal or not based on the embedded features of the to-be-detected behavior set and pre-acquired embedded features of a historical behavior set. According to the method, each behavior in the to-be-detected behavior set is represented in a natural language through a tag mode, tags of all behaviors in the to-be-detected behavior set are quantified into tag features and then mapped into embedded features, high interpretability is achieved, abnormal behavior recognition is carried out based on the embedded features, recognition accuracy can be improved, and false alarms are reduced.

A method for controlling a plurality of half-bridges (HB1...HBN), said controlling comprising, upon occurrence of a given condition, in particular an anomalous behavior, performing a shut-down (203) of at least a half-bridge (HBi) in said plurality of half-bridges (HB1...HBN), characterized in that said method comprises: associating (201) to each half-bridge (HBi) of said plurality of half-bridges ((HB1...HBN) a corresponding register (Ri) storing a link information (K) indicating which other half-bridge or half-bridges in said plurality of half-bridges (HB1...HBN) is linked to said half-bridge (HBi), decoding (202) said link information (K) obtaining a decoded link information indicating which other half-bridge or half-bridges in said plurality of half-bridges (HB1...HBN) is linked to said half-bridge (HBi), performing said shutting down (203) on said at least half-bridge (HBi) and on the other half-bridge or half-bridges in said plurality of half-bridges (HB1...HBN) indicated as linked to said half-bridge (HBi) by said decoded link information.

A system and method collects activity data from one or more data sources recording activities of users and other entities and identifies anomalous activity using a statistical analysis of behaviors that are defined using one or more activities, optionally performed in a sequence, optionally performed within a limited time period, and optionally meeting or being excluded from, a filter. The analysis may incorporate the use of a normal, and any number of special, periods, where the analysis uses data from prior periods of the same type.

Operations include extracting a depiction of a person and associated movement of the person from a first video clip of a first training video included in a first domain dataset. The operations further include superimposing the depiction of the person and corresponding movement into a second video clip of a second training video included in a second domain dataset to generate a third video clip. The operations also include annotating the third video clip to indicate that the movement of the person corresponds to a particular type of behavior, the annotating being based on the first video clip also being annotated to indicate that the movement of the person corresponds to the particular type of behavior. Moreover, the operations include training a machine learning model to identify the particular type of behavior using the second training video having the annotated third video clip included therewith.

Systems and methods include reception of time-series data of a metric for each of a plurality of computer servers, determination, for each computer server, of a representative value of the metric based on the time-series data of the metric for the computer server, determination, for each computer server, of a fluctuation value of the metric based on the time-series data of the metric for the computer server, determination of a standard value of the metric based on the determined representative values, determination of a standard fluctuation value based on the determined fluctuation values, determination, for each computer server, of a difference value based on a difference between the standard value and the representative value for the computer server and a difference between the standard fluctuation value and the fluctuation value for the computer server; and identification of one or more anomalous computer servers based on the difference values.

A method and a system for detecting an anomalous sequence of events in stream data are provided. The method includes: receiving a first set of raw data; analyzing the first set of raw data in order to determine a first event sequence; applying a first Hidden Markov Model (HMM) to the first event sequence in order to generate a first output; and determining, based on the first output, whether the first event sequence is classifiable as being an anomalous event sequence. The HMM is trained by using known sequences of normal events and event sequences that are known to be anomalous.

Disclosed in the present invention are a dynamic topology-based method and apparatus for analyzing a collective anomalous behavior. The method comprises: acquiring examination monitoring video data of an examination room; selecting key frames from examination frame data, performing portrait identification on the key frames sequentially, and labelling examinee information in the key frames; constructing a skeleton topology of each examinee, and continuously monitoring the skeleton topology and the examination monitoring video data; sequentially recording a suspicious posture of each skeleton topology, and, on the basis of coordinate information in the examination monitoring video data of the skeleton topology with the suspicious posture, obtaining an actual interval distance between the skeleton topologies with the suspicious postures; using two skeleton topologies with suspicious postures corresponding to the actual interval distance as an anomalous behavior skeleton, and outputting the examinee information labelled in the anomalous behavior skeleton, so as to complete the analysis of the collective anomalous behavior. The present invention solves the technical problem of failing to accurately and efficiently detect and analyze collective anomalous behaviors of examinees in the prior art.

An anomalous behavior is detected at an AI server device based on data communications managed by the wireless controller. In response to the detected behavior, a robot module can be deployed to a location of the anomalous behavior for testing. Once at the location, logs can be collected from testing or troubleshooting at the location and involving a remote access point proximate to the anomalous behavior (e.g., sniff and capture at specific channel or multiple channels in real-time). Solutions are generated from AI analysis concerning the anomalous behavior and priority level, including at least one automatically implemented solution to self-remediate the wireless network.