50 results about "Anomalous behavior" patented technology

Detecting anomalous behavior of nodes in a hierarchical cloud deployment, including: gathering data describing a cloud deployment as a hierarchy of a plurality of nodes; presenting a graph depicting behavior at a particular hierarchical level of at least a subset of the plurality of nodes; and determining whether behavior associated with a particular node deviates from normal behavior based on a hierarchical portion of plurality of nodes including the particular node.

A system and method for detecting anomalies and malicious processes by analyzing current consumption profiles is disclosed. The technique involves generating current consumption profiles that characterize the expected power draw for known software applications operating in various modes on a target device. At runtime, the current being consumed by actively running applications is measured and compared to the total expected current draw determined from the individual profiles. Deviations between the observed and expected consumption indicate potential interference from malware or other unwanted processes. Additionally, current fluctuation profiles are generated to model the characteristic transient current behavior when applications transition between operational modes. By comparing runtime current measurements during state changes to these expected transitional profiles, the system can identify aberrations indicative of background malware triggering during the transitions. The current monitoring approach provides an efficient way to detect anomalous behavior from unwanted processes with minimal overhead.

Methods and systems for detecting anomalous software behavior by monitoring frequency spectrums emanating from an electronic device are provided. A method includes storing frequency spectrum profiles for software applications and operational modes on the device. During execution of a software application, the real-time emanating frequency spectrum is measured and compared to the stored spectrum profile for that application and operational mode. Deviations between the real-time and reference spectrums indicate anomalous behavior from unknown software executing. The device determines a deviation exists and performs remedial actions like alerting the user, disconnecting from the network, shutting down, or switching application execution to another device. Frequency profiles are measured for new applications installed and stored to keep the data updated. Monitoring real-time frequency spectrums emanating from a device provides a computationally lightweight technique for detecting malicious software behavior without requiring complex analysis of application code.

A method includes generating a product knowledge causal graph based on causal relationships between multiple sensors in one or more manufacturing systems, parts data of a plurality of parts of the manufacturing system, and equipment constant data of a plurality of equipment constants of the manufacturing system. The method further includes determining a causal strength index matrix. The method further includes, responsive to identifying an anomalous behavior in at least one of the plurality of sensors, determining a root cause of the anomalous behavior using at least one of the causal strength index matrix or the product knowledge causal graph. The method further includes identifying, based on at least a subset of the parts data corresponding to the root cause of the anomalous behavior, or a subset of the equipment constant data corresponding to the root cause of the anomalous behavior, at least one corrective action for the anomalous behavior.

Methods, apparatus, and processor-readable storage media for detection of anomalous behavior on online platforms using machine learning techniques are provided herein. An example method includes obtaining a set of machine learning models configured to detect anomalous behavior associated with users interacting with an online platform and performing an incremental machine learning process on one or more of the machine learning models in the set. The incremental machine learning process may include obtaining data related to interactions of users with the online platform, updating at least one of the machine learning models in the set based on the obtained data, comparing the machine learning models, and selecting one of the machine learning models from the set to be used by the online platform based on the comparison. The method may further include determining, utilizing the selected machine learning model, that a given user is exhibiting anomalous behavior on the online platform.

A system, method, and computer-program product includes obtaining, via an application programming interface (API), a test object that includes application usage data of a deployed AI application for a target time span, executing, in real-time by one or more computer processors, one or more application behavior tests that assess an operational behavior of the deployed AI application, detecting, by the one or more computer processors, that a misbehavior occurred in the deployed AI application during the target time span and one or more deviant features contributing to the misbehavior in response to executing the one or more application behavior tests, and returning, by the one or more computer processors, the one or more deviant features contributing to the misbehavior to a subscribing entity associated with the deployed AI application.

Techniques for detecting anomalous behavior of an Internet-of-Things (IoT) device in an IoT network. IoT events of an IoT device are captured and analyzed to identify periodic activities of the IoT device. The periodic activities of the IoT device are tracked over time, and variations in the periodic activities are analyzed to assess potential threats to the IoT network.

Disclosed herein are techniques for detecting anomalous computing environment behavior. Techniques include fusing computer code parameters with hardware performance data associated with at least one device to form a kernel, the computer code parameters being associated with computer code configured for the at least one device; inputting the kernel to a trained model configured to detect execution performance anomalies of the at least one device, the trained model having been trained with a plurality of reference data patterns; and receiving, from the trained model, a detection output based on the kernel, the detection output indicating an anomalous behavior.

The invention relates to the technical field of behavior monitoring during operation, in particular to an execution exception monitoring system and method based on IPD13. According to the execution exception monitoring system and method based on IPD13, through accurate mapping of instruction blocks of execution logs and execution records and jump control flows, an execution path diagram can be effectively constructed, and each detail in program operation can be accurately captured; the method comprises the following steps of: identifying a potential jump path and an abnormal behavior, comparing execution paths segment by segment through a graph neural network, and calculating the similarity, so that not only can the paths which are not matched with a standard graph structure be accurately identified, but also the abnormal paths can be marked in time, thereby preventing the influence of potential system abnormality on stability and performance, and improving the reliability of the system. Through acquisition of the execution frequency and calculation of the node frequency deviation, the nodes showing abnormal behaviors in the system can be identified in time, the nodes are clustered into the abnormal behavior segments, and the abnormal nodes are further generated, so that early warning of the abnormal behaviors is ensured, and the probability of serious faults is reduced.

A data enrichment method, the method constituted of: receiving incident information associated with an incident in a target of interest; based at least in part on the received incident information, analyzing data associated with the target of interest to identify: an effect of the incident within the target of interest, and existing one or more mitigations associated with the incident; and outputting information regarding the incident, the output information comprising the identified effect and identified one or more mitigations, wherein the incident information comprises information regarding detected anomalous behavior in the target of interest or information regarding a detected vulnerability in the target of interest, and wherein the analyzed data is based on a plurality of sources.

Detection of anomalous computing environment behavior using glucose is described. An anomaly detection system receives glucose measurements and event records during a first time period. Missing events that are missing from the event records during the first time period are identified by processing the glucose measurements using an event engine simulator. An anomaly detection model is generated based on the missing events during the first time period. Subsequently, the anomaly detection system receives additional glucose measurements and additional event records during a second time period. Missing events that are missing from the additional event records during the second time period are identified by processing the additional glucose measurements using the event engine simulator. Anomalous behavior is detected if the identified missing events that are missing from the event records during the second time period are outside a predicted range of missing events of the anomaly detection model.

The application relates to an abnormal behavior detection method, device and equipment and a storage medium. The method comprises the following steps: acquiring a process operation behavior sequence, dividing the process operation behavior sequence into a plurality of to-be-detected sequences, each to-be-detected sequence comprising a plurality of user process operation behaviors, and each user process operation behavior comprising a plurality of field information; performing feature extraction based on the attribute values of the plurality of field information of each process operation behavior in the to-be-detected sequence to obtain a feature vector corresponding to the to-be-detected sequence; performing abnormality detection on the feature vectors corresponding to the to-be-detected sequences, determining an abnormal feature vector as a feature vector detected as abnormal; determining the abnormality degrees of each dimension feature in the abnormal feature vector; determining the feature items existing in the abnormal feature vector based on the abnormality degrees of each dimension feature in the abnormal feature vector; and the application can improve the accuracy and efficiency of user abnormal behavior detection.

The present disclosure relates to a system for determining anomalous behavior. The system comprises a processing device that is configured to generate first segmentation information and second segmentation information from the video feed, the first segmentation information corresponding to a first potential occupant and the second segmentation information corresponding to a second potential occupant. The processing device further configured to determine that the first segmentation information and the second segmentation information correspond to actual occupants based on the first segmentation information and the second segmentation information, and generate a first bounding box associated with the first segmentation information and a second bounding box associated with the second segmentation information. The processing device further configured to determine an intersection over union (IOU) region for the first bounding box and the second bounding box, identify anomalous behavior based on the IOU region, and generate one or more alerts identifying the anomalous behavior.

Detecting and mitigating anomalous system behavior by providing a machine learning model comprising a knowledge graph depicting system entity relationships, and modeling behavioral correlations among system entities according to historical time-series data, receiving real-time time-series data for the system, detecting an anomalous system behavior in a system locale, according to the real-time time-series data, according to the machine learning model and multivariate sensor metrics, diagnosing the anomalous system behavior according to an upstream portion of the knowledge graph and a statistical behavior model for the system locale, and mitigating the anomalous behavior by deriving a recommended action according to the anomalous behavior and generating a work order to implement the recommended action.

A method for controlling a plurality of half-bridges (HB1...HBN), said controlling comprising, upon occurrence of a given condition, in particular an anomalous behavior, performing a shut-down (203) of at least a half-bridge (HBi) in said plurality of half-bridges (HB1...HBN), characterized in that said method comprises: associating (201) to each half-bridge (HBi) of said plurality of half-bridges ((HB1...HBN) a corresponding register (Ri) storing a link information (K) indicating which other half-bridge or half-bridges in said plurality of half-bridges (HB1...HBN) is linked to said half-bridge (HBi), decoding (202) said link information (K) obtaining a decoded link information indicating which other half-bridge or half-bridges in said plurality of half-bridges (HB1...HBN) is linked to said half-bridge (HBi), performing said shutting down (203) on said at least half-bridge (HBi) and on the other half-bridge or half-bridges in said plurality of half-bridges (HB1...HBN) indicated as linked to said half-bridge (HBi) by said decoded link information.

Operations include extracting a depiction of a person and associated movement of the person from a first video clip of a first training video included in a first domain dataset. The operations further include superimposing the depiction of the person and corresponding movement into a second video clip of a second training video included in a second domain dataset to generate a third video clip. The operations also include annotating the third video clip to indicate that the movement of the person corresponds to a particular type of behavior, the annotating being based on the first video clip also being annotated to indicate that the movement of the person corresponds to the particular type of behavior. Moreover, the operations include training a machine learning model to identify the particular type of behavior using the second training video having the annotated third video clip included therewith.

Systems and methods include reception of time-series data of a metric for each of a plurality of computer servers, determination, for each computer server, of a representative value of the metric based on the time-series data of the metric for the computer server, determination, for each computer server, of a fluctuation value of the metric based on the time-series data of the metric for the computer server, determination of a standard value of the metric based on the determined representative values, determination of a standard fluctuation value based on the determined fluctuation values, determination, for each computer server, of a difference value based on a difference between the standard value and the representative value for the computer server and a difference between the standard fluctuation value and the fluctuation value for the computer server; and identification of one or more anomalous computer servers based on the difference values.

A method and a system for detecting an anomalous sequence of events in stream data are provided. The method includes: receiving a first set of raw data; analyzing the first set of raw data in order to determine a first event sequence; applying a first Hidden Markov Model (HMM) to the first event sequence in order to generate a first output; and determining, based on the first output, whether the first event sequence is classifiable as being an anomalous event sequence. The HMM is trained by using known sequences of normal events and event sequences that are known to be anomalous.

Disclosed in the present invention are a dynamic topology-based method and apparatus for analyzing a collective anomalous behavior. The method comprises: acquiring examination monitoring video data of an examination room; selecting key frames from examination frame data, performing portrait identification on the key frames sequentially, and labelling examinee information in the key frames; constructing a skeleton topology of each examinee, and continuously monitoring the skeleton topology and the examination monitoring video data; sequentially recording a suspicious posture of each skeleton topology, and, on the basis of coordinate information in the examination monitoring video data of the skeleton topology with the suspicious posture, obtaining an actual interval distance between the skeleton topologies with the suspicious postures; using two skeleton topologies with suspicious postures corresponding to the actual interval distance as an anomalous behavior skeleton, and outputting the examinee information labelled in the anomalous behavior skeleton, so as to complete the analysis of the collective anomalous behavior. The present invention solves the technical problem of failing to accurately and efficiently detect and analyze collective anomalous behaviors of examinees in the prior art.

This application provides a method, apparatus, storage medium, and program product for detecting equipment anomalies, relating to the field of computer technology, and is used to improve the accuracy of equipment anomaly detection. The method includes: acquiring the current operating indicators and current behavioral characteristics of the device under test; determining the current load mode of the device under test based on the current operating indicators, and determining anomaly detection conditions matching the current load mode, the anomaly detection conditions being used to determine whether the operating indicators are abnormal; and, if the current operating indicators meet the anomaly detection conditions, determining anomaly risk information of the device under test based on the abnormal operating indicators in the current operating indicators and the abnormal behavioral characteristics in the current behavioral characteristics, the anomaly risk information being used to indicate whether the device under test is abnormal.

Described herein are technologies related to analyzing behavioral data of an entity in a cloud computing environment and determining suitability of providing the behavioral data to a computer-executable model that is configured to identify anomalous behavior of the entity. The technologies described herein improve performance of computer-executable models that are configured to detect anomalous behavior in a cloud computing environment.

Activity of a blockchain in a distributed ledger is monitored by an AI algorithm to identify anomalous behavior in the distributed ledger. The anomalous behavior of the distributed ledger can comprise one or more of: an anomalous consensus vote of the distributed ledger; an anomalous activity of a mempool of the distributed ledger; a denial-of-service attack on the mempool of the distributed ledger; an anomalous change of information stored in the blockchain of the distributed ledger; and an anomalous voting time for a node in the distributed ledger. Detection of these types of anomalous behavior can be used to prevent attacks on the blockchain, thus contributing to the overall integrity and security of the blockchain.

A system provides the minimum number of sensors that will be needed to uniquely identify locations where anomalous behavior is sensed that can be deployed within the specified budget. The system applies an Integer Linear Programming formulation and a Maximum Set-Group Cover (MSGC) formulation. One implementation of the system is applied to detect contaminants in a water distribution system.

A method of wireless communication at a V2X device is disclosed herein. The method includes detecting that at least one sensor of the V2X device has become inoperable or unreliable. The method comprises sending at least one message for at least one network node based on the detection, the at least one message comprising information regarding the at least one sensor becoming inoperable or unreliable, where the at least one message comprises at least one field for the information.

The embodiment of the invention discloses an abnormal behavior detection method and device and electronic equipment. The scheme comprises the following steps: acquiring to-be-detected behavior data of a target user, and acquiring a target behavior feature data set according to the to-be-detected behavior data; carrying out anomaly detection by adopting an isolation forest algorithm to obtain a first detection result, and carrying out anomaly detection by adopting a local anomaly factor algorithm to obtain a second detection result; obtaining an individual abnormal behavior detection result according to the first detection result and the second detection result; and performing anomaly detection by adopting a graph behavior analysis algorithm in response to that the individual abnormal behavior detection result is abnormal, and obtaining a group abnormal behavior detection result. According to the embodiment of the invention, the isolation forest algorithm, the local abnormal factor algorithm and the graph behavior analysis algorithm are effectively combined, double accurate detection of individual abnormal behaviors and group abnormal behaviors is realized through multi-level abnormal detection, and the accuracy, reliability and flexibility of an abnormal behavior detection process are improved.

A computer implemented method of identifying anomalous behavior of a computer system in a set of intercommunicating computer systems can include monitoring communication between computer systems in the set to generate, for each of a first and second plurality of time periods, with a first and second duration respectively, a first and a second vector representation of each of the computer systems. First vector representations corresponding to different respective ones of the first plurality of time periods are compared to identify behavior of a target computer system at a first temporal resolution. Second vector representations corresponding to different respective ones of the second plurality of time periods are compared to identify behavior of the target computer system at a second temporal resolution. Based on the behavior at one or more of the first and second temporal resolutions, anomalous behavior of the target computer system is identified.

Thread information generated by one or more computing systems is captured. A thread pattern is identified from the captured thread information. The thread pattern is compared to a learned thread pattern. An anomaly is identified in the thread pattern based on a variance from the learned thread pattern. In response to identifying the anomaly in the thread pattern, an action is taken based on the anomalous thread pattern. For example, a user may be notified. The thread patterns may be extended to compare between operating systems, hypervisors, containers, and / or virtual machines.

Described herein are technologies related to analyzing behavioral data of an entity in a cloud computing environment and determining suitability of providing the behavioral data to a computer-executable model that is configured to identify anomalous behavior of the entity. The technologies described herein improve performance of computer-executable models that are configured to detect anomalous behavior in a cloud computing environment.

One variation of a method includes: aggregating language concepts, extracted from documents including refrigeration manuals for a set of refrigeration units, into a corpus of textual training data including descriptors of characteristics of refrigeration units and root causes of anomalous behaviors; training a language model on the corpus of textual training data to generate textual descriptions of root causes of anomalous behaviors; detecting an anomalous behavior occurring at a refrigeration unit; generating a textual descriptor of the anomalous behavior; generating a text string describing a root cause of the anomalous behavior based on proximity of characteristics of the refrigeration unit to characteristics of the set of refrigeration units and proximity of the textual descriptor to troubleshooting descriptions represented in the language model for a subset of analogous refrigeration units in the set of refrigeration units; generating a notification including the text string; and serving the notification to an operator.

A baseline of behavior is received for a set of containers utilized by the Kubernetes manager from a cluster agent. The processes running on the set containers and network traffic generated by the set of containers, to identify anomalous behavior relative to the baseline. Subsequent to the container updates, and responsive to detecting the anomalous behavior exceeds a threshold for a specific container, anomalous data is sent to the cluster agent including an identification and version of the specific container and a description of abnormal behavior. The cluster agent determines a new rule is necessary to define the new behavior and distributes the new rule to the plurality of Kubernetes managers that are affected.