133 results about "Normal behaviour" patented technology

An intrusion detection system (IDS). An IDS which has been configured in accordance with the present invention can include a traffic sniffer for extracting network packets from passing network traffic; a traffic parser configured to extract individual data from defined packet fields of the network packets; and, a traffic logger configured to store individual packet fields of the network packets in a database. A vector builder can be configured to generate multi-dimensional vectors from selected features of the stored packet fields. Notably, at least one self-organizing clustering module can be configured to process the multi-dimensional vectors to produce a self-organized map of clusters. Subsequently, an anomaly detector can detect anomalous correlations between individual ones of the clusters in the self-organized map based upon at least one configurable correlation metric. Finally, a classifier can classify detected anomalous correlations as one of an alarm and normal behavior.

A system and a method for detecting and diagnosing faults in heating, ventilating and air conditioning (HVAC) equipment is described. The system comprises a sensor; a classifier modelling a normal behaviour of the HVAC equipment in situ in the installed operation environment, the classifier having a plurality of classifier parameters for computing a classifier score using an input data based on a measured value from the sensor, the plurality of classifier parameters being created during a training phase of the system using the input data during the training phase; and a decision module for comparing the classifier score to a decision threshold, the decision threshold being set during the training phase.

Detecting abnormal activity of a software system is based on behavioral information obtained from an instrumented computer program while it executes. As the program executes, it expresses information about the sequence and frequency with which program modules are called. Over time, this sequence and frequency defines the normal behavior of the program, and the information expressed on any given run is compared to this normal behavior. Statistical analysis of the differences between the normal behavior and the current run can be used to detect unauthorized or abusive use of the program. Program modules whose behavior is highly correlated can be grouped into a smaller number of virtual modules. Comparison between current and normal program behavior can then be made on the (smaller number of) virtual modules, thereby reducing the dimensionality of the problem of analyzing the differences between current and normal program behavior.

A method for testing abnormal access behaviors in attached network storage devices is to extract and match with the character value by a system dispatch series generated by user access behaviors to identify the abnormal behavior by normal behavior characters and generate response to prevent users in the network from abnormal access operation to the attached network storage device which not only can prevent the non-authorized users from illegal access, but also can prevent the authorized users from power-exceeds access.

The invention discloses an abnormal behavior discovery method and system based on big data machine learning. The abnormal behavior discovery method disclosed by the invention comprises the following steps: carrying out pretreatment on the original security log data; extracting characteristic data from a pretreatment result; clustering the characteristic data, and determining an abnormal behavior library and a normal behavior library; acquiring new behavior sample data in the security log data, comparing with the normal behavior library and the abnormal behavior library, determining a new behavior to be a normal behavior or an abnormal behavior, and updating the normal behavior library or the abnormal behavior library with the new behavior sample data; and repeating the previous step, when the normal behavior library and the abnormal behavior library have enough normal behavior and abnormal behavior sample data, training a random forest model with sample data in the normal behavior library and the abnormal behavior library, and judging the abnormal behavior by utilizing the random forest model obtained through training. By adopting the scheme of the invention, the problem that quantity of label-containing samples in an initial stage is too low is solved, judging accuracy rate is improved, and misjudgement condition is effectively prevented from occurring.

The invention provides a method and device for detecting tumbling. The method provided by the invention comprises the steps of: firstly, collecting behavioral data of a user; secondly, identifying behavior of the user according to the behavioral data of the user; thirdly, segmenting out behavioral switching data from the collected data according to a behavioral identification result, and warping the behavioral switching data into equilong characteristic vectors; and fourthly, performing tumbling detection according to the warped characteristic vectors. According to the method and device provided by the invention, tumbling detection is performed on the basis of behavioral switching, a great amount of normal behavioral data can be filtered, the complexity of a feature space is reduced, the separating capacity of models is enhanced, and the model detection rate is improved.

The invention relates to a biologic water quality monitoring system for perceiving fish behaviors based on vision, comprising a transparent aquarium for containing fishes, cameras for monitoring fish behaviors, video capture cards and a water quality monitoring center, wherein the aquarium is positioned in the visual ranges of the cameras; all cameras are in data communication link with the waterquality monitoring center by the video capture cards; and the water quality monitoring center comprises an image capture module, an image processing module, a target tracking module and a fish behavior data analysis module. The fish behavior data analysis module comprises a data modeling part and a data matching part, obtains data of image frame sequence of a water area to be analyzed and substitutes the data into model formals (6) and (7) for matching. If the difference between a present calculated value and a normal action value is in the range of a default threshold, the fact represents that the fish behaviors are normal and judges that water quality conditions are good. If the difference is beyond the range of the default threshold, the fact judges that the water is polluted. The biologic water quality monitoring system reduces cost, is suitable for large-scale application and has good practicality.

A method, system and computer program product for verifying a usage of a transportation resource by an object user of the transportation resource is disclosed. A peer group of users that are expected to behave similarly as the object user is established to determine a normal behavior that the object user is supposed to act consistent with. An observed behavior of the object user is compared to the normal behavior to verify a usage of the transportation resource by the object user.

A collection of techniques is disclosed to allow for the detection of malware that leverages pattern recognition and machine learning to effectively provide “content-less” malware detection, i.e., detecting a process as being an ‘anomaly’ not based on its particular content, but instead based on comparisons of its behavior to known (and characterized) ‘trusted’ application behaviors, i.e., the trusted applications' “phenotypes” and/or the phenotypes of known malware applications. By analyzing the patterns of normal behavior performed by trusted applications as well as malware applications, one can build a set of sophisticated, content-agnostic behavioral models (i.e., “application phenotypes”)—and later compare the processes executed on a user device to the stored behavioral models to determine whether the actual measured behavior reflects a “good” application, or if it differs from the stored behavioral models to a sufficient degree and with a sufficient degree of confidence, thus indicating a potentially malicious application or behavior.

This invention uses non-parametric statistical measures and probability mathematical techniques to calculate deviations of variable values, on both the high and low side of a data distribution, from the midpoint of the data distribution. It transforms the data values and then combines all of the individual variable values into a single scalar value that is a “good-ness” score. This “good-ness” behavior score model characterizes “normal” or typical behavior, rather than predicting fraudulent, abusive, or “bad”, behavior. The “good” score is a measure of how likely it is that the subject's behavior characteristics are from a population representing a “good” or “normal” provider, claim, beneficiary or healthcare merchant behavior. The “good” score can replace or compliment a score model that predicts “bad” behavior in order to reduce false positive rates. The optimal risk management prevention program should include both a “good” behavior score model and a “bad” behavior score model.

The invention discloses a user abnormal behavior detection method based on neural network clustering. The method comprises: firstly, performing SVD decomposition and denoising on a behavior data set matrix of a user, and inputting the denoised matrix to an input layer of a neural network, and then calculating weight of all attributes of each user in a hidden layer of the neural network, and standardizing the weight, outputting the weight in an output layer, and finally respectively calculating similarity value of each user and each user in a normal behavior model database and a threshold value, if the similarity value is larger than the threshold value, behavior being abnormal behavior, and carrying out corresponding prompt and precautionary measures, otherwise, the behavior being normal behavior, and combining the behavior in the normal model database to upgrade the database in real time. Through cooperation of each part, the method effectively realizes high detection rate and low false alarm rate.

A real-time approach to detecting aberrant modes of system behavior induced by abnormal and unauthorized system activities indicative of abnormal activity of a software system is based on behavioral information obtained from a suitably instrumented computer program as it is executing. The theoretical foundation is founded on a study of the internal behavior of the software system. As a software system is executing, it expresses a set of its many functionalities as sequential events. Each of these functionalities has a characteristic set of modules that is executed to implement the functionality. These module sets execute with defined and measurable execution profiles among the program modules and within the execution paths of the individual modules, which change as the executed functionalities change. Over time, the normal behavior of the system will be defined by the boundary of the profiles. Abnormal activity of the system will result in behavior that is outside the normal activity of the system and thus result in a perturbation of the system in a manner outside the scope of the normal profiles. Such anomalies are detected by analysis and comparison of the profiles generated from an instrumented software system against a set of nominal execution profiles. Moreover, a method for reducing the amount of information necessary to understand the functional characteristics of an executing software system identifies the common sources of variation among the program instrumentation point frequencies and builds execution profiles based on a reduced set of virtual execution domains.

The invention discloses an all-weather defence home security alarm system based on behavioural analysis, which comprises an identity recognizer, a vector door detector, a double curtain intelligent linked probe, a human body sensing counter and an anti-theft alarm mainframe; wherein the identity recognizer cooperates with the vector door detector to monitor and analyze the access behaviour of the human body through the door; the double curtain intelligent linked probe is matched with the human body sensing counter to monitor and analyze the access behaviour of the human body through the balcony; and the anti-theft alarm mainframe discriminate between the normal behaviour and the illegal behaviour, thereby realizing the all-weather defence of the home security alarm system, achieving more safety and reliable use and avoiding the leaking and fault alarm phenomenon .More importantly, the home security alarm system can not only increase the safety of the family belongings, but enhance the personal safety effectively.

The invention relates to a BBS user abnormal behavior auditing method based on Hidden Markov theory, belonging to the technical field of computer and information safety. The method comprises the following steps: reading auditing data from a database to obtain behavior observed sequence to be detected; reading trained model parameters from a Hidden Markov model database; calculating a state value sequence by utilizing a Viterbi algorithm; calculating the observed value sequence probability by forward and afterward algorithms, comparing the observed value sequence probability with the preset threshold, and giving an alarm if the observed value sequence probability is lower than the threshold, otherwise, belonging to normal behavior, correcting the Hidden Markov model parameter and storing the Hidden Markov model parameter into a parameter file of the Hidden Marko model. The BBS added with audit tracking helps system managers to prevent systems and resources from being damaged by illegal authorized users and provides help when data is recovered. The audit tacking can realize associated targets of safety, comprising personal function, event reconstruction, intrusion detection and fault analysis, and greatly improves the safety of the system.

The invention discloses a masquerade intrusion detection method based on a deep neural network. The masquerade intrusion detection method comprises obtaining behavior flow data of at least two users; initializing a super parameter set and a parameter set; acquiring positive samples and negative samples to form a training data set by aiming at each user; sequentially calculating the parameter value of each parameter by means of the training data set, a loss function and an optimization algorithm; querying behavior data corresponding to the behavior sequence to be detected of the user from a behavior embedding representation query table and adding the behavior data to a behavior embedding representation sequence; carrying out convolution operation, pooling operation and operation corresponding to the long short-term memory artificial neural network on the behavior embedding representation sequence to obtain a second behavior sequence; calculating the probability of that the second behavior sequence is a normal behavior sequence; and determining whether the user's behavior is a masquerade intrusion behavior or not in dependence on the probability value. According to the invention, local strong relativity, long-range dependence and time sequence of the behavior are taken into account at the same time, and the masquerade intrusion detection accuracy is improved.

The invention relates to a video abnormal behavior detection method based on depth learning. The method includes a training phase and a test phase. In the training phase, the training video sequence is converted into gray-scale image and optical flow image, which are respectively made into space-time blocks, and then input into residual self-coding model for training. Two models based on gray-scale image and optical flow image are established. The trained model contains the motion mode and appearance information of normal behavior, so it is more conducive to the reconstruction of normal behavior. In the test phase, the test data is made into space-time blocks of gray-scale map and optical flow map, At first, that space-time block of the grayscale image is input into the grayscale image model, The invention initially detects a normal area and a suspicious area, inputs the optical flow map space-time block of the suspicious area into the optical flow map model, detects the normal area and the abnormal area, and obtains the final abnormal judgment. The method of the invention can better identify the motion information and the appearance characteristic of the video data, thereby improving the detection rate of the abnormal behavior.

The invention provides a method, apparatus and system for detecting an abnormal user behavior. The method for detecting the abnormal user behavior comprises the following steps: obtaining user behavior information; extracting user behavior feature values related to user behaviors from the user behavior information; calculating a clustering centroid of the user behavior feature values related to each type of user behaviors according to the clustering characteristics of the user behavior feature values; determining a standard baseline of a normal user behavior by using the clustering centroid as the center; calculating the distance between the user behavior feature values of the user behavior information and the clustering centroid; and comparing the calculated distances with the standard baseline to judge whether the user behavior information belongs to abnormal behavior information. According to the method provided by the invention, by collecting the user behavior information, extracting the feature values from the user behavior information, and performing clustering analysis on the extracted feature values in combination with the normal behavior standard baseline to judge the abnormal situation of the user behaviors, thereby simplifying the judgment process of the abnormal user behavior and realizing fast and accurate detection of the abnormal user behavior.

The invention discloses a fight behavior detection method based on a spatio-temporal interest point. The fight behavior detection method based on the spatio-temporal interest point comprises the following steps: firstly, detecting the spatio-temporal interest point of the current frame; then, segmenting to extract an effective spatio-temporal interest point set; analyzing the distribution of the effective spatio-temporal interest point set and the average displacement amount of the centroid of the effective spatio-temporal interest point set; according to the distribution of the effective spatio-temporal interest point set and the average displacement amount of the centroid of the effective spatio-temporal interest point set, regulating the fight level of the current scene; and outputting the state information ''fight'' or ''normal''. According to the fight behavior detection method based on the spatio-temporal interest point, which is disclosed by the invention, the human body movement in a video is described by the spatio-temporal interest point, and the human body interaction acute degree is detected by analyzing the distribution of the effective spatio-temporal interest point set and the average displacement amount of the centroid of the spatio-temporal interest point set so as to judge whether the fight behavior happens in the current monitoring scene. According to the fight behavior detection method based on the spatio-temporal interest point, the area with drastic movement in the current frame image can be accurately reflected, the fight behavior detection method is unlikely to be affected by the change of environment such as the change of illumination and has the advantages of high detection speed and better robustness, the fight behavior in the scene can be accurately and timely identified, normal behaviors of shaking hands and running and the like can be better distinguished, and the false alarm rate is effectively lowered.

Systems and methods are described that facilitate using end-user feedback to automatically distinguish between a normal behavior and a device failure which can be a hard failure (e.g., a device malfunction) or a soft failure. For instance, upon detection of a usage switch from a first device to a second device by a user, a survey message is sent to the user to solicit information regarding the reasons for the switch. If the switch was triggered by a device malfunction, the detected device failure is verified and an alert is sent to an administrator and/or potentially impacted users. If the switch was triggered by the user's need for functionality (e.g., color printing, collation, etc.) not provided by the first device, which is otherwise functioning properly, then the detected failure is determined to be a failure and the failure detection algorithm is updated accordingly.

The invention provides a database security protection method and device, relates to the technical field of networks, and solves the problem of low security of a database. The method comprises the following steps of: receiving and resolving a message, and extracting database operation information in the message; carrying out statistics on the database operation information; and generating a normal behavioral model according to a statistical result, and detecting whether the database operation is abnormal or not according to the normal behavioral model. The technical scheme provided by the invention is suitable for database security protection.

The invention provides an abnormal behavior detection system and a method by utilizing an automatic multi-feature clustering method; combine a feature group according to the obtained features of all monitoring data, for instance, multiple features are captured from a monitoring video; then build a normal behavior model and an abnormal behavior model after processing and analysis by a machine learning algorithm, and in one embodiment, the behaviors with low occurrence frequency are considered as the abnormal behavior. In the invention, supervised learning can also be adopted, the abnormal behavior model in the behavior models generated by automatic classification is defined artificially, so as to causing the abnormal behavior detection to be in accordance with the requirements of a user; and automatically classify into normal behaviors and abnormal behaviors according to the various captured features after the behavior model is built. In the invention, the system and the method are suitable for detecting various traffic abnormal behaviors such as traffic violation behaviors, for instance, running the red light, violation of right-lane driving and violation of right direction driving.

The invention relates to a user identification system and method based on heterogeneous information network embedding algorithms. The user identification system comprises a data processing module, a joint embedding module and an evaluation analysis module. According to the invention, multi-source heterogeneous user behavior data is utilized for constructing a normal behavior model based on the thought of behavior analysis, and user identification is executed by comparing the similarity between a current behavior and the normal behavior model when behavior data of a new time period arrives. Forthe condition of identification errors, suspicious behavior sorting is given based on dot product similarity operation. The system and method can be applied to an enterprise intranet to detect potential internal threats, a more comprehensive and accurate behavior model can be obtained by combining two heterogeneous information network embedding algorithms, and the user identification accuracy isimproved by about 10%. In addition, event-level traceability clues can be provided for further analysis of the safety monitoring personnel.