HTM Anomaly Detection for Computer Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting non-compliant operation in computer systems are resource-intensive and cumbersome, requiring multiple monitoring mechanisms for disparate systems to enforce compliance rules, which is inefficient and difficult to apply across entire systems or networks.
Innovation Solution
A computer-implemented method using a hierarchical temporal memory (HTM) to generate a sparse distributed representation of system records, train a model of compliant operations, and identify non-compliant behavior by determining the degree of recognition of subsequent records, with the option to invoke protective measures upon detection of non-compliance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If multiple monitoring mechanisms are implemented for disparate computer systems to enforce compliance rules, then compliance detection accuracy is improved, but device complexity and resource consumption increase significantly
Solution Approach 1:
The patent implements a universal monitoring mechanism based on HTM that can handle multiple disparate computer systems through a single unified approach. The HTM model learns compliant operation patterns from training data and can evaluate various system types using the same anomaly detection framework, eliminating the need for system-specific monitoring mechanisms while maintaining detection accuracy
Solution Approach 2:
The patent transforms system records into sparse distributed representations (SDR) as input to the HTM model. This parameter transformation allows diverse system operations to be represented in a standardized format that the HTM can process uniformly, enabling single-mechanism monitoring across heterogeneous systems while preserving detection precision
2Reliability
If constant monitoring of computer systems is performed to spot problematic operation based on rules, then reliability of compliance enforcement is improved, but use of energy and computational resources increases
Solution Approach 1:
The patent performs preliminary training of the HTM model using historical compliant operation records before actual monitoring begins. This preliminary action allows the system to learn normal patterns in advance, enabling subsequent real-time monitoring to operate more efficiently by comparing against pre-learned patterns rather than performing complex rule evaluations continuously
Solution Approach 2:
The patent creates a computational model (HTM) that copies and learns the patterns of compliant operations from training data. Once trained, this model can efficiently evaluate new operations by comparing them against the learned patterns, reducing the computational burden of constant monitoring while maintaining reliable detection of non-compliant operations
3Adaptability or versatility
If multiple monitoring mechanisms are implemented for each disparate system, then compliance coverage is improved, but ease of operation and maintenance deteriorates
Solution Approach 1:
The patent implements a single universal HTM-based monitoring mechanism that can handle multiple disparate computer systems through standardized SDR representation. This unified approach maintains broad compliance coverage across heterogeneous systems while significantly simplifying operation and maintenance compared to managing multiple separate monitoring mechanisms
Data Source
AI summary
A computer implemented method to detect a computer system in execution operating in a manner that is not compliant with a definition of a set of compliant operations, the method including receiving a first set of records for the computer system, each record detailing an occurrence in the computer system during a first predetermined time period; generating a sparse distributed representation of the set of records to form a training set for a hierarchical temporal memory (HTM); training the HTM based on the training set in order that the trained HTM provides a model of the operation of the computer system during the predetermined time period; selecting at least a subset of operations in the set of compliant operations and causing the invocation of each operation of the subset in the computer system over a second predetermined time period to generate a second set of records of occurrences in the computer system; generating a sparse distributed representation of the set of records to form an input set for the trained HTM; executing the trained HTM based on the input set to determine a degree of recognition of the records of the input set; and responsive to a determination that a degree of recognition of one or more records of the input set is below a threshold degree, identifying the operation of the computer system as non-compliant.