Program Anomaly Detection via Event Sequence Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods fail to effectively learn and recognize normal program behavior, making it difficult to detect anomalies and prevent potential harm during program execution, especially in unpredictable environments like PBX systems.
Innovation Solution
A method is developed to record and cluster sequences of events generated by varying stimuli during a learning interval, determining signatures that represent acceptable behavior, which are then used to detect anomalies during in-service execution by comparing event sequences to these signatures using edit distances and clustering techniques.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If program behavior is learned by observing application level events during a learning interval, then anomaly detection capability is improved, but system complexity increases
Solution Approach 1:
The system performs preliminary learning during a dedicated learning interval before normal operation, observing and clustering event sequences to establish baseline behavior patterns. This preliminary action creates signatures that enable subsequent anomaly detection without requiring complex real-time analysis during in-service operation.
Solution Approach 2:
The system creates simplified copies of complex program behaviors in the form of event sequence signatures. These signatures capture essential behavioral patterns without replicating the full complexity of the original program execution, enabling efficient comparison and anomaly detection during runtime.
2Measurement precision
If event sequences are clustered based on similarities using edit distances, then behavior recognition accuracy is improved, but computational complexity increases
Solution Approach 1:
The system segments the complex task of behavior analysis into distinct phases: event sequence generation, clustering based on edit distances, signature determination, and anomaly detection. This segmentation allows each component to be optimized independently, managing computational complexity while maintaining recognition accuracy.
Solution Approach 2:
The system changes parameters by varying stimuli provided to the program during the learning interval, observing how event sequences change in response. This parameter variation enables the system to learn robust behavior patterns that generalize across different operating conditions, improving recognition accuracy without requiring excessive computational resources.
3Adaptability or versatility
If multiple stimuli are varied during program execution, then coverage of acceptable behavior is improved, but learning time increases
Solution Approach 1:
The system implements periodic learning during designated learning intervals, varying multiple stimuli to comprehensively observe program behavior. By concentrating this comprehensive observation into periodic intervals rather than continuous operation, the system achieves broad behavior coverage while minimizing the time impact on normal program execution.
Data Source
AI summary
A computer-enabled method of learning the behavior of a program. A processor can execute a target program during a learning interval while varying a plurality of stimuli provided to the target program so as to produce a multiplicity of different sequences of events which differ in combinations of types of events in respective sequences, orders in which the types of events occur in respective sequences, or in the combinations and in the orders in which the types of events occur. The multiplicity of event sequences can be recorded, and a second program can be executed by a processor to: determine a plurality of clusters based on similarities between the event sequences in their entirety; and determine a plurality of signatures corresponding to the plurality of clusters. Each signature can be the longest common subsequence of all sequences in the respective cluster and thus representative of the cluster. In such method, each of the plurality of signatures can be a benchmark representative of acceptable behavior of the target program.