Anomaly detection
View Patent ↗A system such as a Web-based system in which a plurality of computers interact with each other is monitored to detect online an anomaly. Transactions of a service provided by each of a plurality of computers to another computer are collected, a matrix of correlations between nodes in the system is calculated from the transactions, and a feature vector representing anode activity balance is obtained from the matrix. The feature vector is monitored using a probability model to detect a transition to an anomalous state.
1. A computer implemented anomaly detection method comprising:
a step of monitoring a program for a fault on the basis of a probabilistic model to automatically detect a fault, said program being run through cooperation between computers in a computer system forming a network consisting of a plurality of computers;
a recording step performed by an agent module of associating and recording transactions with a service, said transactions being processes of said service performed by each of said plurality of computers in response to a call from a program running on another of said plurality of computers; and
steps performed by an anomaly monitoring server connected to said network, comprising:
a transaction collecting step of collecting transactions recorded by said agent module from each of said plurality of computers;
a correlation matrix calculating step of outputting a node correlation matrix calculated from said transactions collected from each of said plurality of computers;
an activity vector calculating step of calculating an activity vector by solving an equation specific to said node correlation matrix;
a probability estimating step of estimating the probability of occurrence of said activity vector; and
a fault detecting step of calculating an outlier measure of the activity vector from a probability density estimated in said probability estimating step to automatically detect a fault in the program being run through cooperation between said plurality of computers.
2. The anomaly detection method according to claim 1 , comprising a fault detecting step of detecting a fault at the application layer of said program by using a service associated and provided with said program running on said plurality of computers, said service including one or more items selected from a group including a source IP address, a destination IP address, a destination port number, and a transaction type at the destination port.
3. The anomaly detection method according to claim 1 , wherein said fault detecting step automatically detects a fault by transforming said activity vector into a cosine measure and calculating an outlier measure.
4. The anomaly detection method according to claim 1 , wherein said probability estimating step uses an online EM algorithm to learn a probability distribution online.
5. A computer readable storage medium tangibly embodying computer readable instructions which, when executed, carries out the steps of a computer implemented anomaly detection method comprising:
a step of monitoring a program for a fault on the basis of a probabilistic model to automatically detect a fault, said program being run through cooperation between computers in a computer system forming a network consisting of a plurality of computers;
a recording step performed by an agent module of associating and recording transactions with a service, said transactions being processes of said service performed by each of said plurality of computers in response to a call from a program running on another of said plurality of computers; and
steps performed by an anomaly monitoring server connected to said network, comprising:
a transaction collecting step of collecting transactions recorded by said agent module from each of said plurality of computers;
a correlation matrix calculating step of outputting a node correlation matrix calculated from said transactions collected from each of said plurality of computers;
an activity vector calculating step of calculating an activity vector by solving an equation specific to said node correlation matrix;
a probability estimating step of estimating the probability of occurrence of said activity vector; and
a fault detecting step of calculating an outlier measure of the activity vector from a probability density estimated in said probability estimating step to automatically detect a fault in the program being run through cooperation between said plurality of computers.