Learning program behavior for anomaly detection
View Patent ↗A computer-enabled method of learning the behavior of a program. A processor can execute a target program during a learning interval while varying a plurality of stimuli provided to the target program so as to produce a multiplicity of different sequences of events which differ in combinations of types of events in respective sequences, orders in which the types of events occur in respective sequences, or in the combinations and in the orders in which the types of events occur. The multiplicity of event sequences can be recorded, and a second program can be executed by a processor to: determine a plurality of clusters based on similarities between the event sequences in their entirety; and determine a plurality of signatures corresponding to the plurality of clusters. Each signature can be the longest common subsequence of all sequences in the respective cluster and thus representative of the cluster. In such method, each of the plurality of signatures can be a benchmark representative of acceptable behavior of the target program.
1. A computer-enabled method of learning behavior of a program, comprising:
(a) using a processor to execute a target program during a learning interval while varying a plurality of stimuli provided to the target program, the stimuli affecting execution of the target program, so as to produce a multiplicity of different sequences of events, the event sequences differing in combinations of types of events in respective sequences, orders in which the types of events occur in respective sequences, or in the combinations and in the orders in which the types of events occur;
(b) recording the multiplicity of event sequences; and
(c) executing a second program by a processor to: (i) determine a plurality of clusters based on similarities between the recorded event sequences in their entirety; and (ii) determine a plurality of signatures corresponding to the plurality of clusters, each signature being a sequence of events representative of a respective cluster,
wherein each of the plurality of signatures is a benchmark representative of acceptable behavior of the target program.
2. A method as claimed in claim 1 , wherein step (c) is performed using spatial clustering.
3. A method as claimed in claim 1 , wherein the determination of each signature includes determining a longest common subsequence of events included in each event sequence in the respective cluster as the signature for each respective cluster.
4. A method as claimed in claim 1 , wherein step (c) includes finding event subsequences which are repeated in at least ones of the event sequences and generating linearized event sequences representative of the repeated subsequences therein, and wherein the determining of the clusters in step (c) includes determining the clusters based on the linearized event sequences and the recorded event sequences.
5. A method as claimed in claim 4 , wherein the finding of the repeated event subsequences includes inferring state information regarding the target program by analyzing at least some of the recorded event sequences, at least some of the linearized event sequences, or at least some of the recorded event sequences and at least some of the linearized event sequences.
6. A method as claimed in claim 1 , wherein step (b) includes recording said event sequences in their entirety and step (c) is performed considering the entireties of said event sequences.
7. A method as claimed in claim 1 , further comprising:
(d) further executing the target program during an in-service interval after performing steps (a) through (c), and detecting whether a given sequence of events is anomalous based on a difference between the given sequence of events and each of the cluster signatures.
8. A method as claimed in claim 7 , wherein the detected degree of difference is based on edit distance between the given sequence of events and the plurality of signatures.
9. A method as claimed in claim 8 , wherein each cluster is representative of a distribution of edit distances from the signature of each cluster, the distribution having a plurality of quantiles extending outward from the signature, and the detecting of whether a given event sequence is anomalous includes determining in which quantile of the distribution the given event sequence occurs.
10. An information processing apparatus, comprising:
a processor; and
instructions executable by the processor to perform a method, the method including:
(a) the use of a processor to execute a target program during a learning interval while varying a plurality of stimuli provided to the target program so as to produce a multiplicity of different sequences of events, the event sequences differing in combinations of types of events in respective sequences, orders in which the types of events occur in respective sequences, or in the combinations and in the orders in which the types of events occur;
(b) recording the multiplicity of event sequences;
(c) executing a second program by a processor to: (i) determine a plurality of clusters based on similarities between the event sequences in their entirety; and (ii) determine a plurality of signatures corresponding to the plurality of clusters, each signature being a sequence of events representative of a respective cluster,
wherein each of the plurality of signatures is a benchmark representative of acceptable behavior of the target program.
11. An information processing apparatus as claimed in claim 10 , wherein step (a) includes varying the stimuli only in the multiplicity of ways exemplary of acceptable stimuli to produce only event sequences representative of acceptable behavior.
12. An information processing apparatus as claimed in claim 10 , wherein the determination of each signature in step (c) includes determining a longest common subsequence of events included in each event sequence in the respective cluster as the signature for each respective cluster.
13. An information processing apparatus as claimed in claim 10 , wherein step (c) of the method includes finding event subsequences which are repeated in at least ones of the event sequences and generating linearized event sequences representative of the repeated subsequences therein, and wherein the determining of the clusters is performed using linearized event sequences.
14. An information processing apparatus as claimed in claim 13 , wherein the finding of the repeated event subsequences includes inferring state information regarding the target program by analyzing the recorded event sequences.
15. A non-transitory computer-readable storage medium, the storage medium having a set of instructions recorded thereon, the instructions being executable by a processor to perform a method, the method including:
(a) using a processor to execute a target program during a learning interval while varying a plurality of stimuli provided to the target program, the stimuli affecting results of executing the target program so as to produce a multiplicity of different sequences of events, the event sequences differing in combinations of types of events in respective sequences, orders in which the types of events occur in respective sequences, or in the combinations and in the orders in which the types of events occur;
(b) recording the multiplicity of event sequences;
(c) executing a second program by a processor to: (i) determine a plurality of clusters based on similarities between the event sequences in their entirety; and (ii) determine a plurality of signatures corresponding to the plurality of clusters, each signature being a sequence of events representative of a respective cluster,
wherein each of the plurality of signatures is a benchmark representative of acceptable behavior of the target program.
16. A computer-readable storage medium as claimed in claim 15 , wherein step (a) of the method includes varying the stimuli only in the multiplicity of ways exemplary of acceptable stimuli to produce only event sequences representative of acceptable behavior.
17. A computer-readable storage medium as claimed in claim 15 , wherein step (c) of the method includes determining a longest common subsequence of events included in each event sequence in the respective cluster as the signature for each respective cluster.
18. A computer-readable storage medium as claimed in claim 15 , wherein step (c) of the method includes finding event subsequences which are repeated in at least ones of the event sequences and generating linearized event sequences representative of the repeated subsequences therein, and wherein the determining of the clusters in step (c) includes determining the clusters based on the linearized event sequences and the recorded event sequences.
19. A computer-readable storage medium as claimed in claim 15 , wherein the finding of the repeated event subsequences includes inferring state information regarding the target program by analyzing recorded event sequences.