SYSTEM AND METHOD FOR AUTOMATIC DETECTION OF ANOMALOUS RECURRENT BEHAVIOR
A non-transitory computer readable storage medium includes executable instructions to observe the distribution of the frequency of a recurrent behavior to form a histogram. A rehistogram of the histogram is computed to model the distribution of the frequency of the frequency of the recurrent behavior. The rehistogram provides an individual frequency relative to the total frequency of the recurrent behavior. The individual frequency is compared to a predicted frequency to form a difference frequency. An anomaly event is identified when the difference frequency exceeds an anomaly threshold.
1 . A non-transitory computer readable storage medium, comprising executable instructions to:
observe the distribution of the frequency of a recurrent behavior to form a histogram;
compute a rehistogram of the histogram to model the distribution of the frequency of the frequency of the recurrent behavior, wherein the rehistogram provides an individual frequency relative to the total frequency of the recurrent behavior;
compare the individual frequency to a predicted frequency to form a difference frequency; and
identify an anomaly event when the difference frequency exceeds an anomaly threshold.
2 . The non-transitory computer readable storage medium of claim 1 further comprising executable instructions to form a measure of the degree of anomaly as the ratio of the individual frequency and the predicted frequency, wherein the measure is an excess probability.
3 . The non-transitory computer readable storage medium of claim 2 further comprising executable instructions to take the product of a plurality of excess probabilities to form a joint excess probability.
4 . The non-transitory computer readable storage medium of claim 3 further comprising executable instructions to sum the logarithm of each excess probability of the plurality of excess probabilities.
5 . The non-transitory computer readable storage medium of claim 4 further comprising executable instructions to normalize each excess probability.
6 . The non-transitory computer readable storage medium of claim 5 wherein the executable instructions to normalize include executable instructions to accumulate individual excess probabilities of the plurality of excess probabilities.
7 . The non-transitory computer readable storage medium of claim 1 further comprising executable instructions to form an overall anomaly value by only combining probabilities associated with anomaly events.
8 . The non-transitory computer readable storage medium of claim 1 further comprising executable instructions to compare the rehistogram to a prior rehistogram associated with a prior behavioral cycle.
9 . The non-transitory computer readable storage medium of claim 1 further comprising executable instructions to enable a subject recognizer to associate a subject with a recurrent behavior.
10 . The non-transitory computer readable storage medium of claim 9 further comprising executable instructions to selectively disable the subject recognizer.
11 . The non-transitory computer readable storage medium of claim 1 further comprising executable instructions to enable a behavior recognizer to characterize the recurrent behavior.
12 . The non-transitory computer readable storage medium of claim 11 further comprising executable instructions to selectively disable the behavior recognizer.
13 . The non-transitory computer readable storage medium of claim 1 further comprising executable instructions to enable a session segregator to associate the recurrent behavior with a session.
14 . The non-transitory computer readable storage medium of claim 1 further comprising executable instructions to selectively disable the session segregator.
15 . The non-transitory computer readable storage medium of claim 1 further comprising executable instructions to compute a behavior entity termination probability estimate as the reciprocal of the sample mean of the rehistogram.
16 . The non-transitory computer readable storage medium of claim 15 further comprising executable instructions to take the complement of the behavior entity termination probability estimate to form a behavior entity continuation probability estimate.