System and method for detecting behavior anomaly in information access
A system and method for identifying anomalies in information requests. The information requests are modeled into a plurality of basic elements and association among the basic elements are tracked. The association of one information request is compared with a plurality of bitmap tables and counters representing a baseline information from a historical behavior information. If the association of this information request differs from the baseline information, an alert is issued. The system responds dynamically to changing baselines in assessment of which behaviors constitute an anomaly.
1. A method, for detecting anomalous information access, comprising the steps of:
detecting, at a network interface, a first access request from a user;
comparing, by a controller, the first access request with a baseline behavior associated with the user;
issuing, by the controller, a first alert at a first predetermined level if the first access request differs from the baseline behavior;
updating, by the controller, the baseline behavior with information from the first access request if the first access request is an acceptable behavior from the user; and
if a second access request being received after the first access request, the second access request being identical to the first access request except for being received at a later time, issuing, by the controller, a second alert at a second predetermined level if the second access request differs from the baseline behavior, the second predetermined level being lower than the first predetermined level,
wherein the behavior is not updated with the information from the first access request if the first access request is an unacceptable behavior from the user.
2. The method of claim 1 , further comprising the steps of:
creating the baseline behavior for the user; and
associating the baseline behavior with the user.
3. The method of claim 2 , further comprising the step of storing the baseline behavior in a non-transitory computer readable memory.
4. The method of claim 1 , further comprising the step of retrieving the baseline behavior from a non-transitory computer readable memory.
5. The method of claim 1 , wherein the baseline behavior is represented by a plurality of elements, further comprising the step of storing the baseline behavior in a plurality of bitmaps.
6. The method of claim 5 , wherein the comparing step further comprises the steps of
parsing the first information access request into the plurality of elements; and
comparing each element of the first information access request with a corresponding element in the baseline behavior.
7. A system for detecting anomalous information access, comprising:
a network interface is configured for detecting a first access request from a user;
a controller is configured for comparing the first access request with a baseline behavior associated with the user, and the controller issues a first alert at a first predetermined level if the first access request differs from the baseline behavior, the controller updates the baseline behavior with information from the first access request if the first access request is an acceptable behavior from the user, and the controller does not update the baseline behavior with the information from the first access request if the first access request is an unacceptable behavior from the user;
wherein the controller issues a second alert at a second predetermined level if a second access request which differs from the baseline behavior is received after the first access request, the second access request being identical to the first access request except being received at a later time, and the second predetermined level being lower than the first predetermined level.
8. The system of claim 7 , further comprising:
a non-transitory computer readable memory containing baseline behaviors associated with users and associating the baseline behavior with the user.
9. The system of claim 8 , wherein the controller creates a new baseline behavior from the first access request if no baseline behavior already exists on the non-transitory computer readable memory for the user.
10. The system of claim 7 , further comprising the controller retrieving the baseline behavior from a non-transitory computer readable memory.
11. The system of claim 7 , wherein the baseline behavior is represented by a plurality of elements, further comprising the step of storing the baseline behavior in a plurality of bitmaps.
12. The system of claim 11 , wherein
the controller parses the first information access request into the plurality of elements and compares each element of the first information access request with a corresponding element in the baseline behavior.