Utilizing digital linear recursive filters to estimate statistics for anomaly detection
View Patent ↗A method is provided to estimate statistics of user interaction with a computing system. For example, the method includes tracking the interaction of a plurality of users with the computing system to collect statistical data associated with the user interaction, wherein the statistical data is collected in each of a plurality of sampling intervals. The collected statistical data is applied to a digital linear recursive filter that is configured to combine and filter the collected statistical data based on at least one cyclical function. The filtered statistical data generated by the digital linear recursive filter is then utilized to compute final statistics indicative of the user interaction with the computing system. The final statistics are utilized to identify anomalous activity involving the computing system.
1. A method comprising steps of:
tracking interaction of a plurality of users with a computing system to collect statistical data of said user interaction, wherein the statistical data is collected in each of a plurality of sampling intervals;
applying the collected statistical data to a digital linear recursive filter that is configured to combine and filter the collected statistical data, wherein the digital linear recursive filter comprises a discrete time implementation of a continuous time filter with an impulse response function that is defined, at least in part, by at least one cyclical function that represents a cyclical trend exhibited by the plurality of users interacting with the computing system;
utilizing the filtered statistical data to compute final statistics of said user interaction with the computing system; and
utilizing the final statistics to identify anomalous activity involving the computing system,
wherein the tracking, applying, and utilizing steps are performed by at least one processing device comprising a processor coupled to a memory.
2. The method of claim 1 wherein each sampling interval has a predefined period which is greater than zero, but less than or equal to one hour.
3. The method of claim 1 wherein the impulse response function is further defined based on a decay function.
4. The method of claim 3 wherein the decay function is based on an exponential of a ratio of a predefined time period of each sampling interval to a predefined half-life time constant of the collected statistical data.
5. The method of claim 4 wherein the half-life time constant is one week.
6. The method of claim 1 wherein the at least one cyclical function comprises a weighted sinusoidal function of a daily cycle.
7. The method of claim 1 wherein the at least one cyclical function comprises a weighted sinusoidal function of a weekly cycle.
8. The method of claim 1 wherein the impulse response function is defined as:
h ( t )={ e −t/μ [a 0 +a 1 cos(ω 1 t )+ a 2 cos(ω 2 t )]} u ( t );
wherein e −t/μ corresponds to a decay function, and μ represents a predefined half-life time constant of the collected statistical data;
wherein a 0 , a 1 , and a 2 are filter coefficients;
wherein ω 1 corresponds to a first frequency of a first cyclical function;
wherein ω 2 corresponds to a second frequency of a second cyclical function; and
wherein u(t) represents a unit step function.
9. The method of claim 8 ,
wherein a 0 +a 1 +a 2 =1 and a 0 >a 1 +a 2 ,
wherein ω 1 =2π/1 day, and
wherein ω 2 =2π/1 week.
10. The method of claim 1 wherein tracking interaction of a plurality of users with the computing system to collect statistical data of said user interaction comprises:
tracking one or more pre-specified events; and
accumulating a number of occurrences of each of the one or more pre-specified events in each of the plurality of sampling intervals.
11. The method of claim 10 wherein utilizing the filtered statistical data to compute final statistics comprises computing a categorical probability distribution for each of the one or more pre-specified events.
12. The method of claim 1 wherein tracking interaction of a plurality of users with the computing system to collect statistical data of said user interaction comprises:
tracking one or more pre-specified numerical parameters; and
accumulating a total amount of each of the one or more pre-specified numerical parameters in each of the plurality of sampling intervals.
13. The method of claim 12 wherein utilizing the filtered statistical data to compute final statistics comprises computing a statistical mean of each of the one or more pre-specified numerical parameters.
14. The method of claim 1 wherein utilizing the final statistics to identify anomalous activity involving the computing system comprises utilizing the final statistics to identify one or more anomalies in said user interaction with the computing system.
15. An article of manufacture comprising a processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes said at least one processing device:
to track interaction of a plurality of users with a computing system to collect statistical data of said user interaction, wherein the statistical data is collected in each of a plurality of sampling intervals;
to apply the collected statistical data to a digital linear recursive filter that is configured to combine and filter the collected statistical data, wherein the digital linear recursive filter comprises a discrete time implementation of a continuous time filter with an impulse response function that is defined, at least in part, by at least one cyclical function that represents a cyclical trend exhibited by the plurality of users interacting with the computing system;
to utilize the filtered statistical data to compute final statistics of said user interaction with the computing system; and
to utilize the final statistics to identify anomalous activity involving the computing system.
16. The article of manufacture of claim 15 wherein each sampling interval has a predefined period which is greater than zero, but less than or equal to one hour, wherein the impulse response function is further defined based on a decay function, and wherein the decay function is based on an exponential of a ratio of a predefined time period of the sampling intervals to a predefined half-life time constant of the collected statistical data.
17. The article of manufacture of claim 16 wherein the at least one cyclical function comprises at least one of a weighted sinusoidal function of a daily cycle, a weighted sinusoidal function of a weekly cycle, or both.
18. An apparatus comprising:
at least one processing device comprising a processor coupled to a memory, wherein the at least one processor device is configured to process program code stored in the memory to instantiate a network activity statistics estimator module and to instantiate an anomalous activity detector module;
wherein the network activity statistics estimator module is configured:
to track interaction of a plurality of users with a computing system to collect statistical data of said user interaction, wherein the statistical data is collected in each of a plurality of sampling intervals;
to apply the collected statistical data to a digital linear recursive filter that is configured to combine and filter the collected statistical data, wherein the digital linear recursive filter comprises a discrete time implementation of a continuous time filter with an impulse response function that is defined, at least in part, by at least one cyclical function that represents a cyclical trend exhibited by the plurality of users interacting with the computing system; and
to utilize the filtered statistical data to compute final statistics of said user interaction with the computing system; and
wherein the anomalous activity detector module is configured to utilize the final statistics to identify anomalous activity involving the computing system.
19. A computer network comprising the apparatus of claim 18 .
20. A network security system comprising the apparatus of claim 18 .