Cognitive information security using a behavioral recognition system
View Patent ↗Embodiments presented herein describe techniques for generating a linguistic model of input data obtained from a data source (e.g., a video camera). According to one embodiment of the present disclosure, a sequence of symbols is generated based on an ordered stream of normalized vectors generated from the input data. A dictionary of words is generated from combinations of the ordered sequence of symbols based on a frequency at which combinations of symbols appear in the ordered sequence of symbols. A plurality of phrases is generated based an ordered sequence of words from the dictionary observed in the ordered sequence of symbols based on a frequency by which combinations of words in ordered sequence of words appear relative to one another.
1. An apparatus, comprising:
at least one processor; and
a memory storing processor-executable instructions and in communication with the at least one processor, the instructions in the memory comprising instructions for the at least one processor to:
generate a dictionary of words based on a statistical distribution of combinations of symbols, the symbols being generated based on an ordered stream of normalized data;
dynamically update the dictionary of words based on a subsequent stream of the ordered stream of normalized data;
determine an unusualness score for at least one word in the dictionary of words based on a frequency of occurrence of the at least one word; and
publish an alert based on the unusualness score, the alert indicating an anomaly in the normalized data.
2. A computer-implemented method, comprising:
generating, via at least one processor, a dictionary of words based on a statistical distribution of combinations of symbols, the symbols being generated based on an ordered stream of normalized data;
determining, via the at least one processor, an unusualness score for at least one word in the dictionary of words based on a frequency of occurrence of the at least one word; and
publishing, via the at least one processor, an alert based on the unusualness score, the alert indicating an anomaly in the normalized data.
3. The computer-implemented method of claim 2 , further comprising:
dynamically updating, via the at least one processor, the dictionary of words based on a subsequent stream of the ordered stream of normalized data.
4. The computer-implemented method of claim 2 , wherein each word in the dictionary of words represents an activity, and the unusualness score represents an anomaly in the activity.
5. The computer-implemented method of claim 2 , further comprising:
generating, via the at least one processor, a neuro-linguistic model based at least in part on the dictionary of words.
6. The computer-implemented method of claim 2 , wherein generating the dictionary of words comprises building the dictionary of words up to a maximum length of symbols.
7. The computer-implemented method of claim 2 , wherein generating the dictionary of words further includes:
identifying, via the at least one processor, at least one of a pattern or a sub-pattern of the symbols.
8. The computer-implemented method of claim 2 , wherein the symbols are generated by clustering the ordered stream of normalized data and assigning a symbol to each cluster.
9. The apparatus of claim 1 , further comprising instructions for the at least one processor to:
update the dictionary of words based on a subsequent stream of the ordered stream of normalized data.
10. The apparatus of claim 1 , wherein each word in the dictionary of words represents an activity.
11. The apparatus of claim 10 , wherein the unusualness score represents an anomaly in the activity.
12. The apparatus of claim 1 , further comprising instructions for the at least one processor to:
generate a neuro-linguistic model based at least in part on the dictionary of words.
13. The apparatus of claim 1 , wherein generation of the dictionary of words includes building the dictionary of words up to a maximum length of symbols.
14. The apparatus of claim 1 , further comprising instructions for the at least one processor to:
identify at least one of a pattern or a sub-pattern of the symbols to generate the dictionary of words.
15. The apparatus of claim 1 , further comprising instructions for the at least one processor to:
cluster the ordered stream of normalized data; and
assign a symbol to each cluster.
16. A non-transitory processor-readable storage medium storing processor-executable instructions to:
generate a dictionary of words based on a statistical distribution of combinations of symbols, the symbols being generated from an ordered stream of normalized data;
update the dictionary of words based on a subsequent stream of the ordered stream of normalized data;
determine an unusualness score for at least one word in the dictionary of words based on a frequency of occurrence of the at least one word; and
issue an alert based on the unusualness score, the alert indicating an anomaly in the normalized data.
17. The non-transitory processor-readable storage medium of claim 16 , further comprising processor-executable instructions to:
update the dictionary of words based on a subsequent stream,of the ordered stream of normalized data.
18. The non-transitory processor-readable storage medium of claim 16 , further comprising processor-executable instructions to:
identify at least one of a pattern or a sub-pattern of the symbols to generate the dictionary of words.
19. The non-transitory processor-readable storage medium of claim 16 , further comprising processor-executable instructions to:
generate a neuro-linguistic model using the dictionary of words.