Granted Patent B2

US 12,401,686 · App. 16/636,282 · Granted Aug 26, 2025

Inventors: Fadi El-Moussa (London, GB); Xiaofeng Du (London, GB)

Assignee: British Telecommunications Public Limited Company

H04L63/1483G06F16/958G06N3/045H04L63/1416

Abstract

Claims (29)

1. A computer implemented method to detect an anomalous change to a configuration of a web application, the web application executing with a web server, the method comprising:

receiving a first set of distinct records for the web application operating in a training mode of operation during which the web application is isolated from a wide area network, each record in the first set of distinct records including characteristics of a content of a web page the web application during a training time period;

generating a sparse distributed representation of the first set of distinct records to form a training set for a hierarchical temporal memory (HTM);

training the HTM based on the training set in order that the trained HTM provides a model of operation of the web application in the training mode of operation, wherein the HTM evaluates an anomaly score for the records in the first set of distinct records and the HTM is trained until the anomaly score meets a predetermined threshold degree of anomaly;

receiving a second set of distinct records for the web application, each record in the second set of distinct records including characteristics of the web application during an operational time period, the operational time period being distinct from the training time period;

generating a sparse distributed representation of the second set of distinct records to form an input set for the trained HTM;

executing the trained HTM based on the input set to determine a degree of recognition of the records of the input set;

responsive to a determination that a degree of recognition of one or more records of the input set is below a threshold degree, identifying an anomalous change to the configuration of the web page; and

in response to the identification of the anomalous change to the web page, causing a responsive measure to the anomalous change to be implemented that includes one or more of the following actions:

interrupting operation of the web application;

identifying client components in communication with the web application as potentially compromised;

executing at least one of an intrusion detection, malware detection, virus removal, or a malware removal process for the web application; or

effecting at least one of a redeployment, a reinstallation, or a reconfiguration of the web application.

2. The method of claim 1 , wherein the characteristics of the web page include records corresponding to hypertext markup language (HTML) tags in the web page.

3. A computer system comprising:

a processor and memory storing computer program code for detecting an anomalous change to a configuration of a web application, the web application executing with a web server, by:

receiving a first set of distinct records for the web application operating in a training mode of operation during which the web application is isolated from a wide area network, each record in the first set of distinct records including characteristics of a content of a web page for the web application during a training time period;

generating a sparse distributed representation of the first set of distinct records to form a training set for a hierarchical temporal memory (HTM);

training the HTM based on the training set in order that the trained HTM provides a model of operation of the web application in the training mode of operation, wherein the HTM evaluates an anomaly score for the records in the first set of distinct records and the HTM is trained until the anomaly score meets a predetermined threshold degree of anomaly;

receiving a second set of records for the web application operating in a production mode of operation, each record in the second set of records including characteristics of content of the web page during an operational time period, the operational time period being distinct from the training time period and the production mode of operation being distinct from the training mode of operation;

generating a sparse distributed representation of the second set of distinct records to form an input set for the trained HTM;

executing the trained HTM based on the input set to determine a degree of recognition of the records of the input set;

responsive to a determination that a degree of recognition of one or more records of the input set is below a threshold degree, identifying an anomalous change to the web page; and

responsive to the identification of the anomalous change to the web page, causing a responsive measure to the anomalous change to be implemented that includes one or more of the following actions:

interrupting operation of the web application;

identifying client components in communication with the web application as potentially compromised;

executing at least one of an intrusion detection, malware detection, virus removal, or a malware removal process for the web application; or

effecting at least one of a redeployment, a reinstallation, or a reconfiguration of the web application.

4. A non-transitory computer-readable storage element comprising computer program code to, when loaded into a computer system and executed thereon, cause the computer system to perform the method as claimed in claim 1 .

Assignments (1)

Priority Claims (1)

Continuity (1)

References Cited (61)