Method and apparatus for detecting anomalies in mission critical environments using word representation learning

1. A method for detecting anomalies in mission-critical environments using word representation learning, comprising:

parsing at least one received data set into a text structure;

isolating a protocol language of the at least one received data set, wherein:

the protocol language is a standardized pattern for communication over at least one communication protocol, and

isolating comprises analyzing the text structure to determine a network language constructed from at least one of messages, sessions, and procedures in the at least one received data set;

generating at least one document, in the protocol language, from contents of the at least one received data set, wherein the at least one document includes at least one parsed text structure referencing a unique identifier;

detecting, using a trained word representation learning model and in light of the protocol language isolated, insights in the at least one document, wherein:

the insights are detected in at least one representation having at least one dimension,

the at least one representation is mapped to at least one learned hyperspace, and

the insights describe patterns occurring in the at least one document;

extracting rules from the insights; and

detecting anomalies by applying the rules on patterns for communication over at least one communication protocol.

2. The method of claim 1 , wherein isolating the protocol language of the at least one received data set and generating the at least one document from the contents of the at least one received data set occur substantially simultaneously.

3. The method of claim 1 , wherein detecting insights in the at least one document further comprises:

applying a natural language processing (NLP) technique to the at least one document.

4. The method of claim 3 , wherein the at least one representation includes a vector representation of at least one information element.

5. The method of claim 1 , wherein the at least one received data set includes any one of: machine-to-machine communications and application programming interface (API) communications.

6. The method of claim 5 , wherein parsing the at least one received data set further comprises:

parsing the at least one received data set as any one of: sentences, words, information elements, data units, and parsing procedures or sequences involving data packets or messages as paragraphs, wherein paragraphs contain sentences and sentences contain words.

7. The method of claim 1 , wherein isolating the protocol language of the at least one received data set further comprises:

identifying pre-defined messages, procedures, and sessions for a protocol.

8. The method of claim 1 , wherein generating the at least one document further comprises:

identifying unique identifiers in the at least one received data set; and

creating separate documents containing records relating to each identified unique identifier.

9. The method of claim 1 , wherein the at least one learned hyperspace is a depiction of the at least one representation, and wherein semantic similarity between the at least one representation is determined by proximity within the at least one learned hyperspace.

10. A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process for detecting anomalies in mission-critical environments using word representation learning, the process comprising:

parsing at least one received data set into a text structure;

isolating a protocol language of the at least one received data set, wherein:

the protocol language is a standardized pattern for communication over at least one communication protocol, and

isolating comprises analyzing the text structure to determine a network language constructed from at least one of messages, sessions, and procedures in the at least one received data set;

generating at least one document, in the protocol language, from contents of the at least one received data set, wherein the at least one document includes at least one parsed text structure referencing a unique identifier;

detecting, using a trained word representation learning model and in light of the protocol language isolated, insights in the at least one document, wherein:

the insights are detected in at least one representation having at least one dimension,

the at least one representation is mapped to at least one learned hyperspace, and

the insights describe patterns occurring in the at least one document;

extracting rules from the insights; and

detecting anomalies by applying the rules on patterns for communication over at least one communication protocol.

11. A system for detecting anomalies in mission-critical environments using word representation learning, comprising:

a processing circuitry; and

a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:

parse at least one received data set into a text structure;

isolate a protocol language of the at least one received data set, wherein:

the protocol language is a standardized pattern for communication over at least one communication protocol, and

isolating comprises analyzing the text structure to determine a network language constructed from at least one of messages, sessions, and procedures in the at least one received data set;

generate at least one document, in the protocol language, from contents of the at least one received data set, wherein the at least one document includes at least one parsed text structure referencing a unique identifier;

detect, using a trained word representation learning model and in light of the protocol language isolated, insights in the at least one document, wherein:

the insights are detected in at least one representation having at least one dimension,

the at least one representation is mapped to at least one learned hyperspace, and

the insights describe patterns occurring in the at least one document;

extract rules from the insights; and

detect anomalies by applying the rules on patterns for communication over at least one communication protocol.

12. The system of claim 11 , wherein the system is configured to:

generate the at least one document from the contents of the at least one received data set and to isolate a protocol language of the at least one received data set, substantially simultaneously.

13. They system of claim 11 , wherein the system is configured to:

apply a natural language processing (NLP) technique to the at least one document.

14. The system of claim 13 , wherein the at least one representation includes a vector representation of least one information element.

15. The system of claim 11 , wherein the at least one received data set includes any one of: machine-to-machine communications and application programming interface (API) communications.

16. The system of claim 15 , wherein the system is configured to:

parse the at least one received data set as any one of: sentences, words, information elements, data units, and parsing procedures or sequences involving data packets or messages as paragraphs, wherein paragraphs contain sentences and sentences contain words.

17. The system of claim 11 , wherein the system is configured to:

identify pre-defined messages, procedures, and sessions for a protocol.

18. The system of claim 11 , wherein the system is further configured to:

identify unique identifiers in the at least one received data set; and

create separate documents containing records relating to each identified unique identifier.

19. The system of claim 11 , wherein the at least one learned hyperspace is a depiction of the at least one representation, and wherein semantic similarity between the at least one representation is determined by proximity within the at least one learned hyperspace.