Method and apparatus for detecting anomalies in mission critical environments

1. A method comprising:

isolating a protocol language of a data set comprising a text structure representing data regarding a network communication procedure between a plurality of user devices, wherein the protocol language comprises a pattern for implementing the network communication procedure;

generating a document from the data set, wherein the document includes a text structure,

organizing, in light of the protocol language, the text structure into a natural language scheme by organizing ngrams in the text structure in one or more sequences in which the ngrams occur during the network communication procedure for the protocol language;

detecting, using the natural language scheme, insights in the document, wherein the insights comprise a likelihood of certain ngram sequence orderings of the ngrams during the network communication procedure in the protocol language; and

generating a rule from the insights, wherein the rule comprises returning a detection of an anomaly when the certain ngram sequence orderings are violated in subsequent network communications using the protocol language.

2. The method of claim 1 , wherein the document includes a parsed text structure referencing a unique identifier.

3. The method of claim 1 , further comprising:

detecting the anomaly by applying the rule.

4. The method of claim 1 , wherein detecting insights further comprises:

applying a natural language processing (NLP) technique to the document.

5. The method of claim 4 , wherein the natural language processing (NLP) technique includes at least statistical language modeling (SLM).

6. The method of claim 4 , wherein the natural language processing (NLP) technique includes at least word embedding.

7. The method of claim 1 , wherein isolating further comprises:

identifying pre-defined messages, procedures, and sessions for a protocol.

8. A system for detecting anomalies in mission-critical environments, comprising:

a processing circuitry; and

a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:

isolate a protocol language of a data set comprising a text structure representing data regarding a network communication procedure between a plurality of user devices, wherein the protocol language comprises a pattern for implementing the network communication procedure;

generate a document from the data set, wherein the document includes a text structure,

organize, in light of the protocol language, the text structure into a natural language scheme by organizing ngrams in the text structure in one or more sequences in which the ngrams occur during the network communication procedure for the protocol language;

detect, using the natural language scheme, insights in the document, wherein the insights comprise a likelihood of certain ngram sequence orderings of the ngrams during the network communication procedure in the protocol language; and

generate a rule from the insights, wherein the rule comprises returning a detection of an anomaly when the certain ngram sequence orderings are violated in subsequent network communications using the protocol language.

9. The system of claim 8 , wherein the document includes a parsed text structure referencing a unique identifier.

10. The system of claim 8 , wherein the instructions, when executed by the processing circuitry, further configure the system to:

detect the anomaly by applying the rule.

11. The system of claim 8 , wherein the instructions, when executed by the processing circuitry, further configure the system to detect insights by:

applying a natural language processing (NLP) technique to the document.

12. The system of claim 11 , wherein the natural language processing (NLP) technique includes at least statistical language modeling (SLM).

13. The system of claim 11 , wherein the natural language processing (NLP) technique includes at least word embedding.

14. The system of claim 8 , wherein the instructions, when executed by the processing circuitry, further configure the system to isolate by:

identifying pre-defined messages, procedures, and sessions for a protocol.

15. A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process for detecting anomalies in mission-critical environments, the process comprising:

isolating a protocol language of a data set comprising a text structure representing data regarding a network communication procedure between a plurality of user devices, wherein the protocol language comprises a pattern for implementing the network communication procedure;

generating a document from the data set, wherein the document includes a text structure,

organizing, in light of the protocol language, the text structure into a natural language scheme by organizing ngrams in the text structure in one or more sequences in which the ngrams occur during the network communication procedure for the protocol language;

detecting, using the natural language scheme, insights in the document, wherein the insights comprise a likelihood of certain ngram sequence orderings of the ngrams during the network communication procedure in the protocol language; and

generating a rule from the insights, wherein the rule comprises returning a detection of an anomaly when the certain ngram sequence orderings are violated in subsequent network communications using the protocol language.

16. The non-transitory computer readable medium of claim 15 , wherein the process further comprises:

detecting the anomaly by applying the rule.

17. The non-transitory computer readable medium of claim 15 , wherein, in the process, detecting insights further comprises:

applying a natural language processing (NLP) technique to the document.

18. The non-transitory computer readable medium of claim 17 , wherein the natural language processing (NLP) technique includes at least statistical language modeling (SLM).

19. The non-transitory computer readable medium of claim 17 , wherein the natural language processing (NLP) technique includes at least word embedding.

20. The non-transitory computer readable medium of claim 15 , wherein isolating further comprises:

identifying pre-defined messages, procedures, and sessions for a protocol.