Anomaly detection for computer systems

1. A computer implemented method to detect a computer system in execution operating in a manner that is not compliant with a definition of a set of compliant operations, the method comprising:

receiving a first set of records for the computer system, each record detailing an occurrence in the computer system during a first predetermined time period;

generating a sparse distributed representation of the first set of records to form a training set for a hierarchical temporal memory (HTM);

training the HTM based on the training set in order that the trained HTM provides a model of operation of the computer system during the first predetermined time period;

selecting at least a subset of operations in the set of compliant operations and causing the invocation of each operation of the subset of operations in the computer system over a second predetermined time period to generate a second set of records of occurrences in the computer system;

generating a sparse distributed representation of the second set of records to form an input set for the trained HTM;

executing the trained HTM based on the input set to determine a degree of recognition of the records of the input set; and

responsive to a determination that a degree of recognition of one or more records of the input set is below a threshold degree, identifying the operation of the computer system as non-compliant.

2. The method of claim 1 , further comprising, in response to an identification that the operation of the computer system is non-compliant, implementing a protective measure to protect against a malicious operation of the computer system.

3. The method of claim 2 , wherein the protective measure includes one or more of: causing a cessation of operation of the computer system; generating an event indicating the non-compliance of the computer system; suspending operation of the computer system; or executing one or more protective software components or remedial software components in the computer system.

4. A non-transitory computer-readable storage medium storing a computer program element comprising computer program code to, when loaded into a computer system and executed thereon, cause the computer system to perform the method as claimed in claim 1 .

5. A computer system comprising:

a processor and memory storing computer program code for detecting a computer system in execution operating in a manner that is not compliant with a definition of a set of compliant operations, the method comprising:

receiving a first set of records for the computer system, each record detailing an occurrence in the computer system during a first predetermined time period;

generating a sparse distributed representation of the first set of records to form a training set for a hierarchical temporal memory (HTM);

training the HTM based on the training set in order that the trained HTM provides a model of operation of the computer system during the first predetermined time period;

selecting at least a subset of operations in the set of compliant operations and causing the invocation of each operation of the subset of operations in the computer system over a second predetermined time period to generate a second set of records of occurrences in the computer system;

generating a sparse distributed representation of the second set of records to form an input set for the trained HTM;

executing the trained HTM based on the input set to determine a degree of recognition of the records of the input set; and

responsive to a determination that a degree of recognition of one or more records of the input set is below a threshold degree, identifying the operation of the computer system as non-compliant.