# US 10,372,906 B2 · Behavioral model based on short and long range event correlations in system traces > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,372,906 B2 - Document ID: US10372906B2 - Status: Granted - Kind: B2 - Application number: 14/623,990 - Filed: 2015-02-17 - Published: 2016-08-18 - Granted: 2019-08-06 - Earliest claimed: 2015-02-17 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Olgierd S. Pieczul - Web page: https://patentgrep.com/patent/US10372906B2 ## CPC - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06Q 30/02: Marketing; Price estimation or determination; Fundraising - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR ## Abstract A method of generating a behavioral model of a computer system. A processor partitions a system log of process events into a plurality of strands sharing common characteristics. The processor selects attributes from the strands and generates first distinct n-grams that include attributes from successive events within a strand. The processor generates a first plurality of n-gram groups, each including a plurality of the first distinct n-grams in which a first one of the plurality of first distinct n-grams coexists in a strand also containing a second one of the plurality of first distinct n-grams. The processor generates a first plurality of n-gram group arrangements, each containing a plurality of n-gram groups, and each of the n-gram groups included, in combination, in at least one strand, and the behavioral model containing the first distinct n-grams, the first plurality of n-gram groups, and the first plurality of n-gram group arrangements. ## Claims ### Claim 1 A computer program product for determining whether an anomaly of current activities occurs in a computer system having a system log of recorded activities generated by a plurality of processes executing on the computer system, the computer program product comprising: a computer readable storage medium having computer readable program instructions embodied therewith, wherein the computer readable program instructions are executable by a computer processor, the program instructions comprising: program instructions to partition the system log into a plurality of strands, each strand including activities that share a common characteristic, the activities including past activities of the computer system; program instructions to select attributes of activities from the plurality of strands; program instructions to generate first distinct n-grams, based on the attributes of activities selected from the plurality of strands, wherein an n-gram includes attributes from successive activities within a strand; program instructions to generate a first plurality of n-gram groups, each n-gram group including one or more of the first distinct n-grams in which a first one of the one or more of the first distinct n-grams coexists in a strand also containing a second one of the one or more of the first distinct n-grams; program instructions to generate a first plurality of n-gram group arrangements, each n-gram group arrangement including a plurality of n-gram groups, each of the n-gram groups contained, in combination, in at least one strand, and wherein a first set of integers respectively identifies the first plurality of distinct n-grams, a combination of integers of the first set of integers that respectively correspond to the first plurality of distinct n-grams identifies an n-gram group of the first plurality of n-gram groups, and the first plurality of n-gram group arrangements are represented by arrays of combinations of integers, each combination of integers corresponding to an n-gram group of the first plurality of n-gram groups; program instructions to generate a behavioral model based on the past activities of the computer system, wherein the behavioral model contains the first distinct n-grams, the first plurality of n-gram groups, and the first plurality of n-gram group arrangements; and program instructions to determine whether an anomaly of current activities occurs in the computer system, based on determining whether the current activities represented as second distinct n-grams, second plurality of n-gram groups, and second plurality of n-gram group arrangements are found in the behavioral model. ### Claim 2 (depends on 1) The computer program product of claim 1, wherein the first distinct n-grams are represented in a hash table mapping each n-gram into an integer identifier. ### Claim 3 (depends on 1) The computer program product of claim 1, wherein the plurality of n-gram groups are represented by an array of integers corresponding to n-gram identifiers, each n-gram group of the first plurality of n-gram groups having its own identifier. ### Claim 4 (depends on 1) The computer program product of claim 1, wherein the first plurality of n-gram groups represent common sequences of first distinct n-grams appearing together within a strand of a process recorded in the system log. ### Claim 5 (depends on 1) The computer program product of claim 1, wherein determining whether an anomaly of computer processing activities occurs in the computer system, based on the behavioral model, comprises the steps of: program instructions to partition the system log, associated with recorded activities of current activity of the computer system, into a plurality of strands; program instructions to generate second distinct n-grams from the plurality of strands associated with the current activities of the computer system; program instructions to generate a second plurality of n-gram groups, each n-gram group including one or more of the second distinct n-grams in which a first one of the one or more of the second distinct n-grams coexists in a strand also containing a second one of the one or more of the second distinct n-grams; program instructions to generate a second plurality of n-gram group arrangements, each n-gram group arrangement including a plurality of n-gram groups, each of the n-gram groups contained, in combination, in at least one strand associated with the current activities of the computer system, wherein a second set of integers respectively identifies second distinct n-grams, a combination of integers of the second set of integers that respectively correspond to second distinct n-grams, identifies an n-gram group of the second plurality of n-gram groups, and each n-gram group arrangement is identified by an array of second plurality n-gram group integer combinations; program instructions to determine whether an anomaly exists between the current activities of the computer system and the past activities of the computer system, based on one or more of: one of the second distinct n-grams failing to appear in the first distinct n-grams, the second plurality of n-grams groups failing to appear in the first plurality of n-gram groups, and the second plurality of n-gram group arrangements failing to appear in the first plurality of n-gram group arrangements; and program instructions, responsive to a determination that an anomaly exists between the current activity and the past activity, to provide an alert of the detection of the anomaly. ### Claim 6 (depends on 5) The computer program product of claim 5, wherein the determination that an anomaly exists includes at least one second distinct n-gram that is absent in the first distinct n-grams, and at least one of: a second n-gram group of the second plurality of n-gram groups, which is absent in the first plurality of n-gram groups, and a second n-gram group arrangement of the plurality of second n-gram group arrangements, which is absent in the first plurality of n-gram group arrangements. ### Claim 7 A computer system for determining whether an anomaly of current activities occurs in a computer system having a system log of recorded activities generated by a plurality of processes executing on the computer system, the system comprising: one or more computer processors; one or more computer readable storage media; and program instructions stored on the computer readable storage media for execution by at least one of the one or more processors, the program instructions comprising: program instructions to partition the system log into a plurality of strands, each strand including activities that share a common characteristic, the activities included as past activities of the computer system; program instructions to select attributes of activities from the plurality of strands; program instructions to generate first distinct n-grams, based on the attributes of activities selected from the plurality of strands, wherein an n-gram includes attributes from successive activities within a strand; program instructions to generate a first plurality of n-gram groups, each n-gram group including one or more of the first distinct n-grams in which a first one of the one or more of the first distinct n-grams coexists in a strand also containing a second one of the one or more of the first distinct n-grams; program instructions to generate a first plurality of n-gram group arrangements, each n-gram group arrangement including a plurality of n-gram groups, each of the n-gram groups contained, in combination, in at least one strand, and wherein a first set of integers respectively identifies the first plurality of distinct n-grams, a combination of integers of the first set of integers that respectively correspond to the first plurality of distinct n-grams identifies an n-gram group of the first plurality of n-gram groups, and the first plurality of n-gram group arrangements are represented by arrays of combinations of integers, each combination of integers corresponding to an n-gram group of the first plurality of n-gram groups; program instructions to generate a behavioral model based on the past activities of the computer system, wherein the behavioral model contains the first distinct n-grams, the first plurality of n-gram groups, and the first plurality of n-gram group arrangements; and program instructions to determine whether an anomaly of current activities occurs in the computer system, based on determining whether the current activities represented as second distinct n-grams, second plurality of n-gram groups, and second plurality of n-gram group arrangements are found in the behavioral model. ### Claim 8 (depends on 7) The computer system of claim 7, wherein the first distinct n-grams are represented in a hash table mapping each n-gram into an integer identifier. ### Claim 9 (depends on 7) The computer system of claim 7, wherein the first plurality of n-gram groups represent common sequences of first distinct n-grams appearing together within a strand of a process recorded in the system log. ### Claim 10 (depends on 7) The computer system of claim 7, wherein determining whether an anomaly of activities occurs in the computer system, based on the behavioral model, comprises the steps of: program instructions to partition the system log, associated with recorded activities of current activity of the computer system, into a plurality of strands; program instructions to generate second distinct n-grams from the plurality of strands associated with the current activities of the computer system; program instructions to generate a second plurality of n-gram groups, each n-gram group including one or more of the second distinct n-grams in which a first one of the one or more of the second distinct n-grams coexists in a strand also containing a second one of the one or more of the second distinct n-grams; program instructions to generate a second plurality of n-gram group arrangements, each n-gram group arrangement including a plurality of n-gram groups, each of the n-gram groups contained, in combination, in at least one strand associated with the current activity of the computer system, and wherein a second set of integers respectively identifies second distinct n-grams, a combination of integers of the second set of integers that respectively correspond to second distinct n-grams, identifies an n-gram group of the second plurality of n-gram groups, and each n-gram group arrangement is identified by an array of second plurality n-gram group integer combinations; program instructions to determine whether an anomaly exists between the current activities of the computer system and the past activities of the computer system, based on one or more of: one of the second distinct n-grams failing to appear in the first distinct n-grams, the second plurality of n-gram groups failing to appear in the first plurality of n-gram groups, and the second plurality of n-gram group arrangements failing to appear in the first plurality of n-gram group arrangements; and program instructions, responsive to a determination that an anomaly exists, to provide an alert of the detection of the anomaly. ### Claim 11 (depends on 10) The computer system of claim 10, wherein the determination that an anomaly exists includes at least one second distinct n-gram that is absent in the first distinct n-grams, and at least one of: a second n-gram group of the second plurality of n-gram groups, which is absent in the first plurality of n-gram groups, and a second n-gram group arrangement of the plurality of second n-gram group arrangements, which is absent in the first plurality of n-gram group arrangements.