Behavioral model based on short and long range event correlations in system traces

A method of generating a behavioral model of a computer system, the computer system having a system log that records activities generated by a plurality of processes executing on the computer system, the method comprising the steps of:

• one or more processors partitioning the system log into a plurality of strands, each strand including activities that share a common attribute, the activities included as past activities of the computer system;
• the one or more processors selecting attributes from the plurality of strands;
• the one or more processors generating first distinct n-grams, each n-gram comprised of attributes from successive activities within a strand;
• the one or more processors generating a first plurality of n-gram groups, each n-gram group including a plurality of the first distinct n-grams in which a first one of the plurality of first distinct n-grams coexists in a strand also containing a second one of the plurality of first distinct n-grams;
• the one or more processors generating a first plurality of n-gram group arrangements, each n-gram group arrangement including a plurality of n-gram groups, each of the n-gram groups being found, in combination, in at least one strand, and wherein a first set of integers respectively identifies the first plurality of distinct n-grams, an array of integers of the first set of integers that respectively correspond to the first plurality of distinct n-grams identifies an n-gram group of the first plurality of n-gram groups, and the first plurality of n-gram group arrangements are represented by arrays of n-gram group integer arrays, each n-gram group integer corresponding to an array of integers of an n-gram group of the first plurality of n-gram groups;
• the one or more processors generating a behavioral model based on the past activity of the computer system, wherein the behavioral model contains the first distinct n-grams, the first plurality of n-gram groups, and the first plurality of n-gram group arrangements;
• and
• the one or more processors determining whether an anomaly of current activity occurs in the computer system, based on generating a plurality of second distinct n-grams, a second plurality of n-gram groups, and a second plurality of n-gram group arrangements from attributes of partitioned strands of current activity of the computer system, applied to the behavior model.