Adaptive anomaly detection for computer systems
AssigneeVMware, Inc.
InventorsBin Zan, Dexiang Wang, Zhen Mo, Vijay Ganti
Life of this patent
Estimating the term…
Abstract
Feature vectors are abstracted from data describing application processes. The feature vectors are grouped to define non-anomalous clusters of feature vectors corresponding to normal application behavior. Subsequent feature vectors are considered anomalous if they do not fall within one of the non-anomalous clusters; alerts are issued for anomalous feature vectors. In addition, the subsequent feature vectors may be used to regroup feature vectors to adapt to changes in what constitutes normal application behavior.
Claims12
A computer-implemented method, performed within an enterprise application operating in a virtualized environment, for collecting process data characterizing processes and connections of a virtual machine using an application-protector agent installed in said virtual machine, said computer-implemented method comprising:
- collecting, by said application-protector agent, first said process data describing application processes of said virtual machine, said application-protector agent installed in said virtual machine;
- extracting, by said application-protector agent, first feature vectors from the process data;
- grouping, by said application-protector agent, the feature vectors to define or redefine non-anomalous clusters of feature vectors, wherein the non-anomalous clusters include respective centroids, each centroid associating with each of the plural process features a true value or a false value;
- collecting, by said application-protector agent, next process data describing application processes;
- extracting, by said application-protector agent, next feature vectors from the next process data;
- determining, by said application-protector agent, whether or not a next feature vector is within at least one of the non-anomalous clusters;
- and
- issuing an alert in response to a determination, by said application-protector agent, that the next feature vector is not within at least one of the non-anomalous clusters.
A system including an enterprise application operating in a virtualized environment, for collecting process data characterizing processes and connections of a virtual machine using an application-protector agent installed in said virtual machine, said system further comprising non-transitory media encoded with code that, when executed by a processor, implements a method including:
- collecting, by said application-protector agent, first said process data describing application processes of said virtual machine, said application-protector agent installed in said virtual machine;
- extracting, by said application-protector agent, first feature vectors from the process data;
- grouping, by said application-protector agent, the feature vectors to define or redefine non-anomalous clusters of feature vectors, wherein the non-anomalous clusters include respective centroids, each centroid associating with each of the plural process features a true value or a false value;
- collecting, by said application-protector agent, next process data describing application processes;
- extracting, by said application-protector agent, next feature vectors from the next process data;
- determining, by said application-protector agent, whether or not a next feature vector is within at least one of the non-anomalous clusters;
- and
- issuing an alert in response to a determination, by said application-protector agent, that the next feature vector is not within at least one of the non-anomalous clusters.
Dependencies are inferred from the claim text.