# US 11,122,065 B2 · Adaptive anomaly detection for computer systems > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,122,065 B2 - Document ID: US11122065B2 - Status: Granted - Kind: B2 - Application number: 16/103,108 - Filed: 2018-08-14 - Published: 2020-02-20 - Granted: 2021-09-14 - Earliest claimed: 2018-08-14 - Assignees: VMware, Inc. - Applicants: VMware, Inc. - Inventors: Bin Zan; Dexiang Wang; Zhen Mo; Vijay Ganti - Web page: https://patentgrep.com/patent/US11122065B2 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 18/23213: with fixed number of clusters, e.g. K-means clustering - G06F 18/24137: {Distances to cluster centroïds} - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Feature vectors are abstracted from data describing application processes. The feature vectors are grouped to define non-anomalous clusters of feature vectors corresponding to normal application behavior. Subsequent feature vectors are considered anomalous if they do not fall within one of the non-anomalous clusters; alerts are issued for anomalous feature vectors. In addition, the subsequent feature vectors may be used to regroup feature vectors to adapt to changes in what constitutes normal application behavior. ## Claims ### Claim 1 A computer-implemented method, performed within an enterprise application operating in a virtualized environment, for collecting process data characterizing processes and connections of a virtual machine using an application-protector agent installed in said virtual machine, said computer-implemented method comprising: collecting, by said application-protector agent, first said process data describing application processes of said virtual machine, said application-protector agent installed in said virtual machine; extracting, by said application-protector agent, first feature vectors from the process data; grouping, by said application-protector agent, the feature vectors to define or redefine non-anomalous clusters of feature vectors, wherein the non-anomalous clusters include respective centroids, each centroid associating with each of the plural process features a true value or a false value; collecting, by said application-protector agent, next process data describing application processes; extracting, by said application-protector agent, next feature vectors from the next process data; determining, by said application-protector agent, whether or not a next feature vector is within at least one of the non-anomalous clusters; and issuing an alert in response to a determination, by said application-protector agent, that the next feature vector is not within at least one of the non-anomalous clusters. ### Claim 2 (depends on 1) The method of claim 1 wherein: each feature represents a respective process instance, each feature vector associating with each of plural process features a true value or a false value, each true value indicating that the respective process data indicates that the respective feature has been present in the respective process instance, each false value indicating that the respective process data indicates that the respective feature has not been present in the respective process instance. ### Claim 3 (depends on 2) The method of claim 2 further comprising subset match filtering the next feature vectors to eliminate false positives, the filtering including filtering out feature vectors for which at least one of the centroids associates true values with every process feature with which the feature vector associates a true value so that the determining applies only to feature vectors for which there is no non-anomalous cluster with a centroid that associates true values with every process feature with which that feature vector associates a true value. ### Claim 4 (depends on 1) The method of claim 1 wherein the clusters are redefined more than once to adapt to changes in the normal behavior of an application. ### Claim 5 (depends on 1) The method of claim 1 wherein the grouping re-defines existing clusters and the re-defining involves attributing greater weight to more-recent feature vectors than to less-recent feature vectors that are given a non-zero weight. ### Claim 6 (depends on 1) The method of claim 1 wherein the grouping uses an X-means algorithm to define or re-define the clusters. ### Claim 7 A system including an enterprise application operating in a virtualized environment, for collecting process data characterizing processes and connections of a virtual machine using an application-protector agent installed in said virtual machine, said system further comprising non-transitory media encoded with code that, when executed by a processor, implements a method including: collecting, by said application-protector agent, first said process data describing application processes of said virtual machine, said application-protector agent installed in said virtual machine; extracting, by said application-protector agent, first feature vectors from the process data; grouping, by said application-protector agent, the feature vectors to define or redefine non-anomalous clusters of feature vectors, wherein the non-anomalous clusters include respective centroids, each centroid associating with each of the plural process features a true value or a false value; collecting, by said application-protector agent, next process data describing application processes; extracting, by said application-protector agent, next feature vectors from the next process data; determining, by said application-protector agent, whether or not a next feature vector is within at least one of the non-anomalous clusters; and issuing an alert in response to a determination, by said application-protector agent, that the next feature vector is not within at least one of the non-anomalous clusters. ### Claim 8 (depends on 7) The system of claim 7 wherein: each feature represents a respective process instance, each feature vector associating with each of plural process features a true value or a false value, each true value indicating that the respective process data indicates that the respective feature has been present in the respective process instance, each false value indicating that the respective process data indicates that the respective feature has not been present in the respective process instance. ### Claim 9 (depends on 8) The system of claim 8 wherein the method further includes subset match filtering the next feature vectors to eliminate false positives, the filtering including filtering out feature vectors for which at least one of the centroids associates true values with every process feature with which the feature vector associates a true value so that the determining applies only to feature vectors for which there is no non-anomalous cluster with a centroid that associates true values with every process feature with which that feature vector associates a true value. ### Claim 10 (depends on 8) The system of claim 8 wherein the clusters are redefined more than once to adapt to changes in the normal behavior of an application. ### Claim 11 (depends on 7) The method of claim 7 wherein the grouping re-defines existing clusters and the re-defining involves attributing greater weight to more-recent feature vectors than to less-recent feature vectors that are given a non-zero weight. ### Claim 12 (depends on 7) The method of claim 7 wherein the grouping uses an X-means algorithm to define or re-define the clusters.