Cyber anomaly detection using an artificial neural network

A system comprising:

• a computer processor;
• and
• a computer memory coupled to the computer processor and comprising instructions;
• wherein the computer processor is operable to execute the instructions and execute a process comprising:
• receiving data patterns in real time into a hardware-based artificial neural network;
• training the hardware-based artificial neural network using the data patterns such that the hardware-based artificial neural network learns normal data patterns;
• identifying a new data pattern in the data patterns when the new data pattern deviates from the normal data patterns;
• training the hardware-based artificial neural network using the new data pattern such that the hardware-based artificial neural network learns the new data pattern by altering synaptic weights associated with the new data pattern;
• monitoring a first rate at which the hardware-based artificial neural network alters the synaptic weights associated with the new data pattern;
• and
• identifying the new data pattern as a malicious data pattern when the first rate at which the hardware-based artificial neural network alters the synaptic weights associated with the new data pattern exceeds a threshold;
• and
• wherein the hardware-based artificial neural network comprises:
• a comparator;
• a memory location or register to receive the new data, the memory location or register coupled to an input of the comparator;
• and
• a table containing the learned data patterns, the table coupled to the input of the comparator;
• wherein the comparator is configured to determine that the new data patterns are not one of the learned data patterns;
• and
• wherein in response to a determination that the new data patterns are not one of the learned data patterns, training the hardware-based artificial neural network with the new data patterns and observing when and how often the hardware-based artificial neural network alters the synaptic weights to determine whether the new data patterns are anomalies.

A process comprising:

• receiving, in real time, computer system operating data from a computer system into a hardware-based artificial neural network;
• training the hardware-based artificial neural network using the computer system operating data such that the hardware-based artificial neural network learns normal operating conditions of the computer system;
• identifying a new pattern of the computer system operating data when the new pattern deviates from the normal operating conditions of the computer system;
• training the hardware-based artificial neural network using the new pattern such that the hardware-based artificial neural network learns the new pattern by altering synaptic weights associated with the new pattern;
• monitoring a first rate at which the hardware-based artificial neural network alters the synaptic weights associated with the new pattern;
• and
• identifying the new pattern as indicating a failure in the computer system when the first rate at which the hardware-based artificial neural network alters the synaptic weights associated with the new pattern exceeds a threshold;
• and
• wherein the hardware-based artificial neural network comprises:
• a comparator;
• a memory location or register to receive the new data, the memory location or register coupled to an input of the comparator;
• and
• a table containing the learned data patterns, the table coupled to the input of the comparator;
• wherein the comparator is configured to determine that the new data patterns are not one of the learned data patterns;
• and
• wherein in response to a determination that the new data patterns are not one of the learned data patterns, training the hardware-based artificial neural network with the new data patterns and observing when and how often the hardware-based artificial neural network alters the synaptic weights to determine whether the new data patterns are anomalies.