Method and apparatus for detecting anomalies in mission critical environments

A system for detecting anomalies in mission-critical environments, comprising:

• a processing circuitry;
• and
• a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
• isolate a protocol language of a data set comprising a text structure representing data regarding a network communication procedure between a plurality of user devices, wherein the protocol language comprises a pattern for implementing the network communication procedure;
• generate a document from the data set, wherein the document includes a text structure,
• organize, in light of the protocol language, the text structure into a natural language scheme by organizing ngrams in the text structure in one or more sequences in which the ngrams occur during the network communication procedure for the protocol language;
• detect, using the natural language scheme, insights in the document, wherein the insights comprise a likelihood of certain ngram sequence orderings of the ngrams during the network communication procedure in the protocol language;
• and
• generate a rule from the insights, wherein the rule comprises returning a detection of an anomaly when the certain ngram sequence orderings are violated in subsequent network communications using the protocol language.

A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process for detecting anomalies in mission-critical environments, the process comprising:

• isolating a protocol language of a data set comprising a text structure representing data regarding a network communication procedure between a plurality of user devices, wherein the protocol language comprises a pattern for implementing the network communication procedure;
• generating a document from the data set, wherein the document includes a text structure,
• organizing, in light of the protocol language, the text structure into a natural language scheme by organizing ngrams in the text structure in one or more sequences in which the ngrams occur during the network communication procedure for the protocol language;
• detecting, using the natural language scheme, insights in the document, wherein the insights comprise a likelihood of certain ngram sequence orderings of the ngrams during the network communication procedure in the protocol language;
• and
• generating a rule from the insights, wherein the rule comprises returning a detection of an anomaly when the certain ngram sequence orderings are violated in subsequent network communications using the protocol language.