Reconstructing execution call flows to detect anomalies

A system to identify anomalous calls flowing through modules, comprising:

• a device comprising one or more processors coupled to memory, the device to:
• establish, using information extracted from a log file, a plurality of call flows, each of the plurality of call flows identifying information from the log file of a call flowing through a plurality of modules in accessing an application, wherein the information is extracted from the log file for each call flow of the plurality of call flows based at least on a timestamp, each call flow having a common unique transaction identifier and information from the log file for each call flow identified by the common unique transaction identifier;
• identify a count of a number of occurrences of one or more natural language keywords from the log file in information of each call flow of the plurality of call flows;
• generate a vector of numbers for each call flow based at least on the count for the one or more keywords for that call flow;
• classify, using the vector of numbers for each call flow, each call flow into one or more clusters that indicate whether an operation of the call flow is anomalous;
• and
• update a configuration of one or more of the other modules in accessing the application based at least on the one or more clusters.

A non-transitory computer readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to identify anomalous calls flowing through modules, the instructions comprising instructions to:

• establish, using information extracted from a log file, a plurality of call flows, each of the plurality of call flows identifying information from the log file of a call flowing through a plurality of modules, the information extracted from the log file for each call flow of the plurality of call flows based at least on a timestamp, each call flow having a common unique transaction identifier and information from the log file for each call flow identified by the common unique transaction identifier;
• identify a count of a number of occurrences of one or more natural language keywords from the log file in information of each call flow of the plurality of call flows;
• generate a vector of numbers for each call flow based at least on the count for the one or more keywords for that call flow;
• classify, using the vector of numbers for each call flow, each call flow into one or more clusters that indicate whether an operation of the call flow is anomalous;
• and
• update a configuration of one or more of the other modules in accessing the application based at least on the one or more clusters.