Loading patent…
AssigneeVMware, Inc.
InventorsAshot Nshan Harutyunyan, Arnak Poghosyan, Nicholas kushmerick, Naira Movses Grigoryan
Estimating the term…
Automated methods and systems to determine a baseline event-type distribution of an event source and use the baseline event type distribution to detect changes in the behavior of the event source are described. In one implementation, blocks of event messages generated by the event source are collected and an event-type distribution is computed for each of block of event messages. Candidate baseline event-type distributions are determined from the event-type distributions. The candidate baseline event-type distribution has the largest entropy of the event-type distributions. A normal discrepancy radius of the event-type distributions is computed from the baseline event-type distribution and the event-type distributions. A block of run-time event messages generated by the event source is collected. A run-time event-type distribution is computed from the block of run-time event messages. When the run-time event-type distribution is outside the normal discrepancy radius, an alert is generated indicating abnormal behavior of the event source.
An automated method stored in one or more data-storage devices and executed using one or more processors of a computer system to determine a baseline event-type distribution and detect abnormal behavior of an event source, the method comprising:
A system to determine a baseline event-type distribution and detect abnormal behavior of an event source, the system comprising:
A non-transitory computer-readable medium encoded with machine-readable instructions that implement a method carried out by one or more processors of a computer system to perform the operations of
Dependencies are inferred from the claim text.