# US 2019/0318093 A1 · Behavioral model based on short and long range event correlations in system traces > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0318093 A1 - Document ID: US20190318093A1 - Status: Published application - Kind: A1 - Application number: 16/453,466 - Filed: 2019-06-26 - Published: 2019-10-17 - Earliest claimed: 2015-02-17 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Olgierd S. Pieczul - Web page: https://patentgrep.com/patent/US20190318093A1 ## CPC - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06Q 30/02: Marketing; Price estimation or determination; Fundraising - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR ## Abstract A method of generating a behavioral model of a computer system. A processor partitions a system log of process events into a plurality of strands sharing common characteristics. The processor selects attributes from the strands and generates first distinct n-grams that include attributes from successive events within a strand. The processor generates a first plurality of n-gram groups, each including a plurality of the first distinct n-grams in which a first one of the plurality of first distinct n-grams coexists in a strand also containing a second one of the plurality of first distinct n-grams. The processor generates a first plurality of n-gram group arrangements, each containing a plurality of n-gram groups, and each of the n-gram groups included, in combination, in at least one strand, and the behavioral model containing the first distinct n-grams, the first plurality of n-gram groups, and the first plurality of n-gram group arrangements. ## Claims ### Claim 1 A method for generating a model for determining anomalous behavior within activities of a computer system, the method comprising: one or more processors partitioning a system log of a computer system into a plurality of strands, wherein respective strands are comprised of past activities of the computer system events that share a common attribute; the one or more processors selecting attributes from said respective strands; the one or more processors generating a plurality of first n-grams, wherein a first n-gram of the first plurality of first n-grams is comprised of the attributes selected from successive activities within a strand and respectively identified by a set of integers; the one or more processors generating a plurality of n-gram groups, wherein an n-gram group of the plurality of n-gram groups is comprised of one or more first n-grams appearing together in a strand and respectively identified by an array of integers of the set of integers of component n-grams; the one or more processors generating a plurality of n-gram group arrangements, wherein an n-gram group arrangement of the plurality of n-gram group arrangements is comprised of a plurality of n-gram groups, each of said n-gram groups being found in combination in at least one strand, and wherein an n-gram group arrangement is identified by an array of integers representing component n-gram groups; and generating a behavioral model including said n-grams, said plurality of n-gram groups and said plurality of n-gram group arrangements. ### Claim 2 (depends on 1) The method of claim 1, wherein the plurality of first n-grams is represented in a hash table mapping each n-gram into an integer identifier. ### Claim 3 (depends on 1) The method of claim 1, wherein the attributes of successive activities within the respective strands are selected from a group consisting of: a timestamp, a sequence number, a user identification associated with the activity, a command, an operand on which the command performs, a process identification, and a wildcard character. ### Claim 4 (depends on 1) The method of claim 1, wherein the plurality of n-gram groups represent common sequences of first n-grams appearing at the start of a process or common sequences of distinct n-grams appearing at the end of a process. ### Claim 5 (depends on 1) The method of claim 1, wherein a trace includes a sequence of activities of the computer system, and wherein a strand includes a portion of a trace that shares a common attribute of the activities. ### Claim 6 (depends on 1) The method of claim 1, wherein determining whether an anomaly of events occurs in the computer system, based on the behavioral model, comprises the steps of: the one or more processors partitioning the system log, associated with recorded events of current activity of the computer system, into a plurality of strands; the one or more processors generating a plurality of second n-grams from the plurality of strands associated with the current activity of the computer system; the one or more processors generating a plurality of second n-gram groups, each n-gram group including a one or more of the second n-grams in which a first one of the one or more second distinct n-grams coexists in a strand also containing a second one of the one or more second distinct n-grams; the one or more processors generating a plurality of second n-gram group arrangements, each n-gram group arrangement including one or more n-gram groups, each of the n-gram groups contained, in combination, in at least one strand associated with the current activity of the computer system; the one or more processors determining whether an anomaly exists between the current activity of the computer system and the past activity of the computer system, based on one or more of: the second n-grams appearing in the first n-grams, the second n-gram groups appearing the first n-gram groups, and the second n-gram group arrangements appearing in the first n-gram group arrangements; and the one or more processors, responsive to a determination that an anomaly exists between the current activity and the past activity, providing a notification of the detection of the anomaly to an end user of the computer system. ### Claim 7 (depends on 6) The method of claim 6, wherein the determination that an anomaly exists includes at least one second n-gram that is absent in the first n-grams, and at least one of: a second n-gram group of the one or more second n-gram groups, which is absent in the plurality of first n-gram groups, and a second n-gram group arrangement of the plurality of second n-gram group arrangements, which is absent in the plurality of first n-gram arrangements. ### Claim 8 A computer program product for generating a model for determining anomalous behavior within activities of a computer system, the method comprising: a computer readable storage medium having computer readable program instructions embodied therewith, wherein the computer readable program instructions are executable by a computer processor, the program instructions comprising: program instructions to partition a system log of a computer system into a plurality of strands, wherein respective strands are comprised of past activities of the computer system events that share a common attribute; program instructions to select attributes from said respective strands; program instructions to generate a plurality of first n-grams, wherein a first n-gram of the first plurality of first n-grams is comprised of the attributes selected from successive activities within a strand and respectively identified by a set of integers; program instructions to generate a plurality of n-gram groups, wherein an n-gram group of the plurality of n-gram groups is comprised of one or more first n-grams appearing together in a strand and respectively identified by an array of integers of the set of integers of component n-grams; program instructions to generate a plurality of n-gram group arrangements, wherein an n-gram group arrangement of the plurality of n-gram group arrangements is comprised of a plurality of n-gram groups, each of said n-gram groups being found in combination in at least one strand, and wherein an n-gram group arrangement is identified by an array of integers representing component n-gram groups; and program instructions to generate a behavioral model including said n-grams, said plurality of n-gram groups and said plurality of n-gram group arrangements. ### Claim 9 (depends on 8) The computer program product of claim 8, wherein the plurality of first n-grams is represented in a hash table mapping each n-gram into an integer identifier. ### Claim 10 (depends on 8) The computer program product of claim 8, wherein the attributes of successive activities within the respective strands are selected from a group consisting of: a timestamp, a sequence number, a user identification associated with the activity, a command, an operand on which the command performs, a process identification, and a wildcard character. ### Claim 11 (depends on 8) The computer program product of claim 8, wherein the plurality of n-gram groups represent common sequences of first n-grams appearing at the start of a process or common sequences of distinct n-grams appearing at the end of a process. ### Claim 12 (depends on 8) The computer program product of claim 8, wherein a trace includes a sequence of activities of the computer system, and wherein a strand includes a portion of a trace that shares a common attribute of the activities. ### Claim 13 (depends on 8) The computer program product of claim 8, wherein program instructions to determine whether an anomaly of events occurs in the computer system, based on the behavioral model, comprises the steps of: program instructions to partition the system log, associated with recorded events of current activity of the computer system, into a plurality of strands; program instructions to generate a plurality of second n-grams from the plurality of strands associated with the current activity of the computer system; program instructions to generate a plurality of second n-gram groups, each n-gram group including a one or more of the second n-grams in which a first one of the one or more second distinct n-grams coexists in a strand also containing a second one of the one or more second distinct n-grams; program instructions to generate a plurality of second n-gram group arrangements, each n-gram group arrangement including one or more n-gram groups, each of the n-gram groups contained, in combination, in at least one strand associated with the current activity of the computer system; program instructions to determine whether an anomaly exists between the current activity of the computer system and the past activity of the computer system, based on one or more of: the second n-grams appearing in the first n-grams, the second n-gram groups appearing the first n-gram groups, and the second n-gram group arrangements appearing in the first n-gram group arrangements; and program instructions, responsive to a determination that an anomaly exists between the current activity and the past activity, to provide a notification of the detection of the anomaly to an end user of the computer system. ### Claim 14 (depends on 13) The computer program product of claim 13, wherein program instructions to determine that an anomaly exists includes at least one second n-gram that is absent in the first n-grams, and at least one of: a second n-gram group of the one or more second n-gram groups, which is absent in the plurality of first n-gram groups, and a second n-gram group arrangement of the plurality of second n-gram group arrangements, which is absent in the plurality of first n-gram arrangements. ### Claim 15 A computer system, for generating a model for determining anomalous behavior within activities of a computer system, the system comprising: one or more computer processors; one or more computer readable storage media; and program instructions stored on the computer readable storage media for execution by at least one of the one or more processors, the program instructions comprising: program instructions to partition a system log of a computer system into a plurality of strands, wherein respective strands are comprised of past activities of the computer system events that share a common attribute; program instructions to select attributes from said respective strands; program instructions to generate a plurality of first n-grams, wherein a first n-gram of the first plurality of first n-grams is comprised of the attributes selected from successive activities within a strand and respectively identified by a set of integers; program instructions to generate a plurality of n-gram groups, wherein an n-gram group of the plurality of n-gram groups is comprised of one or more first n-grams appearing together in a strand and respectively identified by an array of integers of the set of integers of component n-grams; program instructions to generate a plurality of n-gram group arrangements, wherein an n-gram group arrangement of the plurality of n-gram group arrangements is comprised of a plurality of n-gram groups, each of said n-gram groups being found in combination in at least one strand, and wherein an n-gram group arrangement is identified by an array of integers representing component n-gram groups; and program instructions to generate a behavioral model including said n-grams, said plurality of n-gram groups and said plurality of n-gram group arrangements. ### Claim 16 (depends on 15) The computer system of claim 15, wherein the plurality of first n-grams is represented in a hash table mapping each n-gram into an integer identifier. ### Claim 17 (depends on 15) The computer system of claim 15, wherein the attributes of successive activities within the respective strands are selected from a group consisting of: a timestamp, a sequence number, a user identification associated with the activity, a command, an operand on which the command performs, a process identification, and a wildcard character. ### Claim 18 (depends on 15) The computer system of claim 15, wherein the plurality of n-gram groups represent common sequences of first n-grams appearing at the start of a process or common sequences of distinct n-grams appearing at the end of a process. ### Claim 19 (depends on 15) The computer system of claim 15, wherein program instructions to determine whether an anomaly of events occurs in the computer system, based on the behavioral model, comprises the steps of: program instructions to partition the system log, associated with recorded events of current activity of the computer system, into a plurality of strands; program instructions to generate a plurality of second n-grams from the plurality of strands associated with the current activity of the computer system; program instructions to generate a plurality of second n-gram groups, each n-gram group including a one or more of the second n-grams in which a first one of the one or more second distinct n-grams coexists in a strand also containing a second one of the one or more second distinct n-grams; program instructions to generate a plurality of second n-gram group arrangements, each n-gram group arrangement including one or more n-gram groups, each of the n-gram groups contained, in combination, in at least one strand associated with the current activity of the computer system; program instructions to determine whether an anomaly exists between the current activity of the computer system and the past activity of the computer system, based on one or more of: the second n-grams appearing in the first n-grams, the second n-gram groups appearing the first n-gram groups, and the second n-gram group arrangements appearing in the first n-gram group arrangements; and program instructions, responsive to a determination that an anomaly exists between the current activity and the past activity, to provide a notification of the detection of the anomaly to an end user of the computer system. ### Claim 20 (depends on 19) The computer system of claim 19, wherein program instructions to determine that an anomaly exists includes at least one second n-gram that is absent in the first n-grams, and at least one of: a second n-gram group of the one or more second n-gram groups, which is absent in the plurality of first n-gram groups, and a second n-gram group arrangement of the plurality of second n-gram group arrangements, which is absent in the plurality of first n-gram arrangements.