Method and a device for detecting an anomaly

The method of claim 1, wherein said determination step for determining the default value for the N-grams that do not belong to the messages of the training database comprises:

• a loop during which a current value is caused to vary, the loop comprising:
• a detection step for detecting anomalies among the messages of a test database of the reference class, evaluating whether each of those messages constitutes an anomaly by using the anomaly detection method of claim 10 after setting the default value equal to said current value in said vector;
• a determination step for determining a false positive rate for the messages of the test database for said current value on the basis of the number of anomalies detected among the messages of the test database;
• a detection step for detecting anomalies among messages unexpected by said application and contained in a database of messages not belonging to said reference class, evaluating whether each of these messages constitutes an anomaly by using the anomaly detection method according to claim 10 after setting said default value equal to said current value in said vector;
• and
• a determination step for determining a detection rate for each unexpected message on the basis of the number of anomalies detected among these unexpected messages;
• said default value being selected from said rates and from a utilization context of said method.

The method of claim 1, wherein said determination step for determining the default value for the N-grams that do not belong to the messages of the training database comprises:

• a first loop during which a current value is caused to vary, this first loop comprising:
• a detection step for detecting anomalies among the messages of a test database of the reference class, evaluating whether each of those messages constitutes an anomaly by using the anomaly detection method of claim 10 after setting the default value equal to said current value in said vector;
• a determination step for determining a false positive rate for the messages of the test database for said current value on the basis of the number of anomalies detected among these messages;
• a second loop during which a number of mutations is caused to vary, this second loop comprising:
• a generation step for generating messages of the test database and for each of these messages to generate an unexpected message that is obtained by varying the number of mutations of symbols in the N-grams of this message;
• and
• a determination step for determining a detection rate for said unexpected messages;
• a determination step for determining a minimum number of mutations for obtaining a predefined trusted detection rate;
• and
• a step during which each current value is associated with a pair comprising said minimum number of mutations and said false positive rate;
• and
• a selection step for selecting a said pair as a function of a utilization context for said method, said default value being selected on the basis of said value associated with said pair.

An anomaly detection method serving to determine whether a message that is to be evaluated, that is constituted by symbols and that is to be received by an application, constitutes an anomaly, the method comprising:

• an extraction step for extracting N-grams from the message that is to be evaluated;
• a scoring step of giving the message that is to be evaluated a score determined from a vector and from the N-grams of the message that is to be evaluated, the vector associating each of the N-grams in a set of messages of a training database of a reference class with a value corresponding to a probability of that N-gram occurring in said training database, and a default value for N-grams that do not belong to the messages of the training database, said score being given by a function that is selected to discriminate between the scores of anomalies and the scores of messages normally expected by said application, by comparing the scores with a threshold defined for the function;
• and
• a comparison step of comparing the score of the message that is to be evaluated with said threshold in order to decide whether or not the message that is to be evaluated is an anomaly.

A model creation device for creating a model serving to detect whether a message that is to be evaluated, that is constituted by symbols, and that might be received by an application, constitutes an anomaly, the device comprising:

• an obtaining module for obtaining a set of messages belonging to a reference class specific to the application in order to constitute a training database;
• an identification module for identifying the set of N-grams in the messages of the training database;
• and
• a generation module for generating a vector of the model, the vector associating:
• each of said N-grams with a value representing the probability of said N-gram occurring in the training database;
• and
• a default value for giving to the N-grams that do not belong to the messages of the training database;
• said device further comprising:
• a definition module for defining a function for giving a score to a message that is to be evaluated from the values of the vector associated with the N-grams of said message that is to be evaluated, this function being selected so as to discriminate between the scores of anomalies and the scores of normally expected messages by comparing those scores with a defined threshold that is defined for the function;
• said message that is to be evaluated being considered as being an anomaly or not an anomaly as a function of the result of the comparison between said score given to the message and said threshold.

An anomaly detection device serving to determine whether a message that is to be evaluated, that is constituted by symbols and that is to be received by an application, constitutes an anomaly, the device comprising:

• an extraction module for extracting N-grams from the message that is to be evaluated;
• a scoring module of giving a score to the message that is to be evaluated from a vector and from the N-grams of the message that is to be evaluated, the vector associating each of the N-grams in a set of messages of a training database of a reference class with a value corresponding to a probability of that N-gram occurring in said training database, and a default value for N-grams that do not belong to the messages of the training database, said score being given by a function that is selected to discriminate between the scores of anomalies and the scores of messages normally expected by said application, by comparing the scores with a threshold defined for the function;
• and
• a comparison module of comparing the score of the message that is to be evaluated with said threshold in order to decide whether or not the message that is to be evaluated is an anomaly.