Method and apparatus for detecting anomalies in mission critical environments using statistical language modeling
AssigneeimVision Software Technologies Ltd.
InventorsKeren COHAVI, Liora BRAUNSTIN, Kiril LASHCHIVER, Yoav SPECTOR
Life of this patent
Estimating the term…
Abstract
A method and system for generating anomaly-detection rules for communication protocols are provided. The method includes receiving communication data; constructing at least one N-gram from the received communication data; analyzing the at least one N-gram by comparing the constructed at least one N-gram with a repository of N-gram analyses to identify conditional probabilities of certain characteristics; and generating anomaly-detection rules based on the N-gram analysis.
Claims21
A method for generating anomaly-detection rules for communication protocols, comprising:
- receiving communication data;
- constructing at least one N-gram from the received communication data;
- analyzing the at least one N-gram by comparing the constructed at least one N-gram with a repository of N-gram analyses to identify conditional probabilities of certain characteristics;
- and
- generating anomaly-detection rules based on the N-gram analysis.
A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process for generating anomaly-detection rules for communication protocols, the process comprising:
- receiving communication data;
- constructing at least one N-gram from the received communication data;
- analyzing the at least one N-gram by comparing the constructed at least one N-gram with a repository of N-gram analyses to identify conditional probabilities of certain characteristics;
- and
- generating anomaly-detection rules based on the N-gram analysis.
A system for generating anomaly-detection rules for communication protocols, comprising:
- a processing circuitry;
- and
- a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
- receive communication data;
- construct at least one N-gram from the received communication data;
- analyze the at least one N-gram by comparing the constructed at least one N-gram with a repository of N-gram analyses to identify conditional probabilities of certain characteristics;
- and
- generate anomaly-detection rules based on the N-gram analysis.
Dependencies are inferred from the claim text.