Loading patent…
AssigneeInternational Business Machines Corporation
InventorsXiaorui Pan, Xiaokui Shu, Dhilung Hang Kirat, Jiyong Jang, Marc Philippe Stoecklin
Estimating the term…
An automated technique for security monitoring leverages a labeled semi-directed temporal graph derived from system-generated events. The temporal graph is mined to derive process-centric subgraphs, with each subgraph consisting of events related to a process. The subgraphs are then processed to identify atomic operations shared by the processes, wherein an atomic operation comprises a sequence of system-generated events that provide an objective context of interest. The temporal graph is then reconstructed by substituting the identified atomic operations derived from the subgraphs for the edges in the original temporal graph, thereby generating a reconstructed temporal graph. Using graph embedding, the reconstructed graph is converted into a representation suitable for further machine learning, e.g., using a deep neural network. The network is then trained to learn the intention underlying the temporal graph. The approach operates to understand running behavior of programs, to classify them, and then enable detection of potential malicious behaviors.
A method to detect anomalous behavior in a computing system, comprising:
An apparatus, comprising:
A computer program product in a non-transitory computer readable medium for use in a data processing system, the computer program product holding computer program instructions that, when executed by the data processing system, are configured to detect anomalous behavior in a computer system, the computer program instructions comprising program code configured to:
Dependencies are inferred from the claim text.