US 5,291,590 A · Method of detecting and processing abnormal message output from computer system and detecting and processing apparatus therefor

Abstract

An abnormal message detecting and processing apparatus comprises an example message storing part (30) for storing examples of normal messages, a variable field information storing part (32) for storing information of a location of variable fields in the example messages, and an abnormal message detecting part (34). The abnormal message detecting part (34) compares input messages (36) with the example messages, except for variable fields specified by the information stored in the variable field information storing part (32), determines that an input message is abnormal if none of the example messages coincide with the input message in the comparison, and outputs the message so that the abnormal message is easily distinguishable from normal messages.

Claims10

Dependent claims

A method of detecting and processing abnormal messages from among messages output from a computer system, comprising the steps of:

(i) storing example messages of normal messages output during a normal operation of the computer system to a first storage;
(ii) storing information of a location of variable portions in the normal messages to a second storage;
(iii) comparing an object message with the example messages stored in the first storage except for the variable portions in the object message and example messages determined by the information stored in the second storage;
(iv) determining that the object message is an abnormal message if none of the example messages coincide with the object message in step iii);
and
(v) outputting the object message so that the abnormal message is distinguishable from normal messages.

3 more elements

An apparatus for detecting and processing abnormal messages from among messages output from a computer system, comprising:

first storage means for storing example messages of normal messages output during a normal operation of the computer system;
second storage means for storing information of a location of variable portions in the normal messages;
and
abnormal message detecting means for comparing an object message with the example messages stored in the first storage means, except for the variable portions in the object message and the example messages determined by the information stored in the second storage means, for determining that the object message is an abnormal message if none of said example messages coincide with the object message in the comparison, and for outputting the object message so that the abnormal message is distinguishable from normal messages.

1 more element

Dependencies are inferred from the claim text.

Method of detecting and processing abnormal message output from computer system and detecting and processing apparatus therefor

Life of this patent

Method of detecting and processing abnormal message output from computer system and detecting and processing apparatus therefor

Life of this patent

Abstract

Claims10