# US 8,230,272 B2 · Methods and systems for detection of anomalies in digital data streams > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,230,272 B2 - Document ID: US8230272B2 - Status: Granted - Kind: B2 - Application number: 12/693,319 - Filed: 2010-01-25 - Published: 2010-07-29 - Granted: 2012-07-24 - Earliest claimed: 2009-01-23 - Assignees: Intelliscience Corporation - Inventors: Nicholas L. Middleton; Bryan G. Donaldson - Web page: https://patentgrep.com/patent/US8230272B2 ## CPC - G06F 11/0751: {Error or fault detection not based on redundancy (power supply failures G06F1/30; network fault management H04L41/06)} - G06F 11/076: {by exceeding a count or rate limit, e.g. word- or bit count limit} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems and methods for determining whether or not one or pluralities of events, patterns, or data elements present within a given digital data stream should be delimited as anomalous. The system requires analyzes the data elements of the data stream using any acceptable user-specified, preset, or automatically determined analysis system. The results of the data processing, which are stored in a data storage structure such as a synaptic web or a data array for example, reveal synaptic paths (patterns) of characteristic algorithm values that function to individually define or delimit the selected data element(s) from the remainder of the original data stream. ## Claims ### Claim 1 A method performed by a computer system, the method comprising: determining if an anomaly occurs in a data stream, by: a. receiving a data element included in the first data stream; b. determining a pattern for the received data element; c. incrementing an occurrence count for a pattern stored in a pattern analysis storage, if the determined pattern for the received data element matches the stored pattern; d. repeating a-c for other data elements in the first data stream; e. determining a mean occurrence count value based on the sum of the occurrence counts of all of the patterns stored in the pattern analysis storage divided by the total number of patterns stored in the pattern analysis storage; f. retrieving an occurrence count for a first stored pattern in the pattern analysis storage; g. identifying the pattern as an anomaly, if the retrieved occurrence count is below the determined mean occurrence count value multiplied by a percentage threshold value; h. repeating f and g for other patterns stored in the pattern analysis storage; and i. outputting an anomaly identifier if the pattern was identified as an anomaly. ### Claim 2 (depends on 1) The method of claim 1, wherein determining a pattern for the received data element comprises applying one or more algorithms to the data element. ### Claim 3 (depends on 1) The method of claim 1, wherein the percentage threshold value is determined based on prior analyses. ### Claim 4 (depends on 1) The method of claim 1, wherein the percentage threshold value is a user-specified percentage. ### Claim 5 (depends on 1) The method of claim 1, wherein a-c are repeated for all the data elements in the data stream. ### Claim 6 (depends on 1) The method of claim 1, wherein f and g are repeated for all the patterns stored in the pattern analysis storage. ### Claim 7 a computer system comprising: memory; a processor in data communication with the memory, the processor configured to determine if an anomaly occurs in a first data stream without reference to a prior analysis of exemplar data streams, by: a. receiving a data element included in a first data stream; b. determining a pattern for the received data element; c. incrementing an occurrence count for a pattern stored in a pattern analysis storage in the memory, if the determined pattern for the received data element matches the stored pattern; d. repeating a-c for other data elements in the first data stream; e. determining an occurrence count value based on the sum of the occurrence counts of all of the patterns stored in the pattern analysis storage divided by the total number of patterns stored in the pattern analysis storage; f. retrieving an occurrence count for a first stored pattern in the pattern analysis storage; g. identifying the pattern as an anomaly, if the retrieved occurrence count is below the determined occurrence count value multiplied by a percentage threshold value; h. repeating f and g for other patterns stored in the pattern analysis storage; and i. for each of the data elements in the first data stream, indicating that the data element is anomalous if its associated pattern in the pattern analysis storage is identified as anomalous; and an output device configured to output an anomaly identifier if the pattern was identified as an anomaly. ### Claim 8 (depends on 7) The system of claim 7, wherein the processor determines a pattern for the received data element by applying one or more algorithms to the data element. ### Claim 9 (depends on 7) The system of claim 7, wherein the threshold is a predefined percentage of a mean of the occurrence count of all the patterns. ### Claim 10 (depends on 7) The system of claim 7, wherein a-c are repeated for all the data elements in the first data stream. ### Claim 11 (depends on 7) The system of claim 7, wherein e and f are repeated for all the patterns stored in the pattern analysis storage. ### Claim 12 A computer system comprising: a computer configured to determine if an anomaly occurs in a first data stream without reference to a prior analysis of exemplar data streams, the computer including: a. a means for receiving a data element included in the first data stream; b. a means for determining a pattern for the received data element; c. a means for incrementing an occurrence count for a pattern stored in a pattern analysis storage, if the determined pattern for the received data element matches the stored pattern; d. a means for repeating a-c for other data elements in the first data stream; e. a means for determining a mean occurrence count value based on the sum of the occurrence counts of all of the patterns stored in the pattern analysis storage over the total number of patterns stored in the pattern analysis storage; f. a means for retrieving an occurrence count for a first stored pattern in the pattern analysis storage; g. a means for identifying the pattern as an anomaly, if the retrieved occurrence count is below the determined mean occurrence count value multiplied by a percentage threshold value; h. a means for repeating f and g for other patterns stored in the pattern analysis storage; i. a means for outputting an anomaly identifier if the pattern was identified as an anomaly; and j. a means for indicating, for each of the data elements in the first data stream, that the data element is anomalous if its associated pattern in the pattern analysis storage is identified as anomalous. ### Claim 13 (depends on 12) The system of claim 12, wherein the means for determining a pattern for the received data element, determines a pattern by applying one or more algorithms to the data element. ### Claim 14 (depends on 12) The system of claim 12, wherein a-c are repeated for all the data elements in the first data stream and wherein e and f are repeated for all the patterns stored in the pattern analysis storage. ### Claim 15 (depends on 1) The method of claim 1, wherein the determining if the anomaly occurs in the first data stream includes determining if the anomaly occurs in the first data stream without reference to a prior analysis of exemplar data streams. ### Claim 16 (depends on 1) The method of claim 1, wherein the determining if the anomaly occurs in the data stream includes determining if the anomaly occurs in the first data stream without a priori knowledge of normal conditions obtained from exemplar data streams. ### Claim 17 (depends on 1) The method of claim 1, further comprising: processing a second data stream to determine occurrence counts for patterns associated with elements of the second data stream; for each pattern in the pattern analysis storage, storing a sum of the occurrence count for the pattern determined with respect to the first data stream and the occurrence count for the pattern determined with respect to the second data stream; and determining the mean occurrence count value as equal to the sum of the stored sums for each of the patterns stored in the pattern analysis storage divided by the total number of patterns stored in the pattern analysis storage. ### Claim 18 (depends on 1) The method of claim 1, further comprising: for each of the data elements in the first data stream, identifying an associated pattern in the pattern analysis storage; and if the identified pattern is identified as anomalous, indicating that the data element is anomalous. ### Claim 19 (depends on 1) The method of claim 1 wherein the pattern analysis storage includes a table that associates data pattern vectors with occurrence counts and that is indexed by data pattern vectors. ### Claim 20 (depends on 7) The system of claim 7, wherein identifying the pattern as an anomaly is based at least in part on standard deviations of a distribution of the occurrence counts in the pattern analysis storage.