Back to results
US 8,479,285 B2Granted
Method, computer program and apparatus for controlling access to a computer resource and obtaining a baseline therefor
AssigneeOracle International Corporation
InventorsStephen Anthony Moyle, Paul Anthony Galwas
Life of this patent
Estimating the term…
Abstract
A plurality of computer messages are classified into clusters according to the behavior of the computer messages in the context of a computer resource. For a new message of the plurality of computer messages, it is determined whether the cluster to which the new computer message is classified has been seen previously. A measure is then obtained of the probability that the cluster to which the next new message will be classified has been seen previously.
Claims16
A system for obtaining a baseline for use in controlling access to a computer resource, the system comprising:
- a storage memory;
- and
- one or more processors coupled to the storage memory, wherein the storage memory stores sets of instructions which, when executed, cause the one or more processors to:
- assign each computer message of a plurality of computer messages received at a processor to one of a first plurality of clusters according to behavior of said each computer message in the context of a computer resource;
- wherein the behavior of said each computer message is determined based on analyzing logic symbols contained within said each message, the logic symbols specifying desired operational behavior of components within the system;
- receive a first message of the plurality of computer messages and assign the first message to a first cluster, and include the first cluster in a second set of clusters included in the first plurality of clusters, wherein at least one message has been assigned to each cluster in the second set of clusters;
- obtain a first measure of probability that a future message will be assigned to a cluster that is already included the second set of clusters prior to the receipt of the future message;
- wherein the future message is a message that has not yet been received by the system;
- and
- in response to determining that the first measure of probability exceeds a threshold, establish a baseline containing a set of computer messages which have been classified according to whether or not each of the computer messages of the set represents acceptable behavior in the context of the computer resource comprising a third plurality of clusters, wherein the second set of clusters includes the third plurality of clusters,
- wherein the computer messages conform to a specification for the computer messages, and said specification is codified into a set of computer-readable rules;
- wherein said each cluster is classified according to whether or not the computer messages assigned to said each cluster represent acceptable behavior in the context of the computer resource;
- wherein computer messages are assigned to a cluster by:
- executing instructions for analyzing the computer messages using the computer-readable rules to identify a pattern of symbols associated with each computer message;
- wherein the pattern of symbols associated with said each computer message is identified by executing instructions for:
- determining a path through the rules that is taken during analysis of said each computer message that successfully terminates, and
- grouping said each computer message according to said path.
14 more elements
A non-transitory computer-readable storage medium for obtaining a baseline for use in controlling access to a computer resource, storing sets of instructions which, when executed by a computer, cause the computer to:
- assign each computer message of a plurality of computer messages received at a processor to one of a first plurality of clusters according to behavior of said each computer message in the context of a computer resource;
- wherein the behavior of said each computer message is determined based on analyzing logic symbols contained within said each message, the logic symbols specifying desired operational behavior of components within the system;
- receive a first message and assign the first message of the plurality of computer messages to a first cluster, and include the first cluster in a second set of clusters included in the first plurality of clusters, wherein at least one message has been assigned to each cluster in the second set of clusters;
- obtain a first measure of probability that a future message will be assigned to a cluster that is already included the second set of clusters prior to the receipt of the future message;
- wherein the future message is a message that has not yet been received by the system;
- and
- in response to determining that the first measure of probability exceeds a threshold, establish a baseline containing a set of computer messages which have been classified according to whether or not each of the computer messages of the set represents acceptable behavior in the context of the computer resource comprising a third plurality of clusters, wherein the second set of clusters includes the third plurality of clusters,
- wherein the computer messages conform to a specification for the computer messages, and said specification is codified into a set of computer-readable rules;
- wherein said each cluster is classified according to whether or not the computer messages assigned to said each cluster represent acceptable behavior in the context of the computer resource;
- wherein computer messages are assigned to a cluster by:
- executing instructions for analyzing the computer messages using the computer-readable rules to identify a pattern of symbols associated with each computer message;
- wherein the pattern of symbols associated with said each computer message is identified by executing instructions for:
- determining a path through the rules that is taken during analysis of said each computer message that successfully terminates, and
- grouping said each computer message according to said path.
11 more elements
A method of obtaining a baseline for use in controlling access to a computer resource, the method comprising:
- assigning each computer message of a plurality of computer messages received at a processor to one of a first plurality of clusters according to behavior of said each computer message in the context of a computer resource;
- wherein the behavior of said each computer message is determined based on analyzing logic symbols contained within said each message, the logic symbols specifying desired operational behavior of components within the system;
- receiving a first message and assigning the first message of the plurality of computer messages to a first cluster, and include the first cluster in a second set of clusters included in the first plurality of clusters, wherein at least one message has been assigned to each cluster in the second set of clusters;
- obtaining a first measure of probability that a future message will be assigned to a cluster that is already included in the second set of clusters prior to the receipt of the future message;
- wherein the future message is a message that has not yet been received by the system;
- and in response to determining that the first measure of probability exceeds a threshold, establishing a baseline containing a set of computer messages which has been classified according to whether or not each of the computer messages of the set represents acceptable behavior in the context of the computer resource,
- wherein the computer messages conform to a specification for the computer messages, and said specification is codified into a set of computer-readable rules;
- wherein said each cluster is classified according to whether or not the computer messages assigned to said each cluster represent acceptable behavior in the context of the computer resource;
- wherein computer messages are assigned to a cluster by:
- executing instructions for analyzing the computer messages using the computer-readable rules to identify a pattern of symbols associated with each computer message;
- wherein the pattern of symbols associated with said each computer message is identified by executing instructions for:
- determining a path through the rules that is taken during analysis of said each computer message that successfully terminates, and
- grouping said each computer message according to said path.
10 more elements
Dependencies are inferred from the claim text.