System and method for detecting behavior anomaly in information access

A method for detecting anomalous information access, comprising the steps of:

• receiving, by a network interface unit, data packets containing an information access request;
• storing a database containing historical behavior information in the storage unit, the historical behavior information being implemented through a plurality of bitmap tables and counters, content of each counter being derived from the bitmap tables, each counter having a threshold;
• analyzing the information access request,
• parsing, by a controller, contents of the information access request into a plurality of basic elements, which comprises who, how, what, where, and when;
• checking whether there is a baseline associated with a parsed content of the information access request;
• if there is no baseline associated with the parsed content of the information access request, establishing a baseline using the parsed content of the information access request;
• recording, by the controller, each basic element of the information access request in the table representing the historical behavior information, each table correlating two basic elements;
• the plurality of basic elements directly map to information embedded in the information access request received by the network interface,
• modifying a counter according to the bitmap table;
• issuing an alert if the counter exceeds the threshold set for the counter;
• and
• if the counter has no threshold, setting a new threshold for the counter using information from a basic element associated to the counter.

A method for detecting anomalous information access, comprising the steps of:

• receiving an information access request at a network interface;
• storing the information access request in a storage unit;
• storing a database containing historical behavior information in the storage unit, the historical behavior information being implemented through a plurality of bitmap tables and counters, content of each counter being derived from the bitmap tables;
• analyzing the information access request,
• parsing the information access request into a plurality of basic elements, the basic elements comprising who, how, what, where, and when;
• checking whether there is a baseline associated with a parsed information of the information access request;
• if there is no baseline associated with the parsed content of the information access request, establishing a baseline using the parsed content of the information access request;
• the plurality of basic elements directly map to information embedded in the information access request received by the network interface,
• comparing each basic element in the parsed information with at least one table that relates two basic elements;
• recording events from the at least one table into at least one counter;
• and
• if an anomaly is detected at the comparing step, issuing an alert;
• and
• clearing the at least one counter periodically.

A non-transitory computer readable medium on which is stored a computer program for assigning system resources to connections associated with an originating server and a destination server in a communication network, the computer program comprising computer instructions that when executed by a computing device performs the steps for:

• receiving, by a network interface unit, data packets containing an information access request;
• storing a database containing historical behavior information in the storage unit, the historical behavior information being implemented through a plurality of bitmap tables and counters, content of each counter being derived from the bitmap tables, each counter having a threshold;
• analyzing the information access request;
• parsing, by a controller, contents of the information access request into a plurality of basic elements, which comprises who, how, what, where, and when;
• checking whether there is a baseline associated with a parsed content of the information access request;
• if there is no baseline associated with the parsed content of the information access request, establishing a baseline using the parsed content of the information access request;
• compares each parsed basic element of the information access request with one or more tables;
• recording, by the controller, each basic element of the information access request in the table representing the historical behavior information, each table correlating two basic elements;
• the plurality of basic elements directly map to information embedded in the information access request received by the network interface unit;
• modifying a counter according to the bitmap table;
• issuing an alert if the counter exceeds the threshold set for the counter;
• and
• if the counter has no threshold, setting a new threshold for the counter using information from a basic element associated to the counter.