US 9,870,470 B2Granted

Method and apparatus for detecting a multi-stage event

AssigneeBritish Telecommunications plc

InventorsIan Herwono, Zhan Cui, Ben Azvine, Martin Brown, Karl Smith

Life of this patent

Estimating the term…

Loading patent…

Abstract

A multi-stage event detector for monitoring a system to detect the occurrence of multistage events in the monitored system, the multi-stage event detector includes: one or more event detecting detector units (142, 144) for detecting observable events occurring on the monitored system; one or more parameter generating detector units (152, 154) for generating parameter values which vary over time dependent on the behavior of the monitored system; a hidden state determiner (120) for determining a likely sequence of states of interest of the system based on the outputs of the one or more event detecting detector units; and a transition determiner (130) for determining a likely transition occurrence based on a comparison of a set of values of a parameter or set of parameters generated by one or more of the one or more parameter generating detector units with a plurality of pre-specified functions or sets of values of a corresponding parameter or set of parameters associated with different transition occurrences.

Claims12

Dependent claims

A multi-stage event detector for monitoring a system to detect the occurrence of multi-stage events in the monitored system, the multi-stage event detector including:

a data store storing a plurality of models of multi-stage events, each model specifying a sequence of stages and a set of transitions from one stage to another;
and processing resources including at least one processor and a memory comprising instructions that, when executed, control the multi-stage event detector to at least:
(a) detect observable events occurring on the monitored system;
(b) generate parameter values that vary over time dependent on behavior of the monitored system;
(c) determine a likely sequence of hidden states of interest of the monitored system based on the detected observable events occurring on the monitored system, wherein the hidden states of interest of the monitored system correspond to stages in the stored models of the multi-stage events;
(d) determine a likely transition occurrence, corresponding to a transition from
one stage to another in the stored models of the multi-stage events, based on a comparison of a set of values of a parameter or set of parameters generated in (b) with a plurality of pre-specified functions or sets of values of a corresponding parameter or set of parameters associated with different transitions from one stage to another in the stored models of the multi-stage events;
and
(e) determine an estimated identity of a multi-stage event and an estimated current stage of the multi-stage event in dependence upon a comparison of both the determination in (c) of a likely sequence of hidden states of interest of the monitored system and the determination in (d) of a likely transition occurrence with the stored models of multi-stage events specifying both sequences of stages and transitions between stages,
wherein (c) is performed in connection with a model of the plurality of the models of multi-stage events, the model further specifying a plurality of distinct hidden states that the monitored system can occupy, and a plurality of visible states that can be determined in (a).

7 more elements

A method of detecting the occurrence of a multi-stage event within a system being monitored, the method comprising:

having stored a plurality of models of multi-stage events, each model specifying a sequence of stages and a set of transitions from one stage to another;
(a) detecting, using processing resources including at least one processor and a memory, observable events occurring on the monitored system;
(b) generating, using the processing resources, parameter values that vary over time dependent on behavior of the monitored system;
(c) determining, using the processing resources, a likely sequence of hidden states of interest of the monitored system based on the detected observable events, wherein the hidden states of interest of the monitored system correspond to stages in the stored models of the multistage events;
(d) determining, using the processing resources, at least one likely transition occurrence, corresponding to a transition from one stage to another in the stored models of the multi-stage events, based on a comparison of the generated parameter values with a plurality of pre-specified functions or sets of values of a corresponding parameter or set of parameters associated with different transitions from one stage to another in the stored models of the multi-stage events;
and
(e) determining, using the processing resources, an estimated identity of a multi-stage event and an estimated current stage of the multi-stage event in dependence upon a comparison of both the determination of a likely sequence of hidden states of interest of the monitored system and the determination of a likely transition occurrence or occurrences with the stored models of multi-stage events specifying both sequences of stages and transitions between stages,
wherein (c) is performed in connection with a model of the plurality of the models of multi-stage events, the model further specifying a plurality of distinct hidden states that the monitored system can occupy, and a plurality of visible states that can be determined in (a).

5 more elements

A non-transitory computer readable storage medium including instructions for detecting the occurrence of a multi-stage event within a system being monitored, the instructions being executable to perform functionality comprising:

having stored a plurality of models of multi-stage events, each model specifying a sequence of stages and a set of transitions from one stage to another;
(a) detecting observable events occurring on the monitored system;
(b) generating parameter values that vary over time dependent on behavior of the monitored system;
(c) determining a likely sequence of hidden states of interest of the monitored system based on the detected observable events, wherein the hidden states of interest of the monitored system correspond to stages in the stored models of the multi-stage events;
(d) determining at least one likely transition occurrence, corresponding to a transition from one stage to another in the stored models of the multi-stage events, based on a comparison of the generated parameter values with a plurality of pre-specified functions or sets of values of a corresponding parameter or set of parameters associated with different transitions from one stage to another in the stored models of the multi-stage events;
and
(e) determining an estimated identity of a multi-stage event and an estimated current stage of the multi-stage event in dependence upon a comparison of both the determination of a likely sequence of hidden states of interest of the monitored system and the determination of a likely transition occurrence or occurrences with the stored models of multi-stage events specifying both sequences of stages and transitions between stages,
wherein (c) is performed in connection with a model of the plurality of the models of multi-stage events, the model further specifying a plurality of distinct hidden states that the monitored system can occupy, and a plurality of visible states that can be determined in (a).

5 more elements

Dependencies are inferred from the claim text.

Facts

Application: 14/781,185Filed 31 Mar 2014
Priority: EP 1325005229 Mar 2013
Published: US 2016/0055335 A125 Feb 2016
Granted: 16 Jan 2018
Term ends: Not estimatedThe source records don’t support an estimate.

Classification10 codes

G06F 21/554
Detecting local intrusion or implementing counter-measures: involving event detection and direct action
G06N 7/01
Computing arrangements based on specific mathematical models: probabilistic graphical models, e.g. probabilistic networks
G06N 20/00
Machine learning
H04L 63/1408
For detecting or protecting against malicious traffic: by monitoring network traffic