Cognitive information security using a behavioral recognition system

• US 10,187,415 B2
• Filed: 03/26/2017
• Issued: 01/22/2019
• Est. Priority Date: 08/09/2013
• Status: Active Grant

• Current Assignee: Intellective Ai, Inc.
• Original Assignee: Omni AI, Inc.
• Inventors: Seow, Ming-Jung, Cobb, Wesley Kenneth, Xu, Gang, Yang, Tao, Poffenberger, Aaron, Risinger, Lon W., Saitwal, Kishor Adinath, Yantosca, Michael S., Solum, David M., Hemsath, Alex David, Urech, Dennis G., Nguyen, Duy Trong, Morgan, Charles Richard
• Primary Examiner(s): Hang, Vu B
• Application Number:
  US15/469,568
• Publication Number:
  US 20180046613A1
• Time in Patent Office: 667 Days
• CPC Class Codes: G06F 40/226 Validation
• CPC Class Codes: G06F 40/242 Dictionaries
• CPC Class Codes: G06F 40/247 Thesauruses; Synonyms
• CPC Class Codes: G06F 40/253 Grammatical analysis; Style critique
• CPC Class Codes: G06F 40/284 Lexical analysis, e.g. tokenisation or collocates
• CPC Class Codes: G06F 40/289 Phrasal analysis, e.g. finite state techniques or chunking
• CPC Class Codes: G06F 40/30 Semantic analysis
• CPC Class Codes: G06F 40/40 Processing or translation of natural language natural language analysis G06F40/20; semantic analysis G06F40/30
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 3/0409 Adaptive resonance theory [ART] networks
• CPC Class Codes: G06N 3/042 Knowledge-based neural networks; Logical representations of neural networks
• CPC Class Codes: G06N 3/088 Non-supervised learning, e.g. competitive learning
• CPC Class Codes: G06N 5/022 Knowledge engineering; Knowledge acquisition
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

Embodiments presented herein describe techniques for generating a linguistic model of input data obtained from a data source (e.g., a video camera). According to one embodiment of the present disclosure, a sequence of symbols is generated based on an ordered stream of normalized vectors generated from the input data. A dictionary of words is generated from combinations of the ordered sequence of symbols based on a frequency at which combinations of symbols appear in the ordered sequence of symbols. A plurality of phrases is generated based an ordered sequence of words from the dictionary observed in the ordered sequence of symbols based on a frequency by which combinations of words in ordered sequence of words appear relative to one another.

Claims

1. An apparatus, comprising:

at least one processor; and

a memory storing processor-executable instructions and in communication with the at least one processor, the instructions in the memory comprising instructions for the at least one processor to;

generate a dictionary of words based on a statistical distribution of combinations of symbols, the symbols being generated based on an ordered stream of normalized data;

dynamically update the dictionary of words based on a subsequent stream of the ordered stream of normalized data;

determine an unusualness score for at least one word in the dictionary of words based on a frequency of occurrence of the at least one word; and

publish an alert based on the unusualness score, the alert indicating an anomaly in the normalized data.

9. The apparatus of claim 1, further comprising instructions for the at least one processor to:

update the dictionary of words based on a subsequent stream of the ordered stream of normalized data.

10. The apparatus of claim 1, wherein each word in the dictionary of words represents an activity.

11. The apparatus of claim 10, wherein the unusualness score represents an anomaly in the activity.

12. The apparatus of claim 1, further comprising instructions for the at least one processor to:

generate a neuro-linguistic model based at least in part on the dictionary of words.

13. The apparatus of claim 1, wherein generation of the dictionary of words includes building the dictionary of words up to a maximum length of symbols.

14. The apparatus of claim 1, further comprising instructions for the at least one processor to:

identify at least one of a pattern or a sub-pattern of the symbols to generate the dictionary of words.

15. The apparatus of claim 1, further comprising instructions for the at least one processor to:

cluster the ordered stream of normalized data; and

assign a symbol to each cluster.

2. A computer-implemented method, comprising:

generating, via at least one processor, a dictionary of words based on a statistical distribution of combinations of symbols, the symbols being generated based on an ordered stream of normalized data;

determining, via the at least one processor, an unusualness score for at least one word in the dictionary of words based on a frequency of occurrence of the at least one word; and

publishing, via the at least one processor, an alert based on the unusualness score, the alert indicating an anomaly in the normalized data.

3. The computer-implemented method of claim 2, further comprising:

dynamically updating, via the at least one processor, the dictionary of words based on a subsequent stream of the ordered stream of normalized data.

4. The computer-implemented method of claim 2, wherein each word in the dictionary of words represents an activity, and the unusualness score represents an anomaly in the activity.

5. The computer-implemented method of claim 2, further comprising:

generating, via the at least one processor, a neuro-linguistic model based at least in part on the dictionary of words.

6. The computer-implemented method of claim 2, wherein generating the dictionary of words comprises building the dictionary of words up to a maximum length of symbols.

7. The computer-implemented method of claim 2, wherein generating the dictionary of words further includes:

identifying, via the at least one processor, at least one of a pattern or a sub-pattern of the symbols.

8. The computer-implemented method of claim 2, wherein the symbols are generated by clustering the ordered stream of normalized data and assigning a symbol to each cluster.

16. A non-transitory processor-readable storage medium storing processor-executable instructions to:

generate a dictionary of words based on a statistical distribution of combinations of symbols, the symbols being generated from an ordered stream of normalized data;

update the dictionary of words based on a subsequent stream of the ordered stream of normalized data;

determine an unusualness score for at least one word in the dictionary of words based on a frequency of occurrence of the at least one word; and

issue an alert based on the unusualness score, the alert indicating an anomaly in the normalized data.

17. The non-transitory processor-readable storage medium of claim 16, further comprising processor-executable instructions to:

update the dictionary of words based on a subsequent stream,of the ordered stream of normalized data.

18. The non-transitory processor-readable storage medium of claim 16, further comprising processor-executable instructions to:

identify at least one of a pattern or a sub-pattern of the symbols to generate the dictionary of words.

19. The non-transitory processor-readable storage medium of claim 16, further comprising processor-executable instructions to:

generate a neuro-linguistic model using the dictionary of words.