Systems and methods for remediating computer stability issues

• US 10,530,809 B1
• Filed: 09/15/2016
• Issued: 01/07/2020
• Est. Priority Date: 09/15/2016
• Status: Active Grant

• Current Assignee: Gen Digital Inc.
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Hart, Michael, Gates, Chris
• Primary Examiner(s): Naghdali, Khalil
• Assistant Examiner(s): Sherkat, Arezoo
• Application Number:
  US15/266,483
• Time in Patent Office: 1,209 Days
• Field of Search: None
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 7/01 Probabilistic graphical models, e.g. probabilistic networks
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

The disclosed computer-implemented method for remediating computer stability issues may include (i) determining that a device has experienced a computer stability problem, (ii) obtaining, from the device, one or more computer-generated log lines that potentially include information pertaining to a cause of the computer stability problem, (iii) directly analyzing text included within the computer-generated log lines, (iv) identifying information relating to the computer stability problem based on the direct analysis of the text, and (v) remediating the device to resolve the computer stability problem. Various other methods, systems, and computer-readable media are also disclosed.

Claims

1. A computer-implemented method for remediating computer stability issues, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

training a machine learning classifier that utilizes a generative statistical model to identify stability-disrupting computer events based solely on text within log lines;

after training the machine learning classifier, determining that a device has experienced a computer stability problem;

obtaining, from the device, one or more computer-generated log lines that were created during a time period corresponding to a time during which the device experienced the computer stability problem, wherein;

the computer-generated log lines represent computer-generated records, stored in folders of the device, that track computer events that occur within the device; and

obtaining the computer-generated log lines comprises scanning the folders for the computer-generated log lines by using parsers to (i) identify which section of a computer-generated log line identifies the origination of an event and (ii) identify which section of the computer-generated log line identifies the event'"'"'s endpoint;

using the machine learning classifier to directly analyze unstructured text included within the computer-generated log lines, without mapping the unstructured text into a structured event schema, by mapping information obtained from the computer-generated log lines into a latent space representing activity for the device within a time frame that is relevant to the computer stability problem;

identifying information relating to the computer stability problem based on the direct analysis of the unstructured text, without relying on any previously established event schemas; and

based on the information relating to the computer stability problem, remediating the device to resolve the computer stability problem.

2. The computer-implemented method of claim 1, wherein determining that the device has experienced the computer stability problem comprising determining that the device has experienced the computer stability problem in response to identifying at least one of:

a decrease in the overall stability of the device;

a decrease in the stability of application software installed on the device; and

a decrease in the stability of system software installed on the device.

3. The computer-implemented method of claim 1, wherein the generative statistical model comprises latent Dirichlet allocation.

4. The computer-implemented method of claim 1, wherein identifying the information relating to the computer stability problem comprises identifying information relating to a severity of the computer stability problem.

5. The computer-implemented method of claim 1, wherein:

the device comprises a client device running client-security software provided by a security service;

the computer-generated log lines comprise log lines created by the client-security software; and

obtaining the one or more computer-generated log lines comprises obtaining the one or more computer-generated log lines from the client-security software.

6. The computer-implemented method of claim 1, wherein training the machine learning classifier comprises training the machine learning classifier with examples of log files associated with one or more previously identified stability problems.

7. The computer-implemented method of claim 1, wherein:

at least one of the computer-generated log lines comprises a novel log line that has no corresponding event-schema entry in any previously established structured event schemas;

the novel log line was produced by at least one of;

a novel program whose log lines had not previously been analyzed by a stability remediation service; and

a recently updated program whose log lines had not been analyzed by the stability remediation service.

8. The computer-implemented method of claim 1, wherein identifying the information relating to the computer stability problem comprises identifying information relating to a duration of the computer stability problem.

9. The computer-implemented method of claim 1, wherein scanning the folders for the computer-generated log lines comprises filtering out computer-generated log lines that include text that has been previously identified via machine learning as not pertaining to computer stability issues.

10. The computer-implemented method of claim 1, wherein:

the method further comprises determining, based on the information relating to the computer stability problem, that the computer stability problem was likely caused by a malicious event incited by a malicious program; and

remediating the device comprises performing a security action.

11. The computer-implemented method of claim 10, wherein the security action comprises at least one of:

removing the malicious program from the device;

transmitting a notification to at least one of the device and an additional computing device that indicates that device has been infected with malware; and

blacklisting at least one of the malicious event and the malicious program.

12. A system for analyzing computer stability issues, the system comprising:

an analysis module, stored in memory, that trains a machine learning classifier that utilizes a generative statistical model to identify stability-disrupting computer events based solely on text within log lines;

a determination module, stored in memory, that determines, after the machine learning classifier has been trained, that a device has experienced a computer stability problem;

an obtaining module, stored in memory, that obtains, from the device, one or more computer-generated log lines that were created during a time period corresponding to a time during which the device experienced the computer stability problem, wherein;

the computer-generated log lines represent computer-generated records, stored in folders of the device, that track computer events that occur within the device; and

obtaining the computer-generated log lines comprises scanning the folders for the computer-generated log lines by using parsers to (i) identify which section of a computer-generated log line identifies the origination of an event and (ii) identify which section of the computer-generated log line identifies the event'"'"'s endpoint;

wherein the analysis module uses the machine learning classifier to directly analyze unstructured text included within the computer-generated log lines, without mapping the unstructured text into a structured event schema, by mapping information obtained from the computer-generated log lines into a latent space representing activity for the device within a time frame that is relevant to the computer stability problem;

an identification module, stored in memory, that identifies information relating to the computer stability problem based on the direct analysis of the unstructured text, without relying on any previously established event schemas;

a remediation module, stored in memory, that, based on the information relating to the computer stability problem, remediates the device to resolve the computer stability problem; and

at least one physical processor configured to execute the determination module, the obtaining module, the analysis module, the identification module, and the remediation module.

13. The system of claim 12, wherein the determination module determines that the device has experienced the computer stability problem by determining that the device has experienced the computer stability problem in response to identifying at least one of:

a decrease in the overall stability of the device;

a decrease in the stability of application software installed on the device; and

a decrease in the stability of system software installed on the device.

14. The system of claim 12, wherein the generative statistical model comprises latent Dirichlet allocation.

15. The system of claim 12, wherein the identification module identifies the information relating to the computer stability problem by identifying information relating to at least one of a severity of the computer stability problem and a duration of the computer stability problem.

16. The system of claim 12, wherein:

the device comprises a client device running client-security software provided by a security service;

the computer-generated log lines comprise log lines created by the client-security software; and

the obtaining module obtains the one or more computer-generated log lines by obtaining the one or more computer-generated log lines from the client-security software.

17. The system of claim 12, wherein the analysis module trains the machine learning classifier by training the machine learning classifier with examples of log files associated with one or more previously identified stability problems.

18. The system of claim 12, wherein at least one of the computer-generated log lines comprises a novel log line that has no corresponding event-schema entry in any previously established event schemas.

19. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

train a machine learning classifier that utilizes a generative statistical model to identify stability-disrupting computer events based solely on text within log lines;

after training the machine learning classifier, determine that a device has experienced a computer stability problem;

obtain, from the device, one or more computer-generated log lines that were created during a time period corresponding to a time during which the device experienced the computer stability problem, wherein;

the computer-generated log lines represent computer-generated records, stored in folders of the device, that track computer events that occur within the device; and

obtaining the computer-generated log lines comprises scanning the folders for the computer-generated log lines by using parsers to (i) identify which section of a computer-generated log line identifies the origination of an event and (ii) identify which section of the computer-generated log line identifies the event'"'"'s endpoint;

use the machine learning classifier to directly analyze unstructured text included within the computer-generated log lines, without mapping the unstructured text into a structured event schema, by mapping information obtained from the computer-generated log lines into a latent space representing activity for the device within a time frame that is relevant to the computer stability problem;

identify information relating to the computer stability problem based on the direct analysis of the unstructured text, without relying on any previously established event schemas; and

remediate the device to resolve the computer stability problem.

20. The non-transitory computer-readable medium of claim 19, wherein the generative statistical model comprises latent Dirichlet allocation.