Cross-feature analysis
First Claim
Patent Images
1. A method of automatically identifying anomalous situations during system operations, said method comprising:
- recording actions performed by said system as features in a history file;
automatically creating a model for each feature only from normal data in said history file;
performing training by calculating anomaly scores of said features;
establishing a threshold to evaluate whether features are abnormal;
automatically identifying abnormal actions of said system based on said anomaly scores and said threshold; and
periodically repeating said training process.
1 Assignment
0 Petitions
Accused Products
Abstract
Disclosed is a method of automatically identifying anomalous situations during computerized system operations that records actions performed by the computerized system as features in a history file, automatically creates a model for each feature only from normal data in the history file, performs training by calculating anomaly scores of the features, establishes a threshold to evaluate whether features are abnormal, automatically identifies abnormal actions of the computerized system based on the anomaly scores and said threshold, and periodically repeats the training process.
26 Citations
26 Claims
-
1. A method of automatically identifying anomalous situations during system operations, said method comprising:
-
recording actions performed by said system as features in a history file;
automatically creating a model for each feature only from normal data in said history file;
performing training by calculating anomaly scores of said features;
establishing a threshold to evaluate whether features are abnormal;
automatically identifying abnormal actions of said system based on said anomaly scores and said threshold; and
periodically repeating said training process. - View Dependent Claims (2, 3, 4, 5, 6, 7, 12)
-
-
8. A method of automatically identifying anomalous situations during system operations, said method comprising:
-
recording actions performed by said system as features in a history file;
automatically creating a model for each feature only from normal data in said history file;
performing training by calculating anomaly scores of said features;
establishing a threshold to evaluate whether features are abnormal;
automatically identifying abnormal actions of said system based on said anomaly scores and said threshold; and
periodically repeating said training process, wherein said process of creating a model for each feature comprises;
establishing relationships that exist between said features for normal system operations;
selecting a labeled feature from said features;
mathematically rearranging said relationships from the point of view of said labeled feature to create a solution for said labeled feature, wherein said solution comprises a model for said labeled feature;
selecting different features as said labeled feature and repeating said process of mathematically rearranging said relationships to produce solutions from the point of view of each remaining feature as models for the remaining features. - View Dependent Claims (9, 10, 11, 13)
-
-
14. A method of automatically identifying anomalous situations during system operations, said method comprising:
-
recording actions performed by said system as features in a history file;
automatically creating a model for each feature only from normal data in said history file;
performing training by calculating anomaly scores of said features;
establishing a threshold to evaluate whether features are abnormal;
automatically identifying abnormal actions of said system based on said anomaly scores and said threshold; and
periodically repeating said training process, wherein said training comprises;
predicting the likelihood that each feature will be normal when one or more of the other features are abnormal, using said model of each of said features;
repeating said predicting using different presumptions about other features being normal and abnormal to produce a trained file of a plurality of anomaly scores for each of said features. - View Dependent Claims (15, 16, 17, 18, 19)
-
-
20. A program storage device readable by machine, tangibly embodying a program of instructions executable by the machine to perform a method of automatically identifying anomalous situations during system operations, said method comprising:
-
recording actions performed by said system as features in a history file;
automatically creating a model for each feature only from normal data in said history file;
performing training by calculating anomaly scores of said features;
establishing a threshold to evaluate whether features are abnormal;
automatically identifying abnormal actions of said system based on said anomaly scores and said threshold; and
periodically repeating said training process. - View Dependent Claims (21, 22, 23, 24, 25, 26)
-
Specification