METHOD AND SYSTEM FOR DETECTING ANOMALOUS PROCESS BEHAVIOR

• US 20090018983A1
• Filed: 07/10/2008
• Published: 01/15/2009
• Est. Priority Date: 07/13/2007
• Status: Active Grant

• Current Assignee: AirBNB Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: El-Rafei, Sherif M., Farahat, Ahmed K., Mahfouz, Tamer A., Hassan, Hany M.
• Granted Patent: US 8,719,190 B2
• Time in Patent Office: Days
• US Class Current: 706/12
• CPC Class Codes: G06F 11/0715 in a system implementing multitasking multitasking per se G06F9/46
• CPC Class Codes: G06F 11/0751 Error or fault detection not based on redundancy power supply failures G06F1/30; network fault management H04L41/06
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06N 7/00 Computing arrangements based on specific mathematical models
• CPC Class Codes: G06Q 10/00 Administration; Management

Abstract

A method for learning a process behavior model based on a process past instances and on one or more process attributes, and a method for detecting an anomalous process using the corresponding process behavior model.

Claims

1. A method for learning a behavior model of a workflow, the behavior model being associated with at least on value falling within a first predetermined range, and comprising a set of paths, wherein a path comprises a set of nodes and a set of transitions and a union of the paths form a directed graph corresponding to the workflow, the method comprising:

for each path in the behavior model;

identifying a set of instances of the workflow among all instances of the workflow, wherein each instance belonging to the set of instances is associated with a value falling within a first predetermined range and any instance belonging to the set of instances corresponds to the path;

computing a likelihood of the path as a function of the number of instances so identified; and

assigning a weight to each transition of the set of transitions as a function of the likelihood of the paths comprising the transition.

2. The method of claim 1, wherein the likelihood is set to an arbitrary value if the number of instances so identified is zero.

3. The method of claim 2, wherein the arbitrary value is small with respect to a likelihood of paths computed with a positive number of instances.

4. The method of claim 1, further comprising:

storing permanently the behavior model.

5. The method of claim 1, wherein the behavior model is a Weighted Finite State Transducer.

6. The method of claim 1, wherein the first predetermined range comprises a single discrete value.

7. A method for monitoring an instance of a workflow, the instance being associated with a first value and with a first directed graph comprising a set of nodes and a set of transitions, the method comprising:

identifying a behavior model according to claim 1, so that the first value falls within the predetermined range associated with the behavior model, and wherein the behavior model comprises a path which is a superset of the first directed graph;

computing a likelihood of the instance as a function of the weights associated with the transitions of the behavior model corresponding to the set of transitions; and

deciding on a normality of the instance as a function of the likelihood so computed and of a threshold.

8. The method of claim 7, wherein the likelihood is obtained by multiplying the weights together.

9. The method of claim 7, wherein the instance is decided to be anomalous if the likelihood is below the threshold.

10. The method of claim 7, wherein the threshold is determined as a function of the number of paths in the behavior model.