DETECTING ANOMALOUS EVENTS THROUGH RUNTIME VERIFICATION OF SOFTWARE EXECUTION USING A BEHAVIORAL MODEL

• US 20170206354A1
• Filed: 01/19/2016
• Published: 07/20/2017
• Est. Priority Date: 01/19/2016
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Pieczul, Olgierd S.
• Granted Patent: US 10,152,596 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06N 5/04 Inference or reasoning models
• CPC Class Codes: G06N 5/045 Explanation of inference; Explainable artificial intelligence [XAI]; Interpretable artificial intelligence

Abstract

Runtime verification of software execution events against a behavioral model. For each event, it is verified whether there is a short range correlation of a sequence of the event and preceding event(s) with the behavioral model, and whether there is a long range correlation of a group of the sequences and of an arrangement of groups of the sequences with the behavioral model. After verifying each long range correlation, the arrangement of groups in the behavioral model event is substituted with an intersection of an arrangement of groups of the sequences with an arrangement of groups of the sequences in the behavioral model. If an event is not covered by a short range correlation or a long range correlation of a group or a long range correlation of an arrangement of groups, the event is indicated as anomalous.

Claims

1. A method comprising:

for each event of a software execution comprising events;

verifying whether the event is covered by a short range correlation of a sequence of the event and one or more events preceding the event with a sequence of two or more events in a behavioral model;

verifying whether the event is covered by a long range correlation of a group of the sequences with a group of the sequences in the behavioral model;

verifying whether the event is covered by a long range correlation of an arrangement of groups of the sequences with an arrangement of groups of the sequences in the behavioral model;

after verifying each long range correlation, substituting the arrangement of groups of the sequences in the behavioral model event with an intersection of an arrangement of groups of the sequences with an arrangement of groups of the sequences in the behavioral model; and

responsive to the event not being covered by at least one of;

the short range correlation, the long range correlation of a group of the sequences, or the long range correlation of an arrangement of groups;

indicating that the event is anomalous.

2. The method of claim 1, wherein the software execution is halted before execution of an event that is indicated as anomalous.

3. The method of claim 1, wherein processing of events continues after an event is indicated as anomalous, and the software execution is halted after a threshold number of anomalous events is reached.

4. The method of claim 1, wherein the short range correlation of a sequence of events utilizes tri-grams generated from the sequence of events.

5. The method of claim 1, wherein the short range correlation of a sequence of events utilizes tri-grams and bi-grams.

6. A system comprising:

one or more computer processors;

one or more computer-readable storage media;

a system log stored on the one or more computer-readable storage media for recording events generated by a software execution;

a behavioral model, stored on the one or more computer-readable storage media comprising one or more n-grams of acceptable short range correlations of a sequence of two or more events, one or more groups of acceptable combinations of n-grams, and one or more group arrangements of acceptable combinations of groups;

a short range event correlator module, stored on the one or more computer-readable storage media which, when executed by the one or more processors;

verifies whether each event is covered by a short range correlation of a sequence of the event and one or more events preceding the event with a sequence of two or more events in the behavioral model; and

responsive to the event not being covered by a short range correlation, indicates that the event is anomalous;

a long range correlator module, stored on the one or more computer-readable storage media which, when executed by the one or more processors;

verifies whether each event is covered by one or more of a long range correlation of;

a group of the sequences with a group of the sequences in the behavioral model;

or an arrangement of groups of the sequences with an arrangement of groups of the sequences in the behavioral model; and

responsive to the event not being covered by at least one of the long range correlations, indicates that the event is anomalous; and

a transaction arrangement substitutor module, stored on the one or more computer-readable storage media which, when executed by the one or more processors, substitutes, after verifying a long range correlation, the arrangement of groups of the sequences in the behavioral model event with an intersection of an arrangement of groups of the sequences with an arrangement of groups of the sequences in the behavioral model.

7. The system of claim 6, wherein the software execution is halted before execution of an event that is indicated as anomalous.

8. The system of claim 6, wherein processing of events continues after an event is indicated as anomalous, the anomalous event is recorded in the system log, and the software execution is halted after a threshold number of anomalous events is reached.

9. The system of claim 6, wherein the short range correlation of a sequence of events utilizes tri-grams generated from the sequence of events.

10. The system of claim 6, wherein the short range correlation of a sequence of events utilizes tri-grams and bi-grams.

11. A computer program product comprising:

a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to;

for each event of a software execution comprising events;

verify whether the event is covered by a short range correlation of a sequence of the event and one or more events preceding the event with a sequence of two or more events in the behavioral model;

verify whether the event is covered by a long range correlation of a group of the sequences with a group of the sequences in the behavioral model;

verify whether the event is covered by a long range correlation of an arrangement of groups of the sequences with an arrangement of groups of the sequences in the behavioral model;

after verifying each long range correlation, substituting the arrangement of groups of the sequences in the behavioral model event with an intersection of an arrangement of groups of the sequences with an arrangement of groups of the sequences in the behavioral model; and

responsive to the event not being covered by at least one of;

the short range correlation, the long range correlation of a group of the sequences, or the long range correlation of an arrangement of groups;

indicating that the event is anomalous.

12. The computer program product of claim 11, wherein the software execution is halted before execution of an event that is indicated as anomalous.

13. The computer program product of claim 11, wherein processing of events continues after an event is indicated as anomalous, and the software execution is halted after a threshold number of anomalous events is reached.

14. The computer program product of claim 11, wherein the short range correlation of a sequence of events utilizes tri-grams generated from the sequence of events.

15. The computer program product of claim 11, wherein the short range correlation of a sequence of events utilizes tri-grams and bi-grams.

16. A computer system comprising:

one or more computer processors, one or more computer-readable storage media, and program instructions stored on one or more of the computer-readable storage media for execution by at least one of the one or more processors, the stored program instructions comprising;

program instructions, for each event of a software execution comprising events, to;

verify whether the event is covered by a short range correlation of a sequence of the event and one or more events preceding the event with a sequence of two or more events in the behavioral model;

verify whether the event is covered by a long range correlation of a group of the sequences with a group of the sequences in the behavioral model;

verify whether the event is covered by a long range correlation of an arrangement of groups of the sequences with an arrangement of groups of the sequences in the behavioral model;

after verifying each long range correlation, substituting the arrangement of groups of the sequences in the behavioral model event with an intersection of an arrangement of groups of the sequences with an arrangement of groups of the sequences in the behavioral model; and

responsive to the event not being covered by at least one of;

the short range correlation, the long range correlation of a group of the sequences, or the long range correlation of an arrangement of groups;

indicating that the event is anomalous.

17. The computer system of claim 16, the stored program instructions further comprising program instructions to halt the software execution before execution of an event that is indicated as anomalous.

18. The computer system of claim 16, the stored program instructions further comprising program instructions to continue processing events after an event is indicated as anomalous, and the software execution is halted after a threshold number of anomalous events is reached.

19. The computer system of claim 16, wherein the stored program instructions for short range correlation of a sequence of events utilize tri-grams generated from the sequence of events.

20. The computer system of claim 16, wherein the stored program instructions for short range correlation of a sequence of events utilize tri-grams and bi-grams.