UNSUPERVISED ANOMALY DETECTION USING SHADOWING OF HUMAN COMPUTER INTERACTION CHANNELS

• US 20190045001A1
• Filed: 08/02/2017
• Published: 02/07/2019
• Est. Priority Date: 08/02/2017
• Status: Abandoned Application

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Inventors: Mankovskii, Serge
• Application Number:
  US15/667,512
• Publication Number:
  US 20190045001A1
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: H04L 43/08 Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes

Abstract

Technologies are provided in embodiments to detect anomalies by shadowing human-computer interaction channels. Embodiments include accessing a shadow signal generated by a shadowing device. In an embodiment, the shadow signal can be a video input stream of display screen images rendered on a display screen, where the display screen images were recorded by the shadowing device. The embodiment also includes identifying, at the shadowing device, a first frame of the video input stream, and determining whether an anomaly is associated with the video input stream based, at least in part, on applying a rule of a set of rules to at least a portion of the first frame, where the set of rules defines a control image associated with the video input stream. The embodiment further includes determining whether to take an action based on the determining whether the anomaly is associated with the video input stream.

Claims

1. A method comprising:

accessing, at a shadowing device, a video input stream of display screen images rendered on a display screen of a display device, the display screen images recorded by the shadowing device to produce the video input stream;

identifying, at the shadowing device, a first frame of the video input stream;

determining, at the shadowing device, whether an anomaly is associated with the video input stream based, at least in part, on applying a rule of a set of rules to at least a portion of the first frame, wherein the set of rules defines a control image associated with the video input stream; and

determining whether to take an action based on the determining whether the anomaly is associated with the video input stream.

2. The method of claim 1, wherein the anomaly is determined to be associated with the video input stream based, at least in part, on determining that the portion of the first frame does not satisfy the rule.

3. The method of claim 1, wherein the anomaly is determined to be not associated with the video input stream based on determining that each rule of the set of rules is satisfied by a respective portion of the first frame.

4. The method of claim 1, wherein the anomaly is determined to be not associated with the video input stream based, at least in part, on:

determining that the portion of the first frame does not satisfy the rule;

identifying a second set of rules that defines a predictable image; and

determining that the second set of rules is satisfied by the first frame.

5. The method of claim 1, wherein the anomaly is determined to be associated with the video input stream if at least a threshold number of rules of the set of rules are not satisfied by the first frame.

6. The method of claim 1, wherein the determining whether the anomaly is associated with the video input stream includes applying the rule of the set of rules to corresponding portions of a threshold number of frames that include the first frame and one or more frames accessed prior to the first frame.

7. The method of claim 6, wherein the anomaly is determined to be associated with the video input stream based on determining that the corresponding portions of the threshold number of frames do not satisfy the rule.

8. The method of claim 1, wherein the anomaly is determined to be associated with the video input stream based on identifying an unexpected pattern in a threshold number of successive frames that include the first frame and one or more frames accessed prior to the first frame.

9. The method of claim 1, wherein the portion of the first frame is a particular field associated with a display screen image corresponding to the first frame.

10. The method of claim 1, wherein the rule is based on a threshold value associated with the portion of the first frame.

11. The method of claim 1, wherein the action includes one or more of sending an alert to a user device and logging information associated with the anomaly.

12. The method of claim 1, wherein the set of rules that defines the control image is based on one or more frames received prior to the first frame in the video input stream.

13. The method of claim 1, wherein the control image is associated with a sound.

14. The method of claim 13, wherein the determining whether the anomaly is associated with the video input stream includes determining whether another rule is satisfied based on a sound associated with the first frame relative to the sound associated with the control image.

15. The method of claim 1, wherein the determining whether the anomaly is associated with the video input stream includes determining whether the rule is satisfied based on a color associated with the portion of the first frame.

16. A system comprising:

a memory element; and

a shadowing device including a processor to execute instructions stored in the memory element to;

recording display screen images rendered on a display screen of a display device;

access a video input stream based on the recording;

identify a first frame of the video input stream;

determine whether an anomaly is associated with the video input stream based, at least in part, on applying a rule of a set of rules to at least a portion of the first frame, wherein the set of rules defines a control image associated with the video input stream; and

determine whether to take an action based on determining whether the anomaly is associated with the video input stream.

17. The system of claim 16, further comprising:

a machine learning engine configured to;

create the set of rules based on evaluating at least some frames of the video input stream for a period of time; and

store the set of rules in the memory element.

18. The system of claim 17, wherein the machine learning engine is further configured to:

update the set of rules that defines the control image in real-time with one or more frames of the video input stream that are accessed subsequent to the period of time.

19. A computer program product comprising a computer readable storage medium comprising computer readable program code embodied therewith, the computer readable program code comprising:

computer readable program code configured to access a video input stream of display screen images rendered on a display screen of a display device, the display screen images recorded by a shadowing device;

computer readable program code configured to identify a first frame of the video input stream;

computer readable program code configured to determine whether an anomaly is associated with the video input stream based, at least in part, on applying a rule of a set of rules to at least a portion of the first frame, wherein the set of rules defines a control image associated with the video input stream; and

computer readable program code configured to determining whether to take an action based on the determining whether the anomaly is associated with the video input stream.

20. The computer program product of claim 19, wherein the anomaly is determined to be associated with the video input stream based, at least in part, on determining that the portion of the first frame does not satisfy the rule.