Methods, media, and systems for detecting an anomalous sequence of function calls
First Claim
1. A method for detecting an anomalous sequence of function calls, the method comprising:
- assigning, using a hardware processor, a first sequence of function calls to a first computing device of an application community and a second sequence of function calls to a second computing device of the application community, wherein the application community includes a plurality of computing devices;
determining a presence of an anomalous sequence of function calls in at least one of the first and second sequences of function calls by compressing at least one of the first sequence of function calls and the second sequence of function calls; and
notifying the other computing devices of the application community of the anomalous sequence of function calls.
0 Assignments
0 Petitions
Accused Products
Abstract
Methods, media, and systems for detecting an anomalous sequence of function calls are provided. The methods can include compressing a sequence of function calls made by the execution of a program using a compression model; and determining the presence of an anomalous sequence of function calls in the sequence of function calls based on the extent to which the sequence of function calls is compressed. The methods can further include executing at least one known program; observing at least one sequence of function calls made by the execution of the at least one known program; assigning each type of function call in the at least one sequence of function calls made by the at least one known program a unique identifier; and creating at least part of the compression model by recording at least one sequence of unique identifiers.
-
Citations
21 Claims
-
1. A method for detecting an anomalous sequence of function calls, the method comprising:
-
assigning, using a hardware processor, a first sequence of function calls to a first computing device of an application community and a second sequence of function calls to a second computing device of the application community, wherein the application community includes a plurality of computing devices; determining a presence of an anomalous sequence of function calls in at least one of the first and second sequences of function calls by compressing at least one of the first sequence of function calls and the second sequence of function calls; and notifying the other computing devices of the application community of the anomalous sequence of function calls. - View Dependent Claims (2, 3, 4, 5, 6, 7)
-
-
8. A system for detecting an anomalous sequence of function calls, the system comprising:
a hardware processor that; assigns a first sequence of function calls to a first computing device of an application community and a second sequence of function calls to a second computing device of the application community, wherein the application community includes a plurality of computing devices; determines a presence of an anomalous sequence of function calls in at least one of the first and second sequences of function calls by compressing at least one of the first sequence of function calls and the second sequence of function calls; and notifies the other computing devices of the application community of the anomalous sequence of function calls. - View Dependent Claims (9, 10, 11, 12, 13, 14)
-
15. A non-transitory computer-readable medium containing computer-executable instructions that, when executed by a processor, cause the processor to perform a method for detecting an anomalous sequence of function calls, the method comprising:
-
assigning a first sequence of function calls to a first computing device of an application community and a second sequence of function calls to a second computing device of the application community, wherein the application community includes a plurality of computing devices; determining a presence of an anomalous sequence of function calls in at least one of the first and second sequences of function calls by compressing at least one of the first sequence of function calls and the second sequence of function calls; and notifying the other computing devices of the application community of the anomalous sequence of function calls. - View Dependent Claims (16, 17, 18, 19, 20, 21)
-
Specification