Behavior change detection system for services

• US 9,619,648 B2
• Filed: 10/20/2014
• Issued: 04/11/2017
• Est. Priority Date: 07/16/2014
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Sol, Alisson Augusto Souza, Boia, Dragos D., Markey, Barry, Fish, Robert D., Ankney, Donald J., Ramdatmisier, Viresh
• Primary Examiner(s): LEMMA, SAMSON B
• Application Number:
  US14/519,062
• Publication Number:
  US 20160019387A1
• Time in Patent Office: 904 Days
• Field of Search: 726 23
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

A behavior change detection system collects behavior from a service, such as an online service, and detects behavior changes, either permanent or transient, in the service. Machine learning hierarchical (agglomerative) clustering techniques are utilized to compute deviations between clustered data sets representing an “answer” that the service presents to a series of requests.

Claims

1. A computer-implemented method comprising:

collecting, via a hardware processor, using a domain metadescriptor in a specific context triggered by a matrix execution, first data associated with an initial behavior phase of a service defining a first set of values;

collecting, via the hardware processor, using the domain metadescriptor in the specific context triggered by the matrix execution, second data associated with an exercised behavior phase of the service defining a second set of values;

clustering the first and second sets of values into respective clusters using a machine learning hierarchical clustering algorithm; and

computing, via the hardware processor, a deviation between the first data associated with the initial behavior phase and second data associated with the exercised behavior phase of the service based on the respective clusters.

2. The method of claim 1, wherein the service comprises an online service.

3. The method of claim 1, wherein the domain metadescriptor is a collection of objects described in an independent context.

4. The method of claim 3, wherein the domain metadescriptor includes an extractor that extracts specific objects from a page and a collection of features which define what a behavior means.

5. The method of claim 1, wherein the matrix execution describes an object context generator.

6. The method of claim 1, wherein collecting the first data associated with the initial behavior phase and collecting the second data associated with the exercised behavior phase are performed over different finite time periods having a same length.

7. The method of claim 1, wherein computing the deviation comprises computing, via the hardware processor, an asymmetrical difference between the respective clusters.

8. The method of claim 1, computing the deviation comprises computing, via the hardware processor, a union of the respective clusters minus an intersection of the respective clusters.

9. A computing device comprising:

one or more hardware processors;

one or more computer readable storage media storing computer readable instructions which, when executed on the hardware processors, cause the one or more hardware processors to;

construct a domain metadescriptor;

construct a matrix execution to place the domain metadescriptor in a specific context;

collect initial behavior data using the domain metadescriptor in the specific context triggered by the matrix execution defining a first set of values;

collect exercised behavior data using the domain metadescriptor in the specific context triggered by the matrix execution defining a second set of values;

cluster the first and second sets of values into respective clusters using a machine learning hierarchical clustering algorithm; and

compute a deviation between the initial behavior data and the exercised behavior data based on the respective clusters.

10. The computing device of claim 9, wherein computing the deviation comprises computing an asymmetrical difference between the respective clusters.

11. The computing device of claim 9, wherein computing the deviation comprises computing a union of the respective clusters minus an intersection of the respective clusters.

12. The computing device of claim 9, wherein the initial behavior data and the exercised behavior data are associated with a service.

13. The computing device of claim 9, wherein the initial behavior data and the exercised behavior data are associated with an online service.

14. A computer-implemented method, comprising:

constructing, via a hardware processor, a domain metadescriptor;

constructing, via the hardware processor, a matrix execution to place the domain metadescriptor in a specific context;

collecting, via the hardware processor, initial behavior data using the domain metadescriptor in the specific context triggered by the matrix execution defining a first set of values;

collecting, via the hardware processor, exercised behavior data using the domain metadescriptor in the specific context triggered by the matrix execution defining a second set of values;

clustering, via the hardware processor, the first and second sets of values into respective clusters using a machine learning hierarchical clustering algorithm; and

computing, via the hardware processor, a deviation between the initial behavior data and the exercised behavior data based on the respective clusters.