Patent ID: 7162741
Filing Date: 2007-01-09
Classification: H04L,Y10S

Abstract:
1. A method for monitoring a sequence of operations during execution of a process on a computer system to detect an anomaly in said sequence of operations, comprising: a) defining a probabilistic detection model configured to determine a predictive probability of an occurrence of a final operation in a sequence of operations conditional on a calculated number of previous operations in said sequence of operations, wherein said calculated number of previous operations is determined from a plurality of predetermined sequences of operations; b) determining said predictive probability for said final operation in said sequence of operations with said probabilistic detection model; c) if said predictive probability is below a predetermined threshold, identifying said sequence of operations as an intrusion, thereby detecting an anomaly in said sequence of operations, wherein the step of defining said probabilistic detection model comprises defining a plurality of sparse prediction trees for determining a predictive probability of said final operation, each said sparse prediction tree comprising a plurality of nodes consisting of a root node, leaf nodes, and branch nodes intermediate to said root node and said leaf nodes such that each of said predetermined sequences of operations defines a path from said root node to one of said leaf nodes and providing a respective weight to each of said sparse prediction trees.