Patent ID: 8479285

Claim:
A system for obtaining a baseline for use in controlling access to a computer resource, the system comprising: a storage memory; and one or more processors coupled to the storage memory, wherein the storage memory stores sets of instructions which, when executed, cause the one or more processors to: assign each computer message of a plurality of computer messages received at a processor to one of a first plurality of clusters according to behavior of said each computer message in the context of a computer resource; wherein the behavior of said each computer message is determined based on analyzing logic symbols contained within said each message, the logic symbols specifying desired operational behavior of components within the system; receive a first message of the plurality of computer messages and assign the first message to a first cluster, and include the first cluster in a second set of clusters included in the first plurality of clusters, wherein at least one message has been assigned to each cluster in the second set of clusters; obtain a first measure of probability that a future message will be assigned to a cluster that is already included the second set of clusters prior to the receipt of the future message; wherein the future message is a message that has not yet been received by the system; and in response to determining that the first measure of probability exceeds a threshold, establish a baseline containing a set of computer messages which have been classified according to whether or not each of the computer messages of the set represents acceptable behavior in the context of the computer resource comprising a third plurality of clusters, wherein the second set of clusters includes the third plurality of clusters, wherein the computer messages conform to a specification for the computer messages, and said specification is codified into a set of computer-readable rules; wherein said each cluster is classified according to whether or not the computer messages assigned to said each cluster represent acceptable behavior in the context of the computer resource; wherein computer messages are assigned to a cluster by: executing instructions for analyzing the computer messages using the computer-readable rules to identify a pattern of symbols associated with each computer message; wherein the pattern of symbols associated with said each computer message is identified by executing instructions for: determining a path through the rules that is taken during analysis of said each computer message that successfully terminates, and grouping said each computer message according to said path.