Patent ID: 8578494

Claim:
A method of detecting a potential security threat on a computing system, the method comprising: embedding time series data relating to the computing system within a reconstructed phase space to generate embedded data; partitioning the reconstructed phase space into a plurality of regions; generating a first matrix having a plurality of cells, wherein the first matrix comprises a row and a column for each of the plurality of regions, wherein a value stored in each cell is based on a probability that the system will transition from a first region associated with the cell to a second region associated with the cell and a rate of separation of trajectories of the embedded data within at least one of the first region and the second region, and wherein the first matrix is generated using a first set of the time series data associated with a normal operating condition of the computing system where the computing system is not under attack from the potential security threat; generating a second matrix based on a second set of the time series data; comparing the first matrix and the second matrix to detect whether the potential security threat is present on the computing system, wherein comparing the first matrix and the second matrix comprises: calculating a state change parameter representing a degree of state change between a first state associated with the first matrix and a second state associated with the second matrix; and comparing the state change parameter to a threshold value; and performing an action when the state change parameter exceeds the threshold value.