Patent Document ID: 20170206354
Application ID: 15000192
Patent Flag: 0

Claim One:
1. A method comprising: for each event of a software execution comprising events: verifying whether the event is covered by a short range correlation of a sequence of the event and one or more events preceding the event with a sequence of two or more events in a behavioral model; verifying whether the event is covered by a long range correlation of a group of the sequences with a group of the sequences in the behavioral model; verifying whether the event is covered by a long range correlation of an arrangement of groups of the sequences with an arrangement of groups of the sequences in the behavioral model; after verifying each long range correlation, substituting the arrangement of groups of the sequences in the behavioral model event with an intersection of an arrangement of groups of the sequences with an arrangement of groups of the sequences in the behavioral model; and responsive to the event not being covered by at least one of: the short range correlation, the long range correlation of a group of the sequences, or the long range correlation of an arrangement of groups; indicating that the event is anomalous.