PATENT CLAIM ANALYSIS

Application Number: 16274479
Application Type: Utility
Filing Date: 2019-02
Publication Date: 2019-06
Patent Classification: ["726", "022000"]

Abstract:
Techniques are described for detecting anomalous behavior in program execution. In one example, a method includes logging occurrence of one or more key run time events during execution of a program. Each key run time event has a corresponding key run time event data structure associated with the program, and logging includes storing records associated with the key run time events, wherein each record is based on the key run time event data structure associated with the key run time event. The method further includes analyzing the records to determine if a current pattern of key run time events associated with the program during execution matches an expected pattern of key run time events and generating a security alert if the current pattern of key run time events does not match the expected pattern of key run time events for the program.

Claim (Index 17):
A computer system comprising:\n one or more processors, one or more computer-readable memories, and one or more computer-readable storage mediums; program instructions, stored on at least one of the one or more storage mediums for execution by at least one of the one or more processors via at least one of the one or more memories, to log key run time events that occur during execution of a program, wherein each key run time event is associated with one or more computer operations and wherein each key run time event has a corresponding key run time event type and a corresponding key run time event data structure, wherein logging includes storing records associated with the key run time events, wherein each record includes the corresponding key run time event type and is based on the key run time event data structure associated with the key run time event; program instructions, stored on at least one of the one or more storage mediums for execution by at least one of the one or more processors via at least one of the one or more memories, to analyze the records to determine if a current pattern of two or more key run time events logged during execution of the program matches an expected pattern of logging of the two or more key run time events during execution of the program; and program instructions, stored on at least one of the one or more storage mediums for execution by at least one of the one or more processors via at least one of the one or more memories, to generate a security alert if the current pattern of two or more key run time events logged during execution of the program does not match the expected pattern of logging of the two or more key run time events during execution of the program.

Metadata:
- Claim Count in Document: 50.0
- Percentile: 99.0
- Lexical Diversity: 2.36508
- Patent Class: 726.0
- Transitional Phrase Type: open
- Component Type: 1
- Foreign Priority: False
- Related Applications: ['14932467', '14986967', '15588131', '14016741', '15252761']

Analysis Scores:
- 35 USC 101 Eligibility (BERT): 0.270433061143828
- 35 USC 102 Novelty (BERT): 0.560987345084413
- Combined Prediction Score: 0.2994884895378865
- Mean Citation Score: 219.405466
- Max Citation Score: 434.23065
- Similarity Product: 390.72262938605553

Labels:
- Claim Label 101: 1
- Claim Label 102: 0
- Claim Label 103: 0
- Claim Label 112: 1
- Combined Label: 0
- Label 101 Adjusted: 1

Dataset: test