公开(公告)号：US20190044912A1

公开(公告)日：2019-02-07

申请号：US15942031

申请日：2018-03-30

Applicant: Intel Corporation

Inventor： Liuyang Lily Yang ,  Huaxin Li ,  Li Zhao ,  Marcio Juliato ,  Shabbir Ahmed ,  Manoj R. Sastry

IPC: H04L29/06 ,  G06F9/455

Abstract: There is disclosed in one example a computing apparatus, including: a hardware platform; a network interface to communicatively couple to a bus lacking native support for authentication; and an anomaly detection engine to operate on the hardware platform and configured to: receive a first data stream across a first time; symbolize and approximate the first data stream, including computing a first window sum; receive a second data stream across a second time substantially equal in length to the first time, the second data stream including data across the plurality of dimensions from the first data stream; symbolize and approximate the second data stream, including computing a second window sum; compute a difference between the first window sum and the second window sum; determine that difference exceeds a threshold and that the correlation across the plurality of dimensions is broken; and flag a potential anomaly.

公开(公告)号：US11012409B2

公开(公告)日：2021-05-18

申请号：US15942031

申请日：2018-03-30

Applicant: Intel Corporation

Inventor： Liuyang Lily Yang ,  Huaxin Li ,  Li Zhao ,  Marcio Juliato ,  Shabbir Ahmed ,  Manoj R. Sastry

IPC: H04L29/06 ,  G06F21/50 ,  G06F9/455

Abstract: There is disclosed in one example a computing apparatus, including: a hardware platform; a network interface to communicatively couple to a bus lacking native support for authentication; and an anomaly detection engine to operate on the hardware platform and configured to: receive a first data stream across a first time; symbolize and approximate the first data stream, including computing a first window sum; receive a second data stream across a second time substantially equal in length to the first time, the second data stream including data across the plurality of dimensions from the first data stream; symbolize and approximate the second data stream, including computing a second window sum; compute a difference between the first window sum and the second window sum; determine that difference exceeds a threshold and that the correlation across the plurality of dimensions is broken; and flag a potential anomaly.