公开(公告)号：US20130282331A1

公开(公告)日：2013-10-24

申请号：US13454572

申请日：2012-04-24

申请人： Ira Cohen ,  Marina Lyan ,  Oded Gazit ,  Ohad Assulin ,  Michael Rozman

发明人： Ira Cohen ,  Marina Lyan ,  Oded Gazit ,  Ohad Assulin ,  Michael Rozman

IPC分类号： G06F17/18

CPC分类号： G06F17/18 ,  H04L41/5006 ,  H04L43/16

摘要： Systems, methods, and machine-readable and executable instructions are provided for detecting abnormal behavior. Detecting abnormal behavior can include receiving a mean at a previous time interval, a sum of squares at the previous time interval, and a first sample of a metric at a current time interval from a system and adjusting a first weight and a second weight at the current time interval to the first sample and a system change report. Detecting abnormal behavior can also include calculating a mean and a standard deviation of the metric at the current time interval by assigning the first sample the adjusted first weight and by assigning the mean and the sum of squares at a previous time interval the adjusted second weight and detecting abnormal behavior by comparing the first sample to an outlier value based on the mean and the standard deviation at the previous time interval.

摘要翻译： 提供系统，方法和机器可读和可执行指令来检测异常行为。 检测异常行为可以包括以前一时间间隔接收平均值，在前一时间间隔处的平方和以及来自系统的当前时间间隔的度量的第一样本，并且调整第一权重和第二权重 第一个样本的当前时间间隔和系统更改报告。 检测异常行为还可以包括通过将第一样本分配给调整的第一权重并通过在之前的时间间隔分配平均值和平方和来计算当前时间间隔上的度量的平均值和标准偏差， 通过基于前一时间间隔的平均值和标准偏差，比较第一个样本与异常值，检测异常行为。