公开(公告)号：WO2017019735A1

公开(公告)日：2017-02-02

申请号：PCT/US2016/044198

申请日：2016-07-27

Applicant: PIVOTAL SOFTWARE, INC.

Inventor： YU, Jin ,  RADHAKRISHNAN, Regunathan ,  KONDAVEETI, Anirudh

IPC: G06F21/31 ,  G06F21/55 ,  H04L29/06

CPC classification number: G06N99/005 ,  G06F17/30598 ,  G06F21/316 ,  G06F21/552 ,  H04L63/1425

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for classifying user behavior as anomalous. One of the methods includes obtaining user behavior data representing behavior of a user in a subject system. An initial model is generated from training data, the initial model having first characteristic features of the training data. A resampling model is generated from the training data and from multiple instances of the first representation for a test time period. A difference between the initial model and the resampling model is computed. The user behavior in the test time period is classified as anomalous based on the difference between the initial model and the resampling model.

Abstract translation: 方法，系统和装置，包括在计算机存储介质上编码的计算机程序，用于将用户行为分类为异常。 其中一种方法包括获取表示主体系统中用户的行为的用户行为数据。 从训练数据生成初始模型，初始模型具有训练数据的第一特征。 从训练数据和测试时间段的第一个表示的多个实例生成重采样模型。 计算初始模型和重采样模型之间的差异。 基于初始模型和重采样模型之间的差异，测试时间段内的用户行为被分类为异常。