The patent badge is an abbreviated version of the USPTO patent document. The patent badge does contain a link to the full patent document.
The patent badge is an abbreviated version of the USPTO patent document. The patent badge covers the following: Patent number, Date patent was issued, Date patent was filed, Title of the patent, Applicant, Inventor, Assignee, Attorney firm, Primary examiner, Assistant examiner, CPCs, and Abstract. The patent badge does contain a link to the full patent document (in Adobe Acrobat format, aka pdf). To download or print any patent click here.
Patent No.:
Date of Patent:
Apr. 12, 2022
Filed:
Mar. 13, 2019
International Business Machines Corporation, Armonk, NY (US);
Heqing Huang, Mahwah, NJ (US);
Taesung Lee, Ridgefield, CT (US);
Ian M. Molloy, Chappaqua, NY (US);
Zhongshu Gu, Ridgewood, NJ (US);
Jialong Zhang, San Jose, CA (US);
Josyula R. Rao, Briarcliff Manor, NY (US);
International Business Machines Corporation, Armonk, NY (US);
Abstract
Mechanisms are provided for detecting abnormal system call sequences in a monitored computing environment. The mechanisms receive, from a computing system resource of the monitored computing environment, a system call of an observed system call sequence for evaluation. A trained recurrent neural network (RNN), trained to predict system call sequences, processes the system call to generate a prediction of a subsequent system call in a predicted system call sequence. Abnormal call sequence logic compares the subsequent system call in the predicted system call sequence to an observed system call in the observed system call sequence and identifies a difference between the predicted system call sequence and the observed system call sequence based on results of the comparing. The abnormal call sequence logic generates an alert notification in response to identifying the difference.