Autonomous detection of incongruous behaviors

Abstract

Behavioral characteristics of at least a first machine component are monitored. A model that represents machine-to-machine interactions between at least the first machine component and at least a further machine component is generated. Using the monitored behavioral characteristics and the generated model, an incongruity of a behavior of at least the first machine component and the machine-to-machine interactions is computed, where the incongruity is predicted based on determining a discordance between an expectation of the system and the behavior and the machine-to-machine interactions, and wherein the predicting is performed without using a previously built normative rule of behavior and machine-to-machine interactions.

What is claimed is: 
     
         1 . A method comprising:
 monitoring, by a system including a processor and sensors, behavioral characteristics of at least a first machine component;   generating, by the system through unsupervised learning, an endogenous and unsupervised Bayesian model that represents interrelations between local events and machine-to-machine interactions between at least the first machine component and at least a further machine component;   predicting, by the system using the monitored behavioral characteristics and the generated model, an incongruity of a behavior of at least the first machine component and the machine-to-machine interactions, wherein the incongruity is predicted based on determining a singularity of the local events and the machine-to-machine interactions, and a discordance between a calculated expectation of the system and an observed behavior and the machine-to-machine interactions, and wherein the predicting is performed without using a previously built normative rule of behavior and machine-to-machine interactions; and   performing, by the system, an action with respect to at least the first machine component in response to the predicted incongruity.   
     
     
         2 . The method of  claim 1 , wherein the predicting is performed without using a previously built normative pattern of behavior and data, or a previously built normative organization of behavior and data, and the predicting comprises continually discovering and automatically learning, using the sensors, the machine-to-machine interactions as the machine-to-machine interactions emerge, 
     
     
         3 . The method of  claim 1 , wherein the predicting is based on an autonomous probabilistic weighting of relative and interrelated frequencies of behavioral occurrences, performed without human supervision, human teaching, or a priori taught model of interactions, and wherein the generating comprises generating the Bayesian model that records over time a probabilistic realization of a behavior, based on knowledge of characteristics, intensity and measures of other learned behaviors over time. 
     
     
         4 . The method of  claim 1 , wherein monitoring the behavioral characteristics of at least the first machine component comprises monitoring the behavioral characteristics of a node in a network or the behavioral characteristics of a machine or a portion of the machine. 
     
     
         5 . The method of  claim 1 , further comprising:
 discovering a new machine component or a new behavior of an existing machine component; and   predicting an incongruity of the new machine component or the new behavior of the existing machine component.   
     
     
         6 . The method of  claim 1 , wherein the expectation of the system is based on learned endogenous logic of the system, the learned endogenous logic learned from previous operations of the system. 
     
     
         7 . The method of  claim 1 , wherein predicting the incongruity is based on determining the singularity and an idiosyncrasy of a detected behavior, as determined and defined as a mathematical impossibility to explain the detected behavior with the Bayesian model, combined with a probabilistic distance between the detected behavior of at least the further machine component to an expected behavior of at least the further machine component, as expected by at least the first machine component given a behavior of at least the first machine component. 
     
     
         8 . A system comprising:
 a non-transitory storage medium storing instructions; and   at least one processor, the instructions executable on the at least one processor to:
 learn behaviors of machine components by auto-generating a Bayesian network from data associated with the machine components, without prior teaching, and without human intervention, the Bayesian network providing, at each stage of a continual observation by the Bayesian network, a predictive model of the behaviors of the machine components and interactions of the machine components, without accessing functions of the machine components that direct these behaviors; 
 compute, based on a predicting of a probable transformation of a behavior of a given machine component and based on the Bayesian network, a probabilistic prediction of an incongruity of the behavior of the given machine component; 
 identify a second machine component that likely caused the incongruity; and 
 perform an action to address the incongruity. 
   
     
     
         9 . The system of  claim 8 , wherein the instructions are executable by the at least one processor to further:
 update the Bayesian network concerning an endogenous behavior of the given machine component, and machine-to-machine interactions between the given machine component and further machine components;   discover a model of behaviors of the further machine components that interact with the given machine component; and   emulate an identified unknown behavior by the Bayesian network to determine whether the identified unknown behavior is a harmful, malevolent, or hazardous behavior.   
     
     
         10 . The system of  claim 8 , wherein the instructions are executable by the at least one processor to further:
 learn over time a persistence of incongruities and incongruous behaviors of machine components, to detect contrived incongruities and deliberate acclimatization to planned incongruous behavior in the system;   record over time different learning states of the machine components; and   encapsulating, for each learning state of the learning states, a calculated level of incongruity of each machine component of the machine components.   
     
     
         11 . The system of  claim 8 , wherein the instructions are executable by the at least one processor to find a most probable machine component for a given behavior, and to find a probable behavior for the given machine component, by retrieving a recorded identification of a machine component or a process that has exhibited a highest cumulative incongruity over time, in comparison to other machine components or processes. 
     
     
         12 . The system of  claim 8 , wherein the instructions are executable by the at least one processor is to:
 find a most probable machine component, in a population of machine components, exhibiting symptoms of incongruity and/or an Advanced Persistent Threat (APT), and to isolate an incongruous or potentially APT behavior from characteristics of the most probable machine component; and   based on highest scores of the APT intensity computed by probabilistic inferences over time, allowing a forensic analysis in real-time and over time, by tracing back the highest scores of incongruity in the machine components.   
     
     
         13 . The system of  claim 8 , wherein the at least one processor is to:
 receive a user request for identifying a most vulnerable machine component based on the incongruity;   score a probability of multiple items selected from among incongruous behaviors, a persistent contriving incongruity behavior, a reconnaissance behavior, an intrusion, legitimating, dormant or delayed triggering of dormant intruder components, unauthorized access to assets and data; and   present different scores regarding new interactions, before the new interactions or behaviors or events associated with the new behaviors are authorized to occur.   
     
     
         14 . The system of  claim 8 , wherein the computing and the identifying do not rely on a pre-built model, but on a Bayesian network for each machine component of multiple machine components updated based on continual learning. 
     
     
         15 . The system of  claim 8 , wherein the at least one processor is to further identify a self-incongruity of the given machine component 
     
     
         16 . The system of  claim 8 , wherein the at least one processor is to further:
 detect variations of behavior of interactions between the given machine component and a second machine component;   in response to the detected variations at different times being within a specified threshold, determine a score of acclimatization of the given machine component to a behavior of the second machine component;   in response to detecting an increase of scores over time of acclimatization of the given machine component to the behavior of the second machine component, declare detection of a persistent incongruity.   
     
     
         17 . An article comprising at least one non-transitory machine-readable storage medium storing instructions that upon execution cause a system to:
 monitor behavioral characteristics of at least a first machine component;   generate a Bayesian network that represents machine-to-machine interactions between at least the first machine component and at least a further machine component;   predict, using the monitored behavioral characteristics and the generated model, an incongruity of a behavior of at least the first machine component and the machine-to-machine interactions, wherein the incongruity is predicted based on determining a discordance between an expectation of the system and the behavior and the machine-to-machine interactions, and wherein the predicting is performed without using a previously built normative rule of behavior and machine-to-machine interactions; and   perform an action to address the predicted incongruity.