Detection of anomalies in a computer system

Abstract

Systems and methods of detecting anomalies in a computing system are disclosed. The computing system can be a member of a blockchain network of a plurality of blockchains. Digests of blocks may be passed between blockchains of the plurality of blockchains, which enables each member of the blockchain network to verify an immutable record of data transactions, free of the mutual trust requirement of a typical blockchain environment. The passing of blockchain block digests further enables a member of the blockchain network to assist another member of the blockchain network to identify an anomaly within moments of when the anomaly first occurs.

1 . A system to detect an anomaly in a monitored computing system, the system comprising:
 a principal computing system implementing a principal blockchain to store record data in a principal series of blocks that are chronologically linked, each block of the principal series of blocks including a cryptographic hash of a previous block, a nonce for the cryptographic hash, a timestamp, and a portion of the record data, wherein the record data stored by the principal blockchain includes data of the monitored computing system;   a first neighbor computing system in communication with the principal computing system and implementing a first participating neighbor blockchain comprising a series of blocks that are chronologically linked, each block of the series of blocks including a cryptographic hash of a previous block, a nonce for the cryptographic hash, a timestamp, and a portion of the record data,   wherein the principal blockchain is to transmit to the first neighbor computing system the cryptographic hash, and the nonce for the cryptographic hash of a most recent principal block of the principal series of blocks,   wherein the first participating neighbor blockchain is to receive the cryptographic hash and the nonce for the cryptographic hash of the most recent principal block and includes the cryptographic hash in a next block of the series of blocks, and   wherein the first neighbor computing system detects an anomaly in the monitored computing system by determining whether a subsequent received cryptographic hash of a subsequent block of the principal blockchain is anomalous.   
     
     
         2 . The system of  claim 1 , wherein the cryptographic hash comprises a binary hash tree, the final hash results from concatenation with a nonce to form an input string for a one-way cryptographic function, the output of which complies with a target difficulty that comprises a rule specifying a compliant cryptographic hash. 
     
     
         3 . The system of  claim 2 , wherein the rule indicates a particular collection of one or more binary values in specified positions of the compliant cryptographic hash. 
     
     
         4 . The system of  claim 1 , wherein the first participating neighbor blockchain transmits to the principal computing system the cryptographic hash and the nonce of a most recent block of the series of blocks, and
 wherein the principal blockchain receives the cryptographic hash and the nonce of the most recent block and includes it in a next principal block of the principal series of blocks.   
     
     
         5 . The system of  claim 4 , further comprising:
 a second neighbor computing system implementing a second participating neighbor blockchain comprising a second series of blocks that are chronologically linked, each block of the second series of blocks including a cryptographic hash of a previous block, a nonce for the cryptographic hash, a timestamp, and a portion of the record data,   wherein the principal blockchain transmits to the second neighbor computing system the cryptographic hash and the nonce of a most recent principal block of the principal series of blocks,   wherein the first participating neighbor blockchain transmits to the second neighbor computing system the cryptographic hash the nonce for the cryptographic hash of a most recent block of the series of blocks, and   wherein the second participating neighbor blockchain receives the cryptographic hash and the nonce for the cryptographic hash of the most recent principal block and includes the cryptographic hash in a next block of the second series of blocks and receives the cryptographic hash of the most recent block and includes the cryptographic hash in the next block of the second series of blocks.   
     
     
         6 . The system of  claim 1 , wherein the detected anomaly is reported by the first neighbor computing system to the principal computing system to record occurrence of the anomaly. 
     
     
         7 . The system of  claim 1 , wherein, upon the first neighbor computing system detecting the anomaly, the first participating neighbor blockchain and/or first neighbor computing system returns to the principal computing system a previous non-anomalous block received from the principal computing system. 
     
     
         8 . The system of  claim 1 , wherein the principal computing system is the monitored computing system. 
     
     
         9 . The system of  claim 1 , wherein the principal computing system is distinct from the monitored computing system. 
     
     
         10 . The system of  claim 1 , wherein the data of the monitored computing system comprises log data from logs maintained by the monitored computing system. 
     
     
         11 . The system of  claim 1 , wherein the data of the monitored computing system comprises data stored by the monitored computing system 
     
     
         12 . The system of  claim 1 , wherein each computing system of the system, including the principal computing system and the first neighbor computing system, is a monitored computing system. 
     
     
         13 . An anomaly detection system to detect an anomaly in monitored data, the system comprising:
 a computing system implementing a participating blockchain, the computing system comprising:
 a communication interface to communicate with a principal computing system over a communication network, the principal computing system implementing a principal blockchain to store monitored data of a monitored computing system; 
 a memory to store record data in a series of blocks of the participating blockchain, the series of blocks chronologically linked, each block of the series of blocks including a digest of a previous block, a nonce for the digest, a timestamp, and a portion of the record data; 
 one or more processors in electronic communication with the communication interface and the memory, the one or more processors to:
 implement a protocol of the participating blockchain; 
 cross-merklize the participating blockchain with the principle blockchain by:
 receiving from the principal computing system, over the communication network via the communication interface, a digest and a nonce of a most recent block of the principal blockchain; and 
 producing a next block of the series of blocks of the participating blockchain to include the digest of the most recent block of the principal blockchain; and 
 
 
 detect an anomaly in the monitored data by determining whether a subsequent digest of a subsequent block of the principal blockchain is anomalous. 
   
     
     
         14 . The system of  claim 13 , wherein the principal computing system is the monitored computing system, 
     
     
         15 . The system of  claim 13 , wherein the one or more processors are further to cross-merklize the participating blockchain with the principle blockchain by transmitting to the principal computing system, over the communication network via the communication interface, the digest and the nonce for the digest of a most recent block of the series of blocks. 
     
     
         16 . The system of  claim 13 , the communication interface further to communicate with one or more nodes also implementing the participating blockchain. 
     
     
         17 . The system of  claim 13 , wherein detecting an anomaly in the monitored data comprises detecting one or more of an incorrect digest and an incorrect digest and nonce combination. 
     
     
         18 . A computer implemented method of detecting an anomaly in monitored data, the method comprising:
 receiving monitored data;   storing the monitored data in record data in a new block of a principal series of blocks of a principal blockchain implemented on a principal computing system, the principal series of blocks chronologically linked, each block of the principal series of blocks including a digest of a previous block, a nonce for the digest, a timestamp, and a portion of the record data;   transmitting a digest of the new block to a participating blockchain being implemented on a neighbor computing system;   receiving at the neighbor computing system the digest of the new block;   storing the received digest in the participating blockchain;   transmitting a subsequent digest of a subsequent new block of the principal blockchain to the participating blockchain;   receiving at the neighbor computing system the subsequent digest of the subsequent new block; and   detecting an anomaly in the monitored data by determining whether the subsequent digest of the subsequent new block is anomalous relative to the digest of the new block.   
     
     
         19 . The method of  claim 18 , further comprising:
 transmitting a digest of a new block of the participating blockchain to the principal blockchain;   receiving at the principal computing system the digest of the new block of the participating blockchain;   storing in the principal blockchain the received digest of the new block of the participating blockchain;   detecting an anomaly in monitored data of the participating blockchain by determining whether a subsequent digest of a subsequent new block of the participating blockchain is anomalous relative to the digest of the new block of the participating blockchain.