SERVICE INFRASTRUCTURE AND METHODS OF PREDICTING AND DETECTING POTENTIAL ANOMALIES AT THE SERVICE INFRASTRUCTURE

摘要

Methods allow a predicting and detecting potential anomalies at a serviceinfrastructure. Astrings table having entries that define character strings and correspondinganomalyprobabilities is accessed. A log entry related to an event occurring in theserviceinfrastructure is generated in a database. The log entry includes a characterstring designatinga name of a file or an IP address and a domain name hosted by the serviceinfrastructure. Asearch is made for the character string in the strings table. The domain nameis marked assuspect if the character string is found in the strings table and if ananomaly probability forthe character string exceeds a predetermined threshold. The anomalyprobabilities may becalculated using a Bayesian filter that accounts for a number of domainshosted by the serviceinfrastructure on which the character string has recently appeared.