Computer System Anomaly Detection Using Human Responses to Ambient Representations of Hidden Computing System and Process Metadata

摘要

A system and method involve measuring one or more hidden states internal to a computing system related only to a user's active task with the computing system, using one or more deterministic mapping functions to directly map, without interpretation of the hidden states as being benign or malicious, the measurements to a representational output, presenting the representational output in real-time and peripheral to the user's active task with the computing system without label information pertaining to the hidden states, determining the user's behavioral responses and/or physiological responses to the presented representational output, altering one or more display characteristics of the presented representational output based upon one or more behavioral responses and physiological responses, and/or inputting the user's response into a machine learning algorithm configured to detect an anomaly within the computing system using the user's behavioral and physiological responses and/or computing system measurements.

主权项

1. A method comprising the steps of:
measuring one or more hidden states internal to a computing system related only to a user's active task with the computing system; using one or more deterministic mapping functions to directly map, without interpretation of the hidden states as being benign or malicious, the measurements to a representational output; presenting the representational output in real-time and peripheral to the user's active task with the computing system, wherein the presented representational output does not label information pertaining to the hidden states; and determining the user's response to the presented representational output.