| 摘要 |
Detecting deviations from normal behavior in a processing system is disclosed. Independently for each of a plurality of processes associated with the processing system, a learning phase is started for the process based on a start criteria associated with the process, the normal behavior associated with the process is learned during the learning phase, the learning phase for the process is stopped based on a stop criteria associated with the process, and a protect phase is started for the process.
|
