Hierarchical temporal memory for access control

Patent metadata

Field	Value
Publication number	US-11586751-B2
Application number	US-201816498827-A
Country	US
Kind code	B2
Filing date	Mar 26, 2018
Priority date	Mar 30, 2017
Publication date	Feb 21, 2023
Grant date	Feb 21, 2023

Abstract

A computer implemented method for access control for a restricted resource in a computer system, the method including receiving a first set of records for the computer system, each record detailing an occurrence in the computer system during a training time period when the resource is accessed in an approved manner; generating a sparse distributed representation of the set of records to form a training set for a hierarchical temporal memory (HTM); training the HTM based on the training set in order that the trained HTM provides a model of the operation of the computer system during the training time period; receiving a second set of records for the computer system, each record detailing an occurrence in the computer system during an operating time period for the computer system in use by a consumer of the resource; generating a sparse distributed representation of the second set of records to form an input set for the trained HTM; executing the trained HTM based on the input set to determine a degree of recognition of the records of the input set; and responsive to a determination that a degree of recognition of one or more records of the input set is below a threshold degree, identifying the operation of the computer system by the consumer as unauthorized.

First claim

The invention claimed is:

1. A computer implemented method for access control for a restricted resource in a computer system, the method comprising:
receiving a first set of records for the computer system, each record detailing an occurrence in the computer system during a training time period when the restricted resource in an approved manner;
generating a sparse distributed representation of the set of records to form a training set for a hierarchical temporal memory (HTM);
training the HTM based on the training set in order that the trained HTM provides a model of operation of the computer system during the training time period;
receiving a second set of records for the computer system, each record detailing an occurrence in the computer system during an operating time period for the computer system in use by a consumer of the restricted resource;
generating a sparse distributed representation of the second set of records to form an input set for the trained HTM;
executing the trained HTM based on the input set to determine a degree of recognition of the records of the input set to the model of operation such that only records from the training time period and the operating time period are considered; and
responsive to a determination that a degree of recognition of one or more records of the input set is below a threshold degree, identifying the operation of the computer system by the consumer during the operation period as unauthorized.

2. The method of claim 1 , further comprising precluding access to at least one of the computer system or the restricted resource in response to an identification that the operation of the computer system is unauthorized.

3. A computer system comprising:
a processor and memory storing computer program code for access control for a restricted resource in a computer system by:
receiving a first set of records for the computer system, each record detailing an occurrence in the computer system during a training time period when the restricted resource is accessed in an approved manner;
generating a sparse distributed representation of the set of records to form a training set for a hierarchical temporal memory (HTM);
training the HTM based on the training set in order that the trained HTM provides a model of operation of the computer system during the training time period;
receiving a second set of records for the computer system, each record detailing an occurrence in the computer system during an operating time period for the computer system in use by a consumer of the restricted resource;
generating a sparse distributed representation of the second set of records to form an input set for the trained HTM;
executing the trained HTM based on the input set to determine a degree of recognition of the records of the input set to the model of operation such that only records from the training time period and the operating time period are considered; and
responsive to a determination that a degree of recognition of one or more records of the input set is below a threshold degree, identifying the operation of the computer system by the consumer during the operation period as unauthorized.

4. A non-transitory computer-readable storage medium storing a computer program element comprising computer program code to, when loaded into a computer system and executed thereon, cause the computer system to perform the method of claim 1 .

Assignees

• British Telecomm

Inventors

• Daniel Joshua
• Du Xiaofeng

Classifications

• G06N20/00

  Machine learning · CPC title

• G06F21/62 Primary

  Protecting access to data via a platform, e.g. using keys or access control rules · CPC title

• H04W12/00

  Security arrangements; Authentication; Protecting privacy or anonymity · CPC title

• G06F3/067

  Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS] · CPC title

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title