FR3038187A1 - METHOD FOR DETECTING ANOMALIES IN THE EXECUTION OF A SERVICE - Google Patents

Abstract

The invention relates to a method for detecting anomalies in the execution of a service, comprising: obtaining (E10) an ordered list of at least two elementary transactions for a current session, during an execution of the service by an entity, - a construction (E11) for the current session of a distribution vector (vc) whose inputs correspond to the inputs of at least one reference vector (C1), an entry of the corresponding reference vector an elementary segment of fixed size of at least one elementary transaction, and association with an input of the distribution vector of a number of occurrences of the corresponding elementary segment in the ordered list, said reference vector being representative of a profile the normal use of the service, - an identification (El3) of the current session as normal when the distance between the distribution vector and the reference vector is less than a threshold value (τj) associated with the reference vector.

Description

The present invention relates to a method for detecting anomalies in the execution of a service.

It finds a particularly interesting application in the detection of attacks against services accessed via the web, especially in the detection of new attacks, that is to say attacks not referenced a priori. Many methods for detecting anomalies when running services exist. It is common for these methods to rely on malicious query modeling to define one or more attack models, and then to detect these patterns among service requests. Such methods are usually based on the use of an event log management tool (called "logs" in English) and the correlation of information from these logs. Such a tool is known as SIEM (Security Information and Event Management). The logs contain for a given device the list of all the events that occurred: success or failure of a user connection, restart of a machine, memory saturation, etc. The SIEM provides methods and tools for aggregating alerts and identifying attacks by correlating log information. Such a tool relies on statistical metrics and / or static correlation rules. However, the effectiveness of such a tool is conditioned by a prior knowledge of how the attack will manifest. Indeed, a SIEM tool requires a priori knowledge of the possibilities of attacking the service. Such a tool builds a pattern of malicious queries from a set of malicious queries. It detects attack profiles based on statistical observation of service or machine-related events, for example, an anomaly in the number of requests from a user or in the number of goods purchased by a user in the service. case of an online shopping service. Such a method, however, does not allow to detect attack profiles not initially referenced. One of the aims of the invention is to remedy the shortcomings / disadvantages of the state of the art and / or to make improvements thereto. To this end, the invention proposes a method for detecting anomalies in the execution of a service, comprising: obtaining an ordered list of at least two elementary transactions for a current session, during a execution of the service by an entity, - a construct for the current session of a distribution vector (va) whose inputs correspond to the inputs of at least one reference vector, an entry of the reference vector corresponding to a segment elementary size of at least one elementary transaction, and association with an input of the distribution vector of a number of occurrences of the corresponding elementary segment in the ordered list, said reference vector being representative of a behavior profile normal use of the service, - identification of the current session as normal when the distance between the distribution vector and the reference vector is lower at a threshold value associated with the reference vector. Compared with known methods for detecting malicious behavior, the method proposes to compare a current execution session with a set of normal usage behavior patterns of a service and to identify the current execution session as normal. since the current execution session is close to at least one normal behavior model. In other words, the current session is considered an anomaly since it deviates from the set of normal behavior patterns. Thus, unlike known methods, the method makes it possible to detect anomalies corresponding to attacks that have not been identified so far. In addition, the method allows the detection of anomalies in the execution of complex services, that is to say services which include many functionalities, and for which a session can comprise a large number of elementary transactions. In this case, the vulnerability may not be related to a particular service feature but to a particular flow of features. Advantageously, the method comprises replacing at least one specific value contained in the elementary transactions by a generic value. The replacement of specific values by generic values in the elementary transactions makes it possible to ignore non-representative values for the identification of normal behaviors of use of the service. It makes it possible to generalize transactions according to the semantics specific to specific values. It thus makes it possible to construct normal behavior patterns that group together execution sessions that differ in non-significant specific values. Advantageously, the ordered list of at least two elementary transactions is obtained by means of an n-grams analysis of the elementary transactions. Usually n-grams analysis is used on lexical units. The use of n-grams analysis has been observed as part of a malicious code detection.

However, this approach consisted of parsing service requests in order to identify attacks that were closest to previously identified attacks. This falls into the category of methods based on pattern matching (or "pattern matching"). Here, we use an n-grams analysis on elementary transactions representative of the interactions between an entity and a service. This analysis allows a service session analysis that takes into account the sequence of elementary transactions by the entity. The choice of n for the n-grams analysis depends on the service. It is empirically fixed at a value that generates the least false positives. In an exemplary embodiment, the method detects an abnormality when the elementary segment of the current session is not among the entries of the reference vector. In this example, an anomaly is detected in a current session of use of the service when a new elementary segment is encountered. "New" means that it was not encountered during the learning phase. Such an anomaly is detected relatively early during the analysis of the session. It can be consecutive to an evolution of the service. For example, a new feature has been defined and put into service. In this case, it is necessary to implement a new learning phase in order to integrate this new functionality in the normal behavior models. According to an exemplary embodiment, the distance between the distribution vector and the reference vector is the Euclidean distance.

In an exemplary embodiment, the method comprises a learning phase implemented over a set of training sessions, comprising for one of said training sessions associated with a service execution: obtaining an ordered list for learning at least two elementary learning transactions, - a construction of a learning distribution vector whose inputs correspond to the inputs of the reference vector, to an input of the learning distribution vector. a number of occurrences of the corresponding elementary learning segment in the ordered learning list, - a construction of a distribution matrix by adding said training distribution vector 30, said observation matrix comprising in the i-th line an i-th learning distribution vector, and, - a modification of the order of the columns and the rows of the distribution matrix obtained. for all the learning sessions, to form groups of 3038187 4 values around the diagonal of the matrix, and obtaining for each grouping of values, the reference vector and the associated threshold value. The method defines a learning phase during which the normal behavior patterns are constructed to which the current service execution sessions are compared. According to an exemplary embodiment, the groups of values are obtained during the learning phase by applying a double classification algorithm, or "coclustering", to the distribution matrix. The double classification, or co-clustering, makes it possible to characterize service sessions 10 and to group them according to the only parameters they have in common. This classification is therefore finer than classifications that work on all the parameters. Thus, it makes it possible to obtain several clusters, or groupings of data, each of which includes common parameters. The invention also relates to an anomaly detection device, comprising: a module for obtaining an ordered list, arranged to obtain an ordered list of at least two elementary transactions for a current session, during a execution of the service by an entity, - a construction and association module, arranged to construct for the current session a distribution vector whose inputs correspond to the inputs of at least one reference vector, an input of the reference vector corresponding to an elementary segment of fixed size of at least one elementary transaction, and for associating with an input of the distribution vector a number of occurrences of the corresponding elementary segment in the ordered list, said reference vector being representative of a normal usage behavior profile of the service, an identification module, arranged to identify the current session as normal when the distance between the distribution vector and the reference vector is less than a threshold value associated with the reference vector. The invention also relates to a computer program on a data carrier and loadable in the memory of a computer, the program comprising code instructions for executing the steps of the abnormality detection method, when the program is run on said computer. The invention also relates to a data carrier in which the program is recorded as described above.

Other features and advantages of the present invention will be better understood from the description and the appended drawings in which: FIG. 1 shows the steps of the learning phase of the abnormality detection method during use a service, according to an exemplary embodiment; FIG. 2 presents the steps of the anomaly detection method; FIG. 3 shows, by way of example, a matrix on which a double classification is implemented and the resulting matrix obtained; FIG. 4 is a schematic representation of an abnormality detection device according to an example embodiment.

The steps of a method for detecting anomalies during the execution of a service, according to an exemplary embodiment will be described in relation with FIGS. 1 to 3. The method proposes to build statistically, from from an observation of normal service executions, i.e. free from anomalies, one or more normal behavior profiles to identify service executions that deviate from this normal behavior, and that It is thus considered anomalies Here we are interested in the execution of so-called "complex" services in the sense that they potentially include the execution of several basic services, such as an authentication service, a service of building a basket, a payment service, etc. Such a service is typically an internet shopping service. During the execution of the purchasing service, a user will perform what is called a "customer journey" from access to the service until receipt of a confirmation of a payment of goods, in through an authentication, the constitution of a basket, a validation of the basket, the provision of bank details for payment, etc. In this sense, the service is described as complex.

25 The customer journey includes possible failures of authentication, surfing on different pages of the merchant site, etc., which correspond to as many interactions with the service. Such a customer journey is associated with an execution session. The session consists of a set of elementary transactions corresponding to the different interactions of the user with the service. An elementary transaction includes a service request and an associated response.

It should be noted that such a service may involve several service providers: a first service provider for authentication, a second service provider for the display of a catalog and the selection of articles and a third supplier for the payment. In a learning phase PO, described in connection with FIG. 1, behavior profiles are constructed modeling normal, that is to say, free of similar, abnormal customer journey histories from a database of BdO observation data which stores a large sample of user sessions. For example, the BdO observation database stores more than 100,000 sessions. Note that the BdO observation database can also be a raw traffic record, such as "HTTP" traces (HyperText Transfer Protocol) or an event log (or "log"). English). A large number of samples in the observation database makes it possible to have a more accurate anomaly detection method. In a subsequent detection phase P1, current execution sessions are compared to normal behavior patterns constructed during the training phase PO and likened to normal service executions or anomalies, depending on the result of the comparison.

In the example described here, a service accessed through the Internet is considered. A user session, composed of elementary transactions, is then described by means of a succession of "Uniform Resource Locator" (URL) requests, or web addresses, representative of all the interactions of the user. user with the service. In this example, it is possible to retain in the observation database BdO only the requests associated with a positive response. The construction of behavioral profiles modeling normal customer journeys will consist in comparing sequences of elementary transactions in sessions and in generating similar behavioral profiles to which the different sessions can be assimilated. The structure of a URL is defined in "RFC" 2616 (for "Request For 20 Comment"). A URL defines by means of a name, a location and possibly other characteristics, a resource accessible through the Internet. More specifically, a URL is structured in several fields: - a fully qualified name (or "FQDN" for "Fully Qualified Domain Name"), which provides the location of the service hosting a resource on a global network space, 25 - the name absolute of the resource or application provided by the service; and - additional optional parameters that may consist of keys and values. An example URL is: URL = https://perso.orange.fr/maf.php?contract=123456&page=svc-mobile 30 A URL may contain user-specific attributes, in the example above a Contract number whose value is "123456". In order to compare URLs resulting from different sessions which for example relate to different users and whose certain parameters, although specific, are not significant for the comparison since the semantics of the associated transaction can be the same in this case, it is necessary to make abstraction of these specific parameters. Indeed, failing that, a URL that contains specific parameters is unique in the context of a given session or user and a comparison of two semantically equivalent URLs does not identify similarity. In an initial step EO, for a session of the observation database BdO 5, an ordered list of elementary transactions is obtained. In a next step El of replacement of specific parameters, it is proceeded, for the session, to identify and replace specific parameters in the representative URLs of elementary transactions by generic parameters. The specificity of a URL can appear in the optional additional parameters. Indeed, the first two fields, in this case the fully qualified name and the absolute name of the resource or the application provided by the service concern specific resources or applications provided by the service and do not concern parameters. specific to the user. Optional additional settings may indicate service-specific attributes that allow users to be redirected to specific web applications. In this case they are equivalent if they share the same key and the same value. The optional additional parameters may also indicate user-specific parameters that allow the service to specify the content to be delivered to the user, for example content that specifies a contract number. User-specific settings in two separate URLs are equivalent if they share the same key and semantics. These 20 parameters do not, however, determine the user's session. It is therefore necessary in the latter case to make the value that is associated with a key generic in order to generalize a parameter specific to the user. In this example, it is proposed to generalize user-specific parameters to semantically equivalent parameters and to replace in one URL each occurrence of a user-specific parameter by its generic equivalent. For example, consider a series of URLs representative of the execution of a service that allows a user to access a page to change their mobile device. The elementary transactions corresponding to the basic requests implemented during the execution of the service by the user are for example the following, in this order: URL1: http: // engine. orange. en /? kw = replace + mobile & bhv = en & module = orange URL2: http://motor.orange.fr/?kw=change+mobile&bhv=en&module=orange URL3: https: // auth. orange. en / auth.cgi? origin = wg & tgt = open. orange. en URL4: https: //open.orange.fr/perso/mobiles.aspx? app = changeMobile & user = bob & bran d = iphone & rdt = en 35 URL5: https: //perso.orange.fr/maf.php? contract = 123456 & page = mobile-svc.

3038187 8 This ordered sequence of URLs is transformed into the following sequence of elementary transactions by replacing user-specific parameters with generic parameters: Ta: http: // engine. orange. en /? kw = [literal] & bhv = [ccode] & module = orange 5 Ta: http: // engine. orange. en /? kw = [literal] & bhv = [ccode] en & module = orange Tb: https://auth.orange.fr/auth.cgi?origin=wg&tgt=open.orange.fr Tc: haps: // open. orange. en / personal / mobile. aspx? app = changeMobile & user = [userId] & bra nd = [item] & rdt = [ccode] Td: https://perso.orange.fr/maf.php?contract=[userId] & page = svc-mobile.

The ordered list of elementary transactions thus obtained is denoted by <Ta, Ta, Tb, Tc, Td>. Note that for some services, the basic queries implemented during the execution of the service do not contain specific parameters. The list of elementary transactions therefore does not require any parameter replacement. During this transformation, a user-specific connection identifier, for example "bob" or "12345", is replaced by a generic "userId" connection identifier. The language, or the country where the user's terminal is located, here "fr" is replaced by a generic value "Ccode". In this service example, the generic parameter denoted "Item" is also used to replace a basic identifier associated with a data item selected by a user, a generic parameter denoted "Timestamp" to replace a local date on the terminal of the user. user, a generic parameter noted "Cookie" to replace a signature or digest for a cookie issued by the service. It is assumed that for a given service, the generic parameters to be used to replace specific parameters have been defined. Other generic parameters may be added based on features specific to a service. On the other hand, in an example where the http requests include context information at the http header, one can consider exploiting the data exchanged via these headers. At the end of the El step of replacing specific parameters, the elementary transactions associated with the execution of the service have thus been generalized by replacing specific user parameters with generic parameters, representative of their semantics. In a next step E2 of analysis, a known statistical analysis method called n-grams is applied to the ordered list of elementary transactions of a session i obtained in the previous step. An n-grams is a subsequence of n elements of constructed from a given sequence. N-grams are widely used in natural language processing and signal processing.

In the method described here, the n-grams analysis method is applied in an original way to ordered lists of elementary transactions representative of service execution sessions in order to characterize legitimate user sessions, ie that is to say without anomaly, in terms of an ordered sequence of elementary transactions. Here, the value of n 5 corresponds to a number of elementary transactions. The use of n-grams makes it possible to take into account the order relationship between n consecutive elementary transactions represented in n-grams. The n-grams is then considered as an elementary and indivisible datum, which represents a sequence of n transactions. appear in this order during the service session.

The use of the n-grams is based on the simplifying assumption that, given a sequence of k elements, k> n, the probability of occurrence of an element in position i depends only on the n-1 preceding elements. Recent applications of n-grams include work on document indexing, multilingual automatic textualization that uses large text collections to build hypertext navigation interfaces, and more.

In these works, the n-grams are n-grams of characters that are defined by a sequence of n characters. In a sub-step E21 of the n-grams analysis step E2, the elementary transactions relating to a session are represented by means of an n-grams. If we consider the ordered list of elementary transactions below: <Ta , Tb, Tc, Ta, Ta, Tb, Tc, Ta, Td> representative, with the replacement of specific parameters by generic parameters, a navigation of a user on the service, we obtain for n = 2 a decomposition into the following n-grams: <TaTb, TbTc, TcTa, TaTa, TaTb, TbTc, TcTa, TaTd>. An elementary element of the n-gram, for example TaTb, is called a segment (or "token" in English). For a given n, the segments are of fixed size in terms of the number of elementary transactions, 2 in the example above and induce an order between the elementary transactions that compose it. We also build a learning vector v, specific to the session i which comprises as many columns as possible elementary segments in a space of the elementary transactions of the service. In another example where the value chosen for n is 3, we obtain the following n-grams: <TaTbTc, TbTcTa, TcTaTa, TaTaTb, TaTbTc, TbTcTa, TcTaTd>. The choice of n depends on the service, and this value is fixed empirically; it is set to a value that generates the least false positives. Note that if we choose n = 1, the model is very generic, but information about the sequence and scheduling of elementary transactions in this sequence is lost. Note also that for 35 n = 1, the anomaly detection system is capable of identifying during the detection phase 3038187 10 P1 abnormal behaviors such as brute force attacks in which a user sends a large number of corresponding requests. to one or a few elementary transactions. The system can also detect specific attacks in which a user injects malicious code into a URL request. Indeed, in this case, the elementary transaction does not correspond to any segment identified during the learning phase P0. The request is then identified as an anomaly. However, with n = 1, it is not possible to detect Cross-Site Request Forgery attacks in which an attacker causes a victim to perform a malicious action on a site where the victim has a session. authenticated in progress. On the other hand, if a value of n is chosen which is too large, the model constructed during the learning phase PO is very closed in the sense that, during the learning phase P0, very few sessions share the same segments. . Even if we consider that a high value of n significantly reduces the number of false negatives, they can contribute to increasing the number of false positives. Indeed, there is a good chance of encountering, during the detection phase P1, service utilization sequences that have not been observed during the PO learning phase and that are therefore likely to be assimilated to anomalies whereas they represent normal behaviors. In a following sub-step E22 of frequency measurement, the frequency of each of the elementary segments is measured for the sequence obtained and for the various elementary segments that compose it. Thus, for the n-grams <TaTb, TbTC, TcTa, TaTa, TaTb, TbTC, TcTa, TaTd>, the frequency of the TaTb segment is 2, the frequency of the TbT segment. is 2, the frequency of the segment TcTa is 2, the frequency of the segment TaTa is 1, the frequency of the segment TaTd is 1 and no other elementary segment appears. The frequency thus measured for the elementary segments composing the sequence is reported in the learning distribution vector v. In a next step E23 for constructing a distribution matrix, the learning distribution vector v, specific to the session i, is transferred to a distribution matrix MD, which comprises as many columns as possible elementary segments in the context the use of the service and as many rows as sessions analyzed. The observation matrix MD thus comprises in the ith line the learning distribution vector v1. Note that the n-grams of session i may not understand all possible segments. For the n-grams presented above, for example do not include the segments TbTb, T, Tc, etc. These segments appear in the observation matrix with a frequency equal to zero for the session i. Note that the observed observation matrix MD is a very large and sparse matrix. We are indeed on a very large observation space in terms of the number of 3038187 11 sessions analyzed, of the order of more than 100000, the sessions are not limited by the number of elementary transactions implemented by the user. which are unique to each user. In addition, the MD matrix has many elements at 0, a service execution rarely exploring all the possible options of this service.

The steps E0, E1 and the substeps E21, E22 and E23 of the analysis step are iterated over all the sessions of the observation database BdO. At the end of the analysis step E2, there is an observation matrix MD representative of the sessions included in the observation database BdO and more precisely of the sequence of elementary transactions in the sessions, the number of transactions of a sequence dependent on the value n chosen for the analysis n-grams In a next step E3 of double classification (or "co-clustering", or "biclustering" in English), a double classification is carried out on the MD distribution matrix, to group sessions that represent the same behavior. Dual classification is an unsupervised learning technique (referred to as a "machine learning" in English) for simultaneously segmenting the rows and columns of a matrix. The principle of double classification consists of moving the rows and columns of a matrix according to a defined co-clustering algorithm in order to identify density zones in the matrix. An n-grams integrates the notion of order into the n transactions that compose it, and this order is preserved within the same n-grams during the double classification step E3. It is considered that the n-grams can work on partial sequences sufficient to detect anomalies. Thus, the displacement of rows and columns, which somehow breaks the sequencing of an analyzed usage session, is not detrimental to the detection of anomalies. The resulting distribution matrix approaches a diagonal matrix; it includes m groups of visible data C1171 (or "cluster" in English). Each of these clusters Cj, or grouping of data, represents a similar behavioral profile in terms of elementary transactions implemented during the execution of the service, for example, purchase of a game then consultation of e-mail, search in a catalog without purchase, search in a catalog with purchase, etc. The dual classification also produces for each grouping of data Cr a reference vector Cj and a radius Ti of the data group. The reference vector Cj corresponds to the center of the cluster Cr or centroid; it is representative of a normal behavior profile associated with the data clustering, and the radius Ti delimits a density zone around the reference vector. The radius Ti determines a threshold value for determining whether or not a new session is part of the cluster Cj representative of a normal execution profile. By way of example, FIG. 3 shows a double classification implemented on a first matrix, on the left in the figure, and the resulting matrix, on the right in the figure, where several data groups clearly appear. To implement the double classification step E3, for example, the co-clustering algorithm defined in the article "Co-clustering documents and words using bipartite spectral graph partitioning", I.S. Dillon, in Proceedings of SIGKDD, 2001. The invention is not limited to this algorithm and any dual classification algorithm that produces a centroid and a radius per cluster can be used. At the end of step E3, there is an MD distribution matrix that models all the normal behaviors of users of the service. In the example described here, it was considered that the population of the observation database BdO was carried out in a secure environment. The invention is not limited to a secure context and in another example, the BdO observation database is populated in an operational environment. It is considered that globally the ratio of dishonest behavior to honest behavior is infinite and that with the method described here, dishonest behaviors recorded during the learning phase will not impact the construction of the model and will even be susceptible be identified at the end of this phase. Indeed, the learning phase and observation base are based on a very large amount of user sessions. Anomalies are considered to be few. In the next detection phase P1, described in connection with FIG. 2, any new user session, or current session, is analyzed in the same way that a session was analyzed during the learning phase PO so as to construct a distribution vector n-grams current proper to the current session. The current distribution vector is then compared with the clusters [C1171 obtained during the double classification step E3 so as to be associated with a corresponding service utilization profile. If the current vector does not correspond to any use pattern identified during the learning phase P1, the current session is considered an anomaly. The current session includes an ordered list of common elementary transactions representative of interactions between the user and the service. In an initial step E10, the current session of execution of the service is represented as an ordered list of elementary transactions.

In a following step Ell of replacing specific parameters, comparable to the step E0 of replacing specific parameters implemented during the learning phase P0, user-specific parameters of the elementary transactions of the current session are replaced by generic parameters, representative of their semantics. In a next step E12 of analysis, the n-grams statistical method as applied during the analysis step E2 is applied to the elementary transactions obtained during the previous step Ell. The value of n is identical to that used during the learning phase PO. Applying the n-grams method provides a sequence of segments associated with the current session. The frequency of occurrence of the different segments of the sequence is then measured. It is then constructed, comparable to substep E23, a current distribution vector vc specific to the current session. This vector vc comprises the same columns as the distribution matrix obtained at the end of the double classification step E3 and in the jth position vc (j) the frequency of occurrence of the segment of the jth column. At the end of the analysis step E12, the distribution vector vc specific to the current session is available. Note that it is possible for the current session to include a current segment that was never encountered during the learning phase. It is therefore referenced neither in the columns 20 of the distribution matrix MD nor in the columns of the distribution vector vc. This may correspond to an anomaly This can also correspond to an evolution of the service that incorporates new functionalities and that can therefore be at the origin of new elementary transactions. In this case, it is necessary to implement the PO learning phase again in order to update the MD distribution matrix and thus take into account the changes in the service. In a next evaluation step E13, the current distribution vector vc is compared with the m groupings of data fC1171, representative of profiles of normal behaviors of use of the service, in order to identify a profile Ck corresponding to the behavior represented by the vector. current distribution vc. For this purpose, the distance between the distribution vector vc and each of the m reference vectors {CJ} 71 from the m data groupings is compared to each of the threshold values frj171 of the data groupings representative of the radius of each cluster {CJ 71}. In a first case (branch "ok" in FIG. 1) where the distance between the distribution vector vc and at least one reference vector Ck of the cluster Ck is less than the threshold value rk representative of the radius of the cluster Ck, then the The current session, associated with the distribution vector vc, is assimilated in a step E14 to a normal behavior. In the opposite case ("nok" branch in FIG. X), the current session is considered to be an anomaly in an abnormality step E15. In the example described here, the user's interactions with the service are described by a succession of URL requests. A URL is a de facto standard used to locate resources on the Internet. The use of URLs is therefore applicable to all types of Internet protocols, such as http, "P2P" (of the English "Peer To Peer"), and "FTP" (of the English "File Transfer Protocol") . The invention is however not limited to URL requests for the description of user sessions and also applies to requests that include other http headers. On the other hand, other types of information representative of the user's interactions with a service and which can be found in the log files can be used. In the example described here, interactions are described as basic transactions between a user and a service. The invention is not limited to this example and can be applied to a case where a first service interacts with a second service during a session. The interactions between the two services during the session are in the form of elementary transactions. The steps of the method described above then apply in the same way. The method finds an interesting application for the detection of anomalies in complex services. Such services are, for example, online purchasing services, mobile subscription management operator services and the Internet. It also finds an interesting application for configuring environments in cloud computing. Indeed, such a configuration which consists of configuring virtual machines in terms of the number of machines and resources to move such machines is done by means of Internet transactions. Each of the operations performed constitutes a service included in the configuration service. A device 40 for detecting anomalies in the execution of a service will now be described in relation to FIG. 4. The device for detecting anomalies is a computer equipment, such as a server, arranged to identify that a current user session comprising elementary transactions relating to the execution of a service corresponds to a normal user anomaly or behavior. For this purpose, the detection device 4 comprises an autonomous application for analyzing execution logs. The analysis module comprises software instructions arranged to implement the steps of the anomaly detection method as described above.

The device 40 comprises: - a processing unit 41, or "CPU" for "Central Processing Unit", - a set of memories, including a volatile memory 42, or "RAM" (for "Random Access Memory") and a read-only memory 43 of the "Read 5 Only Memory" type and a storage memory 44 of flash memory type or "EEPROM" (for "Electrically-Erasable Programmable Read Only Memory). The volatile memory 42 is arranged to execute code instructions, store variables, and so on. The storage memory 44 is arranged to store data. In particular, the storage memory 44 stores the abnormality detection application which includes code instructions for carrying out the steps of the abnormality detection method as described above; Communication interfaces 45, arranged to access the data from the double classification step, in this case the reference vectors of the data groups and the threshold values. The device also comprises: a module 46 for obtaining an ordered list of at least two elementary transactions for a current session of execution of a service by an entity. The entity can be a user or another service. The module 46 for obtaining a list is arranged to implement the step E10 of the anomaly detection method as described above; a module 47 for constructing a distribution and association vector, arranged to construct, for the current session, a distribution vector vc whose inputs correspond to the inputs of at least one reference vector Cj, an input of reference vector corresponding to an elementary segment of fixed size of at least one elementary transaction. The module 46 is also arranged to associate with an input of the distribution vector a number of occurrences of the corresponding elementary segment in the ordered list, said reference vector being representative of a profile of normal behavior of use of the service. The module 47 for constructing a distribution and association vector is arranged to implement the step Ell of the anomaly detection method described above; and an identification module 48, arranged to identify the current session as normal when the distance between the distribution vector and the reference vector is less than a threshold value Ti associated with the reference vector. The threshold value Ti corresponds to the radius of a cluster or data group C1 whose reference vector is Cj. The identification module 48 is arranged to implement the step E13 of the anomaly detection method described above.

The module 46 for obtaining an ordered list of at least two elementary transactions, the module 47 for constructing a distribution and association vector and the identification module 48 are preferably software modules comprising software instructions for executing the steps of the abnormality detection phase P1 described above. The invention therefore also relates to: a computer program comprising instructions for implementing the method of detecting anomalies as described above when this program is executed by a processor of the device 40 for detecting anomalies, and A readable recording medium on which is recorded the computer program described above. The software modules can be stored in, or transmitted by, a data carrier. This may be a hardware storage medium, for example a CD-ROM, a magnetic diskette or a hard disk, or a transmission medium such as a signal or a telecommunications network. In an exemplary embodiment, corresponding to the case where the device 40 for detecting anomalies is arranged to implement the training phase PO, the device 40 also comprises the following modules (not shown in Figure 4): - a second communication interface, arranged to access the observation base Bd0; a module for obtaining an ordered list of learning of at least two elementary learning transactions; a module for constructing a learning distribution vector v whose inputs correspond to the inputs of the training vector; reference, to an input of the training distribution vector a number of occurrences of the corresponding elementary learning segment is associated in the ordered learning list, - a building module of a distribution matrix by adding said vector training distribution, said observation matrix comprising in the it-th line an i-th learning distribution vector, and a modification and obtaining module, arranged to modify the order of the columns and rows of the distribution matrix obtained for the set of training sessions to constitute groupings of values around the diagonal of the matrix, and to obtain for each group of values, the reference vector and the associated threshold value.

These modules are preferably software modules, arranged to implement the steps of the learning phase of the method for assisting the analysis of the execution of a virtual machine as described above. 5

Claims (10)

REVENDICATIONS1. Method for detecting anomalies in the execution of a service, comprising: - obtaining (E10) an ordered list of at least two elementary transactions for a current session, during a service execution by an entity a construction (El 1) for the current session of a distribution vector (va) whose inputs correspond to the inputs of at least one reference vector (Cj), an input of the reference vector corresponding to an elementary segment of fixed size of at least one elementary transaction, and association with an input of the distribution vector of a number of occurrences of the corresponding elementary segment in the ordered list, said reference vector being representative of a normal behavior profile d use of the service, - identification (E13) of the current session as normal when the distance between the distribution vector and the reference vector is less than a threshold value (Ti ) associated with the reference vector. 2. Method according to one of the preceding claims, comprising a replacement (El) of at least one specific value contained in the elementary transactions by a generic value. 3. Method according to one of the preceding claims, wherein the ordered list of at least two elementary transactions is obtained by means of an n-grams analysis of the elementary transactions. 4. Method according to one of the preceding claims comprising an anomaly detection when the elementary segment of the current session is not among the entries of the reference vector. 5. Method according to one of the preceding claims, wherein the distance between the distribution vector and the reference vector is the Euclidean distance. 30 6. Method according to one of the preceding claims, comprising a learning phase implemented on a set of training sessions, comprising for one of said training sessions associated with a service execution: - a obtaining (E10) an ordered list of learning of at least two elementary learning transactions, - a construction (E21) of a learning distribution vector (vi) whose inputs correspond to the entries of the reference vector at an input of the training distribution vector is associated (E22) a number of occurrences of the corresponding elementary learning segment in the ordered learning list, 5 - a construction (E23) of a distribution matrix ( MD) by adding said training distribution vector, said observation matrix comprising in the it-th line an i-th learning distribution vector, and, - a modification (E3) of the order of training olonnes and rows of the distribution matrix obtained for all the learning sessions, to constitute groups of values around the diagonal of the matrix, and obtaining for each group (Cj) of values, the vector of reference (Cj) and the associated threshold value (Ti). The method of claim 6, wherein the value pools are obtained by applying a dual classification algorithm, or "co-clustering", to the distribution matrix. An abnormality detection device, comprising: a module (46) for obtaining an ordered list, arranged to obtain an ordered list of at least two elementary transactions for a current session, during an execution service by an entity, - a module (47) for construction and association, arranged to construct for the current session a distribution vector (va) whose inputs correspond to the inputs of at least one reference vector (Cj) an input of the reference vector corresponding to a fixed-size elementary segment of at least one elementary transaction, and for associating with an input of the distribution vector of a number of occurrences of the corresponding elementary segment in the ordered list, said reference vector being representative of a normal usage behavior profile of the service, - an identification module (48), arranged to identify the current session as normal when the ance between the distribution vector and the reference vector is less than a threshold value associated with the reference vector. A computer program on a data carrier and loadable in a computer memory, the program comprising code instructions for performing the steps of the abnormality detection method according to one of claims 1 to at 7, when the program is running on said computer. Data carrier in which the program according to claim 5 is recorded.