US 11,853,450 B2
Detection of web application anomalies using machine learning
Sultan Saadaldean Alsharif, Al-Khobar (SA); Mohammed Ahmad Ababtain, Khobar (SA); and Adrian Francis Goodhead, Dhahran (SA)
Assigned to Saudi Arabian Oil Company, Dhahran (SA)
Filed by Saudi Arabian Oil Company, Dhahran (SA)
Filed on Oct. 26, 2020, as Appl. No. 17/079,778.
Claims priority of provisional application 62/931,038, filed on Nov. 5, 2019.
Prior Publication US 2021/0133346 A1, May 6, 2021
Int. Cl. G06F 21/62 (2013.01); G06F 16/906 (2019.01); G06F 16/958 (2019.01); G06F 16/953 (2019.01); G06N 20/00 (2019.01)
CPC G06F 21/6227 (2013.01) [G06F 16/906 (2019.01); G06F 16/953 (2019.01); G06F 16/986 (2019.01); G06N 20/00 (2019.01)] 20 Claims
OG exemplary drawing
 
1. A method comprising:
receiving, by one or more processors of a web server, web application logs and database logs, the web server associated with an N-tier architecture;
segmenting, by a machine learning algorithm executed by the one or more processors, the web application logs and the database logs into a plurality of clusters based on probability density modeling, such that a variance of features within each cluster of the plurality of clusters is less than a threshold variance, each cluster of the plurality of clusters corresponding to one of authorized access of one or more backend databases or unauthorized access of the one or more backend databases;
comparing, by the one or more processors, each cluster of the plurality of clusters to one or more baseline clusters corresponding to the authorized access of the one or more backend databases;
determining, by the one or more processors, that a particular cluster of the one or more clusters corresponds to the unauthorized access of the one or more backend databases based on the comparison; and
responsive to determining that the particular cluster of the one or more clusters corresponds to the unauthorized access of the one or more backend databases, generating, by a display device of the web server, a graphical user interface representing the particular cluster.