Detecting anomalous process behavior - Hassan Awadalla, Hany (2007)
A method for learning a process behavior model based on a process past instances and on one or more process attributes, and a method for detecting an anomalous process using the corresponding process behavior model.
US Patent US8719190B2