Concepts forming on the basis of small samples

Monitoring systems of information security of information systems obtain information in the form of chains of short messages which can be considered as chains of small samples. Often, owing to an inertance of information systems, these chains reflect close statuses of the computing system or network. In the paper, it is supposed that work of the system can be presented in the form of a finite set of modes which are called concepts. Violations of security are detected by means of anomalies that are associated with emergence of new concepts. The known technologies of identification of anomalies are based on creation of a model of a normal system's behavior. Concepts correspond to normal types of a system's behavior. In the paper, the problem of creation of concepts on the basis of machine learning based on chains of small samples is considered. The algorithm of concepts forming is constructed and its efficiency is proved.