[0001] Companies and products utilize analytics to perform behavior prediction by time series analysis of related and unrelated data. For example, techniques such as Fast Fourier Transforms are generally applied to detect a frequency for a time series.

Brief Description of the Drawings

[0002] Figure 1 is a functional block diagram illustrating one example of a system for application event time adjustment based on a prime number time series.

[0003] Figure 2 is a block diagram illustrating one example of a computer readable medium for application event time adjustment based on a prime number time series.

[0004] Figure 3 is a flow diagram illustrating one example of a method for application event time adjustment based on a prime number time series.

[0005] Figure 4 is a flow diagram illustrating one example of a method for identifying a collection of primes based on timing characteristics for application event time adjustment based on a prime number time series.

[0006] Figure 5 is a flow diagram illustrating one example of a method for identifying a second collection of primes based on a second event sequence for application event time adjustment based on a prime number time series.

[0007] Figure 6 is a flow diagram illustrating one example of a method for configuring a number generator to have entropy that exceeds a threshold.

Detailed Description

[0008] As online communications become more pervasive, cybersecurity becomes key to protecting online activities. Communications and transmissions by government agencies, corporations, and other high security groups become vulnerable to hostile online environments. Companies and products are able to utilize analytics to perform behavior prediction by time series analysis of related and unrelated data. Accordingly, there is a need to provide a secure veil or a security blanket to online communications so that such communications are not detectable by analytics techniques for behavioral detection.

[0009] As described herein, through a process of pre-caicuiation of time series that cannot or is difficult to be analyzed by time series systems, it may be possible to establish patterns of behavior that may be substantially invisible to Fast Fourier Transforms ("FFT") and other analysis. For example, one function of FFTs is to provide a frequency for a time series. As described herein, such frequency detection may be disrupted by utilizing a prime number time series.

[0010] A prime number is a positive integer greater than 1 that is only divisible by 1 and itself. For example, 2, 3, 5, 7, 1 1 , 13, 17, 19, ... are the first few prime numbers. Determining whether a number is prime or not, i.e. determining primality of a number, is generally a hard problem. In fact, there is no known equation such that primality may be determined in linear time for any given number. Accordingly, the distribution of primes is a pattern that may not be detectable.

[0011] Primality of a number is generally determined by attempting to factor the number. No known algorithm can factor all integers in polynomial time, i.e., no algorithm is known that can factor b-b t numbers in time Q(b ^k ) for some constant k. As used in mathematics, the big O notation describes a limiting behavior for a function as an argument tends to a finite value or to infinity. For example, 0(b ^k ) generally describes limiting behavior for algorithmic time in terms of b ^k . There are some known algorithms that may perform factorization in sub-exponential time. For example, there are known algorithms that are faster than 0((1 +ε) ^& ) for ail positive real numbers ε. Finding a factorization algorithm that can operate in linear or polynomial time is a generally well-known open problem in mathematics.

[0012] Execution of computer applications generally requires performance of a sequence of event steps. For example, when a user invokes an application for electronic mail, the user may perform event steps including, for example, clicking on a link for a first message in an inbox which opens the first message. The user may close the first message, and may click on a link for a second message in the inbox to open the second message, and so forth. [0013] As another example, an application for getting directions to a location may include opening a "Map" application, entering an address, receiving a list of options to reach the desired location, selecting an option of the given options, receiving step by step directions to the desired location, and so forth.

[0014] Patterns in such activities may be generally detected via analytics techniques for behavioral detection, such as, for example, by performing an FFT on the sequence of time differences between steps. Accordingly, online activities may be vulnerable to unwanted online detection and prediction.

[0015] Generally, there may be few discernible patterns among differences of prime numbers . Also, as described herein, determining primality for these differences may be nearly impossible at present. Accordingly, the sequence of time differences between steps may be configured to correspond to a sequence of prime numbers, thereby making the sequence of steps substantially invisible to techniques for behavioral detection.

[0016] As described in various examples herein, application event time adjustment based on a prime number time series is disclosed. One example is a system including a prime series generator communicatively linked to an application configured to run an event sequence, where the prime series generator identifies a collection of primes based on the event sequence, and utilizes a number generator to generate a prime number time series from the collection of primes. A timing mechanism causes to adjust execution times of the events of the event sequence, where each difference between successive execution times corresponds to a number in the prime number time series.

[0017] In the following detailed description, reference is made to the accompanying drawings which form a part hereof, and in which is shown by way of illustration specific examples in which the disclosure may be practiced. It is to be understood that other examples may be utilized, and structural or logical changes may be made without departing from the scope of the present disclosure. The following detailed description, therefore, is not to be taken in a limiting sense, and the scope of the present disclosure is defined by the appended claims. It is to be understood that features of the various examples described herein may be combined, in part or whole, with each other, unless specifically noted otherwise. [0018] Figure 1 is a functional block diagram illustrating one example of a system for application event time adjustment based on a prime number time series. System 100 includes a prime series generator 104, a number generator 106, and a timing mechanism 108, System 100 is communicatively linked to an application 102.

[0019] Application 102 may be any computer-based application (e.g., comprising machine-readable, processor executable instructions) that runs an event sequence. For example, application 102 may be an email application, and the event sequence may be a sequence of steps utilized by the email application to provide email communications functionality to a user. As another example, application 102 may be a Bluetooth communication application, and the event sequence may be a sequence of steps utilized by the application to provide Bluetooth communication functionality to a user. In some examples, the event sequence may be a series of network events. For example, a network management console may perform an event sequence comprising a series of steps related to diagnostics, updates, audits, modifications, topology detection, and so forth in a network environment.

[0020] The prime series generator 104 is communicatively linked to the application 102 that is configured to run an event sequence. The prime series generator 104 identifies a collection of primes based on the event sequence, and utilizes the number generator 106 to generate a prime number time series from the collection of primes. The collection of primes may be identified based on various characteristics of the event sequence. For example, the collection of primes may be identified based on a type of the application 102 running the event sequence (e.g., email application, browsing application, application providing directions, a security application, a banking application, etc.), computing resources that may be available for the application 102 (e.g., cache requirements, processing capabilities, memory resources, network bandwidth, etc.), a time of day, a day of the week, and so forth.

[0021] The number generator 106 is generally a computer application configured to select numbers from a collection of numbers. In some examples, the number generator 106 may be configured to select the numbers based on a probability distribution. For example, in some examples, the number generator 106 may be configured to select the numbers in a random manner. The term "random" as used herein, may be generally construed to mean substantially, and/or approximately random, subject to limits of computing resources. In some examples, the number generator 106 may generate a prime number time series with a predetermined number of primes from the identified collection of primes. In some examples, the number generator 106 may generate a prime number time series with primes in a predetermined range of values from the identified collection of primes. In some examples, the prime numbers in the prime number time series may be ordered, such as increasing (e.g., 43, 53, 71 , 89), and decreasing (e.g., 59, 47, 29). However, in some examples, the primes in the prime number time series may not be in any particular order (e.g., 83, 97, 71 , 53, 59, 47, ... ). In some examples, the number generator 106 may generate a prime number time series on demand, and/or on a continuous basis. In some examples, the number generator 106 may generate a prime number time series and store it in a cache.

[0022] In order to thwart detection of a pattern in the sequence of events, the prime numbers in the prime number time series may be selected to have high entropy. High entropy is generally indicative of more disorder, thereby making it difficult to detect patterns. In some examples, the number generator 106 may be configured to have entropy that exceeds a threshold. Accordingly, a degree of disorder in the prime number time series may be built in to result in a higher entropy. Generally, such entropy is based on a probability distribution of the collection of primes. In some examples, the primes in the collection of primes may be appropriately weighted to incorporate entropy considerations. Generally, the amount of prior information built into a distribution may be minimized by maximizing entropy. Accordingly, such an appropriately generated prime number time series may be immune to discovery by a behavior and/or pattern detection technique.

[0023] The prime number time series, as used herein, generally refers to a sequence of prime numbers. In some examples, the prime number time series may include at least one composite. The term "composite" generally refers to a number thai is not a prime number. For example, numbers 1 , 4, 6, 8, 9, 10, 12,14, and so forth are composite numbers. This provides additional distortion to any behavior and/or pattern detection technique that may attempt to detect a pattern of primes.

[0024] In some examples, timing characteristics of the event sequence may be determined, and the collection of primes may be identified based on the timing characteristics. The term "timing characteristics" as used herein, generally refers to any timing related attributes for the event sequence. For example, some event sequences may have some periodic and/or repetitive behavior. Also, for example, some event sequences may be executed in a relatively short period of time. As another example, some event sequences may execute the events at regular time intervals. Also, for example, some event sequences may comprise events executed at varying time intervals. In some examples, the prime series generator 104 may determine these timing characteristics by accessing the application 102, and may identify the collection of primes based on the timing characteristics. In some examples, applications and their timing characteristics may be available in a lookup table in an appropriate database, and the prime series generator 104 may access such a database to retrieve data related to the timing characteristics.

[0025] In some examples, time gaps, or time between execution of events in the event sequence, may be measured by utilizing a timing device in a computing device. The term "time" as used herein may generally refer to any measurement of time for an activity performed in computing environment. For example, time may be system time, process time, time for a network activity, and so forth. In some examples, a computer clock may be utilized to determine the time. For example, a computer clock may be utilized to determine the time between the events in the event sequence. In some examples, time may be measured in units of seconds, milliseconds, nanoseconds, and so forth.

[0026] Some applications may require short time gaps associated with a short response time for execution of events in the event sequence. Also, for example, some other applications may require relatively larger time gaps associated with a relatively larger response time for execution of events in the event sequence.

8 Accordingly, for an application for which the time gaps may be measured in nanoseconds, large prime numbers may be utilized, whereas for an application for which the time gaps may be measured in seconds, smaller prime numbers may be utilized. Accordingly, the prime series generator 104 identifies the collection of primes based on the event sequence.

[0027] In some examples, the size of the collection of primes may be based on the event sequence. For example, the prime series generator 104 may determine a number of events in the event sequence, and determine a number of primes needed based on the number of events in the event sequence. In some examples, the number of primes in the prime number time series may be one less than the number of events in the event sequence.

[0028] In some examples, the prime series generator 104 may determine that an event in the event sequence is associated with a second event sequence. For example, application 102 may run a first event sequence associated with accessing email messages. An event in the first event sequence may involve opening a first email message. However, a user may invoke a second event sequence from the first email message by clicking a link to an internet site. Accordingly, a browser application may be invoked, and the browser application may include a second event sequence to perform browsing activities. Accordingly, the prime series generator 104 may identify a second collection of primes based on the second event sequence. For example, the prime series generator 104 may identify a second collection of primes to correspond to the browsing activity.

[0029] Generally, as described herein, an event in the event sequence may itself be another application, and/or be associated with another application. Also, for example, an event in the event sequence may be associated with another sequence of events. In some examples, a plurality of events in the event sequence may be associated with a plurality of additional independent, dependent, and/or co-dependent event sequences.

[0030] Although system 100 is described with respect to application 102, more than one application may be communicatively linked to system 100. In some examples, the prime series generator 104 may be communicatively linked to an additional appiication configured to run an additional event sequence. Accordingly, the prime series generator 104 may identify an additional collection of primes based on the additional event sequence, and utilize the number generator 106 to generate an additional prime number time series from the additional collection of primes.

[0031] Also, for example, more than one application may be run concurrently, successively, and/or with overlapping times, and the prime series generator 104 may identify a plurality of collections of primes for the various applications. Also, for example, different applications and event sequences may be associated with different timing characteristics, and the prime series generator 104 may identify collections of primes based on such different timing characteristics.

[0032] In some examples, the prime series generator 104 may dynamically generate the prime number time series as the events in the event sequence are executed. For example, instead of determining how many events there are and/or what the timing characteristic of the event sequence may be, the prime series generator 104 may communicate with application 102 to dynamically determine the types and/or number of primes that may be needed. Accordingly, the prime series generator 104 may access the number generator 106 to generate prime numbers on demand.

[0033] In some examples, the prime series generator 104 may be equipped with a cache to store prime numbers that may be generated and stored for rapid retrieval. In some examples, a plurality of caches may exist for different sets of primes. For example, prime numbers over certain ranges may be stored in different caches. For example, a first cache may include prime numbers that are less than 1000, and a second cache may store prime numbers greater than 10,000. Such caches enable the prime series generator 104 to rapidly retrieve collections of primes, especially when catering to multiple applications at the same time.

[0034] System 100 includes a timing mechanism 108 to cause to adjust execution times of the events of the event sequence, where each difference between successive execution times corresponds to a number in the prime number time series. The term "adjust" as used herein, may generally refer to a potential change in the execution time, and may include maintaining the same execution time, causing a delay in the execution time, causing a modification in the execution time, and so forth. For a given event sequence, the timing mechanism 108 may delay some execution times, keep some execution times the same, and so forth. The term "corresponds" as used herein generally refers to a correspondence between the execution times and the primes in the prime number time series.

[0035] For example, if the event sequence is to be executed at times t _ls t ₂ , ... , t _N , then the time difference between events in the event sequence may be adjusted to be equivalent to primes in a prime number time series given by a sequence Pi ^{¾ T:} 2 ^{"""" t:} i> P ^¾ % - t ₂ , - , VN-I ~ ^T N - tjv-i- As another example, if the event sequence is to be executed at times t _lt t ₂ , ,., , t _N , then the time difference between events in the event sequence may be adjusted to be equal to primes in a prime number time series given by a sequence p ₁ - t ₂ - t _lt p ₂ = t ₃ - t ₂ , p _N -i - ^T N — tj -i - ^ ⁿ some examples, based on the recording mechanism for prediction and/or pattern detection analysis between events 1 , 2, ... N, the timing mechanism 108 adjusts execution times of the events by waiting for a duration equivalent to a prime number to create the time difference equal to that prime number.

[0036] For example, an analysis of a network event may comprise an event sequence with three events, and time between the three events in the event sequence may be measured in milliseconds. A prime number time series, for example, 53, 79, may be generated by the prime series generator 104. After a first event in the event sequence is executed, the timing mechanism 108 may adjust execution of a second event in the event sequence by a duration of time equivalent to a given prime number in the given units of time. For example, the second event may be determined to be executed after a delay of 53 milliseconds, where 53 is a prime number from the prime number time series. Accordingly, the timing mechanism 108 performs, or directs application 102 to perform, the execution of the second event after a delay of 53 milliseconds after execution of the first event. Also, for example, the timing mechanism 108 may adjust execution of a third event in the event sequence by a duration of time equivalent to a given prime number in the given units of time. For example, the third event may be determined to be executed after a delay of 79 milliseconds, where 79 is a prime number from the prime number time series. Accordingly, the timing mechanism 108 performs, or directs application 102 to perform, the execution of the third event after a delay of 79 milliseconds after execution of the second event. In some examples, a duration of an actual and/or measured performance of the second event may be taken into account such that the second event may be logged to have been executed (e.g., in a system log file) after an adjustment of a time equivalent to a prime number (measured in appropriate units of time).

[0037] As described herein, in some examples, more than one of the numbers in the prime number time series may be composite. In some examples, the timing mechanism 108 causes to adjust execution of the event sequence based on the generated prime number time series. Accordingly, a behavior and/or pattern detection system fails in its attempt to find a pattern of execution for the event sequence, since the prime number time series does not facilitate detection based on known properties of prime numbers. Additional inclusion of composite numbers in the prime number time series may add another detrimental factor to such pattern detection. In some examples, the composite numbers may be inserted at various positions to replace prime numbers in the prime number time series, where the positions for the inserted composite numbers may be determined, for example, in an aperiodic manner.

[0038] In some examples, the time differences between events in the event sequence may be adjusted to avoid potential detection. For example, the time differences between events in the event sequence may be adjusted to avoid detection by a known detection system. Generally, when it is know that the detection system is attempting to detect a pattern based on a given unit of time (e.g., seconds, milliseconds, etc.), then system 100 may adjust the time differences to be measured in the same unit of time. For example, the detection system may perform a pattern detection analysis at a macro level based on the time differences measured in seconds. Accordingly, the time differences between events in the event sequence may be adjusted to be in seconds as well. For example, the prime series generator 104 may generate an appropriate collection of primes that may be utilized to measure time in seconds. In some examples, the collection of primes may be determined so as to measure time in microseconds, and the microseconds may be converted to seconds to adjust the time differences between events in the event sequence. Generally, the collection of primes may be determined so as to match the desired time differences as accurately as possible, and also to conform to the unit of time measurement utilized by the known detection system. Generally, converting from a smaller unit of time to a larger unit of time may maintain accuracy of the prime numbers. For example, if the detection system is known to measure time in seconds, then the prime series generator 104 may generate primes to measure time in milliseconds and/or nanoseconds and convert such time to seconds. However, if may be less desirable to generate primes to measure time in minutes, and then convert such time to seconds by dividing by 60.

[0039] In some examples, the prime number time series may be determined to provide times in microseconds, and the known detection system may be attempting to detect a pattern at a macro level by rounding time to the nearest second. For example, the event sequence may comprise four events, with a time difference between events corresponding to time measured in milliseconds. Accordingly, the detection system may observe after rounding to the nearest second, for example, four events each with a time difference of one second. In such an instance, the prime number time series to be associated with the time differences may be appropriately adjusted to convert the milliseconds to seconds. Also, for example, the prime number time series to be associated with the time differences may be appropriately adjusted to insert another number for a prime number in the series, and/or insert a composite number. Such an insertion may generally be large enough to the macro/micro observation to be able to avoid any potential detection from rounding to a macro analysis level.

[0040] System 100 may be implemented by a computing device. As used herein, a computing device may be a desktop computer, laptop (or notebook) computer, workstation, tablet computer, mobile phone, smart device, switch, router, server, blade enclosure, or any other processing device or equipment including a processing resource. In examples described herein, a processing resource may include, for example, one processor or multiple processors included in a single computing device or distributed across multiple computing devices. The components of system 100 (e.g., 104, 106, and 108) may be any combination of hardware and programming to implement the functionalities described herein. In examples described herein, such combinations of hardware and programming may be implemented in a number of different ways. For example, the programming for the components may be processor executable instructions stored on at least one non-transitory machine-readable storage medium and the hardware for the components may include at least one processing resource to execute those instructions. In some examples, the hardware may also include other electronic circuitry to at least partially implement at least one component of system 100. In some examples, the at least one machine-readable storage medium may store instructions that, when executed by the at least one processing resource, at least partially implement some or all of components 104, 106, and 108 of system 100. In such examples, system 100 may include the at least one machine-readable storage medium storing the instructions and the at least one processing resource to execute the instructions. In other examples, the functionalities of any components of system 100 may be at least partially implemented in the form of electronic circuitry.

[0041] For example, the prime series generator 104 may be a combination of hardware and programming (e.g., processor executable instructions) to identify a collection of primes based on the event sequence. For example, the programming of prime number generator 104 may include instructions executable to automatically utilize a number generator to generate a prime number time series from the collection of primes. Also, for example, the prime series generator 104 may include hardware to physically store, for example, the prime number time series. As another example, the programming of prime series generator 104 may implement functionality to interact with the application 102 to determine parameters for the collection of primes, including identifying the collection of primes based on, say, timing characteristics of the event sequence. Also, for example, the prime series generator 104 may include a combination of hardware and software programming to dynamically interact with the other components of system 100.

[0042] Likewise, the timing mechanism 108 may be a combination of hardware and programming (e.g., processor executable instructions) to identify a collection of primes based on the event sequence. For example, the programming of timing mechanism 108 may include instructions executable to automatically cause to adjust execution times of the events of the event sequence, where each difference between successive execution times corresponds to a number in the prime number time series. Also, for example, timing mechanism 108 may include hardware to physically store, for example, instructions for the application 102 to apply the successive execution times. In some examples, the timing mechanism 108 may include a hardware component installed in a computing device capable of running application 102, where the installed component may communicate with the timing mechanism 108 to implement the successive execution times for the event sequence. The timing mechanism 108 may include a combination of hardware and software programming to dynamically interact with the other components of system 100.

[0043] Generally, as described herein, the components of system 100 may include software programming and physical networks to be communicatively linked to other components of system 100. In some instances, the components of system 100 may include a processor and a memory, while programming code is stored and on that memory and executable by a processor to perform designated functions.

[0044] A computing device, as used herein, may be, for example, a web-based server, a local area network server, a cloud-based server, a notebook computer, a desktop computer, an all-in-one system, a tablet computing device, a mobile phone, an electronic book reader, or any other electronic device suitable for provisioning a computing resource to perform a unified visualization interface. The computing device may include a processor and a computer-readable storage medium.

[0045] Figure 2 is a block diagram illustrating one example of a computer readable medium for application event time adjustment based on a prime number time series. Processing system 200 includes a processor 202, a computer readable medium 208, input devices 204, and output devices 208. Processor 202, computer readable medium 208, input devices 204, and output devices 206 are coupled to each other through a communication link (e.g. , a bus).

[0046] Processor 202 executes instructions included in the computer readable medium 208, Computer readable medium 208 includes timing characteristics determination instructions 210 to determine, via a processor, timing characteristics of an event sequence run by an application, as described herein.

[0047] Computer readable medium 208 includes collection of primes determination instructions 212 to identify, via a processor, a collection of primes based on the timing characteristics.

[0048] Computer readable medium 208 includes time series generation instructions 214 to utilize, via the processor, a number generator to generate a prime number time series from the collection of primes.

[0049] Computer readable medium 208 includes time adjustment instructions 216 to adjust, via the processor, execution times of the events of the event sequence, wherein each difference between successive execution times corresponds to a number in the prime number time series.

[0050] Computer readable medium 208 includes adjusted time providing instructions 218 to provide, via the processor, the adjusted execution times to the application.

[0051 ] In some examples, computer readable medium 208 includes instructions to configure the number generator to have entropy that exceeds a threshold.

[0052] Input devices 204 include a keyboard, mouse, data ports, and/or other suitable devices for inputting information into processing system 200. !n some examples, input devices 204 are used to receive, via a computing device, user interactions with a computer application to initiate an event sequence. Output devices 206 include a monitor, speakers, data ports, and/or other suitable devices for outputting information from processing system 200. In some examples, output devices 206 are used to provide, via a computing device, an adjusted time sequence to correspond to an event sequence. [0053] As used herein, a computer readable medium may be any electronic, magnetic, optical, or other physical storage apparatus to contain or store information such as executable instructions, data, and the like. For example, any computer readable storage medium described herein may be any of Random Access Memory (RAIVI), volatile memory, non-volatile memory, flash memory, a storage drive (e.g., a hard drive), a solid state drive, and the like, or a combination thereof. For example, the computer readable medium 208 can include one of or multiple different forms of memory including semiconductor memory devices such as dynamic or static random access memories (DRAMs or SRAMs), erasable and programmable read-only memories (EPRO s), electrically erasable and programmable read-only memories (EEPROMs) and flash memories; magnetic disks such as fixed, floppy and removable disks; other magnetic media including tape; optical media such as compact disks (CDs) or digital video disks (DVDs); or other types of storage devices.

[0054] As described herein, various components of the processing system 200 are identified and referto a combination of hardware and programming configured to perform a designated visualization function. As illustrated in Figure 3, the programming may be processor executable instructions stored on tangible computer readable medium 208, and the hardware may include processor 202 for executing those instructions. Thus, computer readable medium 208 may store program instructions that, when executed by processor 202, implement the various components of the processing system 200.

[0055] Such computer readable storage medium or media is (are) considered to be part of an article (or article of manufacture). An article or article of manufacture can refer to any manufactured single component or multiple components. The storage medium or media can be located either in the machine running the machine-readable instructions, or located at a remote site from which machine- readable instructions can be downloaded over a network for execution.

[0056] Computer readable medium 208 may be any of a number of memory components capable of storing instructions that can be executed by Processor 202. Computer readable medium 208 may be non-transitory in the sense that it does not encompass a transitory signal but instead is made up of one or more memory components configured to store the relevant instructions. Computer readable medium 208 may be implemented in a single device or distributed across devices. Likewise, processor 202 represents any number of processors capable of executing instructions stored by computer readable medium 208. Processor 202 may be integrated in a single device or distributed across devices. Further, computer readable medium 208 may be fully or partially integrated in the same device as processor 202 (as illustrated), or it may be separate but accessible to that device and processor 202. In some examples, computer readable medium 208 may be a machine-readable storage medium.

[0057] Figure 3 is a flow diagram illustrating one example of a method for application event time adjustment based on a prime number time series. In some examples, such an example method may be implemented by a system such as, for example, system 100 of Figure 1 .

[0058] At 300, based on an event sequence run by an application, a collection of primes is identified via a processor, as described herein.

[0059] At 302, a number generator is utilized, via the processor, to generate a prime number time series from the collection of primes.

[0060] At 304, execution times of the events of the event sequence are caused to be adjusted via the processor, where each difference between successive execution times corresponds to a number in the prime number time series.

[0061] At 306, the adjusted execution times are provided via the processor to the application.

[0062] Figure 4 is a flow diagram illustrating one example of a method for identifying a collection of primes based on timing characteristics for application event time adjustment based on a prime number time series. In some examples, such an example method may be implemented by a system such as, for example, system 100 of Figure 1.

[0063] At 400, based on an event sequence run by an application, a collection of primes is identified via a processor.

[0064] At 402, a number generator is utilized, via the processor, to generate a prime number time series from the collection of primes. [0065] At 404, execution times of the events of the event sequence are caused to be adjusted via the processor, where each difference between successive execution times corresponds to a number in the prime number time series.

[0066] At 406, the adjusted execution times are provided via the processor to the application.

[0067] At 408, timing characteristics of the event sequence are determined.

[0068] At 410, the collection of primes is identified based on the timing characteristics.

[0069] Figure 5 is a flow diagram illustrating one example of a method for identifying a second collection of primes based on a second event sequence for application event time adjustment based on a prime number time series. In some examples, such an example method may be implemented by a system such as, for example, system 100 of Figure 1 .

[0070] At 500, based on an event sequence run by an application, a collection of primes is identified via a processor.

[0071] At 502, a number generator is utilized, via the processor, to generate a prime number time series from the collection of primes.

[0072] At 504, execution times of the events of the event sequence are caused to be adjusted via the processor, where each difference between successive execution times corresponds to a number in the prime number time series.

[0073] At 506, the adjusted execution times are provided via the processor to the application.

[0074] At 508, an event in the event sequence is determined to be associated with a second event sequence.

[0075] At 510, a second collection of primes is identified based on the second event sequence.

[0076] Figure 6 is a flow diagram illustrating one example of a method for configuring a number generator to have entropy that exceeds a threshold. In some examples, such an example method may be implemented by a system such as, for example, system 100 of Figure 1 .

[0077] At 600, based on an event sequence run by an application, a collection of primes is identified via a processor. [0078] At 602, a number generator is utilized, via the processor, to generate a prime number time series from the collection of primes.

[0079] At 604, execution times of the events of the event sequence are caused to be adjusted via the processor, where each difference between successive execution times corresponds to a number in the prime number time series.

[0080] At 606, the adjusted execution times are provided via the processor to the application.

[0081] At 608, the number generator is configured to have entropy that exceeds a threshold.

[0082] Examples of the disclosure provide a generalized system for application event time adjustment based on a prime number time series. The generalized system provides adjusted times based on a prime number time series, where steps in an event sequence are executed at times so that the time interval between the steps correspond to the prime numbers. This enables execution of the event sequence to be undiscoverabie to application detection algorithms, such as fast Fourier transform techniques.

[0083] Although specific examples have been illustrated and described herein, a variety of alternate and/or equivalent implementations may be substituted for the specific examples shown and described without departing from the scope of the present disclosure. This application is intended to cover any adaptations or variations of the specific examples discussed herein.