Using new edges for anomaly detection in computer networks

Neil, Joshua Charles

Using new edges for anomaly detection in computer networks

Patent · 03 July 2018

OSTI ID:1459412

Neil, Joshua Charles

Creation of new edges in a network may be used as an indication of a potential attack on the network. Historical data of a frequency with which nodes in a network create and receive new edges may be analyzed. Baseline models of behavior among the edges in the network may be established based on the analysis of the historical data. A new edge that deviates from a respective baseline model by more than a predetermined threshold during a time window may be detected. The new edge may be flagged as potentially anomalous when the deviation from the respective baseline model is detected. Probabilities for both new and existing edges may be obtained for all edges in a path or other subgraph. The probabilities may then be combined to obtain a score for the path or other subgraph. A threshold may be obtained by calculating an empirical distribution of the scores under historical conditions.

View Patent

Research Organization:: Los Alamos National Laboratory (LANL), Los Alamos, NM (United States)

Sponsoring Organization:: USDOE

DOE Contract Number:: AC52-06NA25396

Assignee:: Los Alamos National Security, LLC (Los Alamos, NM)

Patent Number(s):: 10,015,183

Application Number:: 15/637,475

OSTI ID:: 1459412

Country of Publication:: United States

Language:: English

References (14)

Anomaly detection: A survey Chandola, Varun; Banerjee, Arindam; Kumar, Vipin ACM Computing Surveys, Vol. 41, Issue 3, p. 1-58 https://doi.org/10.1145/1541880.1541882	journal	July 2009
Alert correlation in a cooperative intrusion detection framework Cuppens, F.; Miege, A. Proceedings 2002 IEEE Symposium on Security and Privacy https://doi.org/10.1109/SECPRI.2002.1004372	conference	January 2002
Adaptive ROC-based ensembles of HMMs applied to anomaly detection Khreich, Wael; Granger, Eric; Miri, Ali Pattern Recognition, Vol. 45, Issue 1, p. 208-230 https://doi.org/10.1016/j.patcog.2011.06.014	journal	January 2012
Probabilistic Alert Correlation Valdes, Alfonso; Skinner, Keith; Goos, Gerhard Recent Advances in Intrusion Detection, p. 54-68 https://doi.org/10.1007/3-540-45474-8_4	book	January 2001
Exploiting dynamicity in graph-based traffic analysis: techniques and applications Iliofotou, Marios; Faloutsos, Michalis; Mitzenmacher, Michael CoNEXT '09 Proceedings of the 5th international conference on Emerging networking experiments and technologies, p. 241-252 https://doi.org/10.1145/1658939.1658967	conference	January 2009
Two-tier data-driven intrusion detection for automatic generation control in smart grid Ali, Muhammad Qasim; Yousefian, Reza; Al-Shaer, Ehab 2014 IEEE Conference on Communications and Network Security, p. 292-300 https://doi.org/10.1109/CNS.2014.6997497	conference	December 2014
Discovering Collaborative Cyber Attack Patterns Using Social Network Analysis Du, Haitao; Yang, Shanchieh Jay; Salerno, John Social Computing, Behavioral-Cultural Modeling and Prediction, p. 129-136 https://doi.org/10.1007/978-3-642-19656-0_20	conference	January 2011
Botnets: A survey Silva, Sérgio S. C.; Silva, Rodrigo M. P.; Pinto, Raquel C. G. Computer Networks, Vol. 57, Issue 2, p. 378-403 https://doi.org/10.1016/j.comnet.2012.07.021	journal	February 2013
A survey of coordinated attacks and collaborative intrusion detection Zhou, Chenfeng Vincent; Leckie, Christopher; Karunasekera, Shanika Computers & Security, Vol. 29, Issue 1, p. 124-140 https://doi.org/10.1016/j.cose.2009.06.008	journal	February 2010
Identifying botnets by capturing group activities in DNS traffic Choi, Hyunsang; Lee, Heejo Computer Networks, Vol. 56, Issue 1, p. 20-33 https://doi.org/10.1016/j.comnet.2011.07.018	journal	January 2012
Bayesian anomaly detection methods for social networks Heard, Nicholas A.; Weston, David J.; Platanioti, Kiriaki The Annals of Applied Statistics, Vol. 4, Issue 2, p. 645-662 https://doi.org/10.1214/10-AOAS329	journal	August 2010
The link-prediction problem for social networks Liben-Nowell, David; Kleinberg, Jon Journal of the American Society for Information Science and Technology, Vol. 58, Issue 7, p. 1019-1031 https://doi.org/10.1002/asi.20591	journal	January 2007
Scan Statistics for the Online Detection of Locally Anomalous Subgraphs Neil, Joshua; Hash, Curtis; Brugh, Alexander Technometrics, Vol. 55, Issue 4, p. 403-414 https://doi.org/10.1080/00401706.2013.822830	journal	August 2013
Detecting Anomalies Using End-to-End Path Measurements Naidu, K. V. M.; Panigrahi, D.; Rastogi, R. IEEE INFOCOM 2008 - The 27th Conference on Computer Communications https://doi.org/10.1109/INFOCOM.2008.248	conference	April 2008

Similar Records

Using new edges for anomaly detection in computer networks

Patent · 2015 · OSTI ID:1179789

Using new edges for anomaly detection in computer networks

Patent · 2017 · OSTI ID:1368182

Using new edges for anomaly detection in computer networks

Patent · 2020 · OSTI ID:1735092

Related Subjects

97 MATHEMATICS AND COMPUTING

Using new edges for anomaly detection in computer networks

Citation Formats

References (14)

Similar Records

Related Subjects