Title: Using new edges for anomaly detection in computer networks

Abstract

Creation of new edges in a network may be used as an indication of a potential attack on the network. Historical data of a frequency with which nodes in a network create and receive new edges may be analyzed. Baseline models of behavior among the edges in the network may be established based on the analysis of the historical data. A new edge that deviates from a respective baseline model by more than a predetermined threshold during a time window may be detected. The new edge may be flagged as potentially anomalous when the deviation from the respective baseline model is detected. Probabilities for both new and existing edges may be obtained for all edges in a path or other subgraph. The probabilities may then be combined to obtain a score for the path or other subgraph. A threshold may be obtained by calculating an empirical distribution of the scores under historical conditions.

Inventors:

Neil, Joshua Charles

Issue Date:

2015-05-19

Research Org.:

Los Alamos National Lab. (LANL), Los Alamos, NM (United States)

Sponsoring Org.:

USDOE

OSTI Identifier:

1179789

Patent Number(s):

9038180

Application Number:

13/826,995

Assignee:

Los Alamos National Security, LLC (Los Alamos, NM)

Patent Classifications (CPCs):

G - PHYSICS G06 - COMPUTING G06F - ELECTRIC DIGITAL DATA PROCESSING

H - ELECTRICITY H04 - ELECTRIC COMMUNICATION TECHNIQUE H04L - TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION

Show more

G - PHYSICS G06 - COMPUTING G06F - ELECTRIC DIGITAL DATA PROCESSING

G06F21/577 - {Assessing vulnerabilities and evaluating computer system security}

H - ELECTRICITY H04 - ELECTRIC COMMUNICATION TECHNIQUE H04L - TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION

H04L2463/144 - Detection or countermeasures against botnets
H04L63/1408 - {by monitoring network traffic

G - PHYSICS G06 - COMPUTING G06N - COMPUTER SYSTEMS BASED ON SPECIFIC COMPUTATIONAL MODELS

G06N5/045 - {Explanation of inference steps}
G06N5/02 - Knowledge representation

H - ELECTRICITY H04 - ELECTRIC COMMUNICATION TECHNIQUE H04L - TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION

H04L63/1416 - {Event detection, e.g. attack signature detection}

G - PHYSICS G06 - COMPUTING G06N - COMPUTER SYSTEMS BASED ON SPECIFIC COMPUTATIONAL MODELS

G06N7/005 - {Probabilistic networks}
G06N5/022 - {Knowledge engineering

H - ELECTRICITY H04 - ELECTRIC COMMUNICATION TECHNIQUE H04L - TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION

H04L63/1433 - {Vulnerability analysis}
H04L1/002 - {Algorithms with memory of the previous states, e.g. Markovian models}
H04L63/1425 - {Traffic logging, e.g. anomaly detection}

Show less

DOE Contract Number:  

AC52-06NA25396

Resource Type:

Patent

Resource Relation:

Patent File Date: 2013 Mar 14

Country of Publication:

United States

Language:

English

Subject:

97 MATHEMATICS AND COMPUTING