Real-time detection and classification of anomalous events in streaming data
Abstract
A system is described for receiving a stream of events and scoring the events based on anomalousness and maliciousness (or other classification). The events can be displayed to a user in user-defined groupings in an animated fashion. The system can include a plurality of anomaly detectors that together implement an algorithm to identify low probability events and detect atypical traffic patterns. The atypical traffic patterns can then be classified as being of interest or not. In one particular example, in a network environment, the classification can be whether the network traffic is malicious or not.
- Inventors:
- Issue Date:
- Research Org.:
- Oak Ridge National Laboratory (ORNL), Oak Ridge, TN (United States)
- Sponsoring Org.:
- USDOE
- OSTI Identifier:
- 1247988
- Patent Number(s):
- 9319421
- Application Number:
- 14/053,248
- Assignee:
- UT-Battelle, LLC (Oak Ridge, TN)
- Patent Classifications (CPCs):
-
H - ELECTRICITY H04 - ELECTRIC COMMUNICATION TECHNIQUE H04L - TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- DOE Contract Number:
- AC05-00OR22725
- Resource Type:
- Patent
- Resource Relation:
- Patent File Date: 2013 Oct 14
- Country of Publication:
- United States
- Language:
- English
- Subject:
- 97 MATHEMATICS AND COMPUTING; 99 GENERAL AND MISCELLANEOUS
Citation Formats
Ferragut, Erik M., Goodall, John R., Iannacone, Michael D., Laska, Jason A., and Harrison, Lane T. Real-time detection and classification of anomalous events in streaming data. United States: N. p., 2016.
Web.
Ferragut, Erik M., Goodall, John R., Iannacone, Michael D., Laska, Jason A., & Harrison, Lane T. Real-time detection and classification of anomalous events in streaming data. United States.
Ferragut, Erik M., Goodall, John R., Iannacone, Michael D., Laska, Jason A., and Harrison, Lane T. Tue .
"Real-time detection and classification of anomalous events in streaming data". United States. https://www.osti.gov/servlets/purl/1247988.
@article{osti_1247988,
title = {Real-time detection and classification of anomalous events in streaming data},
author = {Ferragut, Erik M. and Goodall, John R. and Iannacone, Michael D. and Laska, Jason A. and Harrison, Lane T.},
abstractNote = {A system is described for receiving a stream of events and scoring the events based on anomalousness and maliciousness (or other classification). The events can be displayed to a user in user-defined groupings in an animated fashion. The system can include a plurality of anomaly detectors that together implement an algorithm to identify low probability events and detect atypical traffic patterns. The atypical traffic patterns can then be classified as being of interest or not. In one particular example, in a network environment, the classification can be whether the network traffic is malicious or not.},
doi = {},
journal = {},
number = ,
volume = ,
place = {United States},
year = {Tue Apr 19 00:00:00 EDT 2016},
month = {Tue Apr 19 00:00:00 EDT 2016}
}
Save to My Library
You must Sign In or Create an Account in order to save documents to your library.
Works referenced in this record:
Integration of Self-Organizing Map (SOM) and Kernel Density Estimation (KDE) for network intrusion detection
conference, September 2009
- Cao, Yuan; He, Haibo; Man, Hong
- SPIE Europe Security + Defence, SPIE Proceedings
Anomaly detection: A survey
journal, July 2009
- Chandola, Varun; Banerjee, Arindam; Kumar, Vipin
- ACM Computing Surveys, Vol. 41, Issue 3, p. 1-58
VAST Challenge 2012: Visual analytics for big data
conference, October 2012
- Cook, Kristin; Grinstein, Georges; Whiting, Mark
- 2012 IEEE Conference on Visual Analytics Science and Technology (VAST)
An Intrusion-Detection Model
journal, February 1987
- Denning, D. E.
- IEEE Transactions on Software Engineering, Vol. SE-13, Issue 2
Method and apparatus for detecting malicious code in an information handling system
patent, June 2010
- Obrecht, Mark; Alagna, Michael Tony; Payne, Andy
- US Patent Document 7,748,039
Computer-implemented modeling systems and methods for analyzing and predicting computer network intrusions
patent, September 2011
- Wu, Lizhong; Barker, Terrance Gordon; Desai, Vijay S.
- US Patent Document 8,015,133
Statistical method and system for network anomaly detection
patent, December 2013
- Mullarkey, Peter; Johns, Michael Charles
- US Patent Document 8,601,575