Title: Path scanning for the detection of anomalous subgraphs and use of DNS requests and host agents for anomaly/change detection and network situational awareness

Abstract

A system, apparatus, computer-readable medium, and computer-implemented method are provided for detecting anomalous behavior in a network. Historical parameters of the network are determined in order to determine normal activity levels. A plurality of paths in the network are enumerated as part of a graph representing the network, where each computing system in the network may be a node in the graph and the sequence of connections between two computing systems may be a directed edge in the graph. A statistical model is applied to the plurality of paths in the graph on a sliding window basis to detect anomalous behavior. Data collected by a Unified Host Collection Agent ("UHCA") may also be used to detect anomalous behavior.

Inventors:

Neil, Joshua Charles; Fisk, Michael Edward; Brugh, Alexander William; Hash, Curtis Lee; Storlie, Curtis Byron; Uphoff, Benjamin; Kent, Alexander

Issue Date:

2017-11-21

Research Org.:

Los Alamos National Laboratory (LANL), Los Alamos, NM (United States)

Sponsoring Org.:

USDOE

OSTI Identifier:

1409817

Patent Number(s):

9825979

Application Number:

15/419,673

Assignee:

Los Alamos National Security, LLC (Los Alamos, NM)

Patent Classifications (CPCs):

G - PHYSICS G06 - COMPUTING G06F - ELECTRIC DIGITAL DATA PROCESSING

G - PHYSICS G06 - COMPUTING G06N - COMPUTER SYSTEMS BASED ON SPECIFIC COMPUTATIONAL MODELS

Show more

G - PHYSICS G06 - COMPUTING G06F - ELECTRIC DIGITAL DATA PROCESSING

G06F21/577 - {Assessing vulnerabilities and evaluating computer system security}

G - PHYSICS G06 - COMPUTING G06N - COMPUTER SYSTEMS BASED ON SPECIFIC COMPUTATIONAL MODELS

G06N5/02 - Knowledge representation
G06N5/022 - {Knowledge engineering
G06N5/045 - {Explanation of inference steps}

H - ELECTRICITY H04 - ELECTRIC COMMUNICATION TECHNIQUE H04L - TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION

H04L1/002 - {Algorithms with memory of the previous states, e.g. Markovian models}
H04L2463/144 - Detection or countermeasures against botnets
H04L63/1408 - {by monitoring network traffic
H04L63/1416 - {Event detection, e.g. attack signature detection}
H04L63/1425 - {Traffic logging, e.g. anomaly detection}
H04L63/1433 - {Vulnerability analysis}

Show less

DOE Contract Number:  

AC52-06NA25396

Resource Type:

Patent

Resource Relation:

Patent File Date: 2017 Jan 30

Country of Publication:

United States

Language:

English

Subject:

97 MATHEMATICS AND COMPUTING