Complementary workflows for identifying one-hop network behavior and multi-hop network dependencies
Abstract
A network analysis tool evaluates network flow information in complementary workflows to identify one-hop behavior of network assets and also identify multi-hop dependencies between network assets. In one workflow (e.g., using association rule learning), the network analysis tool can identify significant one-hop communication patterns to and/or from network assets, taken individually. Based on the identified one-hop behavior, the network analysis tool can discover patterns of similar communication among different network assets, which can inform decisions about deploying patch sets, mitigating damage, configuring a system, or detecting anomalous behavior. In a different workflow (e.g., using deep learning or cross-correlation analysis), the network analysis tool can identify significant multi-hop communication patterns that involve network assets in combination. Based on the identified multi-hop dependencies, the network analysis tool can discover functional relationships between network assets, which can inform decisions about configuring a system, managing critical network assets, or protecting critical network assets.
- Inventors:
- Issue Date:
- Research Org.:
- Pacific Northwest National Lab. (PNNL), Richland, WA (United States)
- Sponsoring Org.:
- USDOE
- OSTI Identifier:
- 1650839
- Patent Number(s):
- 10637744
- Application Number:
- 15/486,162
- Assignee:
- Battelle Memorial Institute (Richland, WA)
- Patent Classifications (CPCs):
-
H - ELECTRICITY H04 - ELECTRIC COMMUNICATION TECHNIQUE H04L - TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- DOE Contract Number:
- AC05-76RL01830
- Resource Type:
- Patent
- Resource Relation:
- Patent File Date: 04/12/2017
- Country of Publication:
- United States
- Language:
- English
- Subject:
- 97 MATHEMATICS AND COMPUTING
Citation Formats
Carroll, Thomas E., Chikkagoudar, Satish, Arthur-Durett, Kristine M., and Thomas, Dennis G. Complementary workflows for identifying one-hop network behavior and multi-hop network dependencies. United States: N. p., 2020.
Web.
Carroll, Thomas E., Chikkagoudar, Satish, Arthur-Durett, Kristine M., & Thomas, Dennis G. Complementary workflows for identifying one-hop network behavior and multi-hop network dependencies. United States.
Carroll, Thomas E., Chikkagoudar, Satish, Arthur-Durett, Kristine M., and Thomas, Dennis G. Tue .
"Complementary workflows for identifying one-hop network behavior and multi-hop network dependencies". United States. https://www.osti.gov/servlets/purl/1650839.
@article{osti_1650839,
title = {Complementary workflows for identifying one-hop network behavior and multi-hop network dependencies},
author = {Carroll, Thomas E. and Chikkagoudar, Satish and Arthur-Durett, Kristine M. and Thomas, Dennis G.},
abstractNote = {A network analysis tool evaluates network flow information in complementary workflows to identify one-hop behavior of network assets and also identify multi-hop dependencies between network assets. In one workflow (e.g., using association rule learning), the network analysis tool can identify significant one-hop communication patterns to and/or from network assets, taken individually. Based on the identified one-hop behavior, the network analysis tool can discover patterns of similar communication among different network assets, which can inform decisions about deploying patch sets, mitigating damage, configuring a system, or detecting anomalous behavior. In a different workflow (e.g., using deep learning or cross-correlation analysis), the network analysis tool can identify significant multi-hop communication patterns that involve network assets in combination. Based on the identified multi-hop dependencies, the network analysis tool can discover functional relationships between network assets, which can inform decisions about configuring a system, managing critical network assets, or protecting critical network assets.},
doi = {},
journal = {},
number = ,
volume = ,
place = {United States},
year = {2020},
month = {4}
}
Works referenced in this record:
Detecting Transparent Network Communication Interception Appliances
patent-application, September 2013
- Branch, Joel W.; Nidd, Michael E.; Rissman, Ruediger
- US Patent Application 13/418761; 20130246606