Non-harmful insertion of data mimicking computer network attacks

A computer program embodied on a non-transitory computer-readable medium, the computer program configured to cause at least one processor to:

• determine, based on historical data, which network connections to generate that form a k-path between a plurality of computing systems to create an anomaly by applying stochastic models for each edge in the k-path;
• generate the determined network connections in the k-path and data mimicking an attack to create the anomaly;
• and
• transmit the generated data mimicking the attack between the plurality of computing systems using the determined anomalous real network connections forming the k-path, wherein
• the k-path is a subgraph of size k that has diameter k, and
• k is at least two.

A computer-implemented method, comprising:

• inserting, by a plurality of computing systems, traffic in a k-path in a network comprising computing systems that do not normally communicate, the traffic deviating from stochastic models for each edge of the k-path;
• detecting the inserted k-path as anomalous, by a computing system, based on analysis of the inserted traffic;
• verifying, by the computing system, that an attack was correctly detected based on the detected inserted k-path;
• and
• providing output of results, by the computing system, indicating a degree of success or failure of the verification, wherein
• the k-path comprises a plurality of directed edges, each directed edge comprising associated data,
• the k-path is a subgraph of size k that has diameter k, and
• k is at least two.

A computer program embodied on a non-transitory computer-readable medium, the computer program configured to cause at least one processor to:

• determine, based on historical data, which network connections to generate that form a k-path between a plurality of computing systems to create an anomaly by applying stochastic models for each edge in the k-path;
• generate the determined network connections in the k-path to create the anomaly;
• verify that a data collection mechanism for the network actually measured data pertaining to the generated connections;
• and
• provide output of results indicating a degree of success or failure of the verification, wherein
• the k-path is a subgraph of size k that has diameter k, and
• k is at least two.

A computer program embodied on a non-transitory computer-readable medium, the computer program configured to cause at least one processor to:

• determine, based on historical data, which network connections to generate that form a k-path between a plurality of computing systems to create an anomaly by applying stochastic models for each edge in the k-path;
• build stochastic models for each directed edge in the k-paths of a plurality of the determined network connections;
• compare historical parameters with current parameters in a time window to determine a level of anomalousness of the k-paths of the plurality of the determined network connections;
• and
• generate the determined network connections in the k-path to create the anomaly, wherein
• the k-path is a subgraph of size k that has diameter k, and
• k is at least two.

A computer-implemented method, comprising:

• inserting, by a plurality of computing systems, traffic in a k-path in a network comprising computing systems that do not normally communicate, the traffic deviating from stochastic models for each edge of the k-path;
• building stochastic models, by the computing system, for each directed edge in the k-path;
• and
• comparing historical parameters with current parameters in a time window, by the computing system, to determine a level of anomalousness of the k-path;
• and
• detecting the inserted k-path as anomalous, by a computing system, based on analysis of the inserted traffic, wherein
• the k-path comprises a plurality of directed edges, each directed edge comprising associated data,
• the k-path is a subgraph of size k that has diameter k, and
• k is at least two.

A computer-implemented method, comprising:

• determining based on historical data, by the computing system, which traffic to insert between the computing systems to create an anomaly;
• inserting, by a plurality of computing systems, traffic in a k-path in a network comprising computing systems that do not normally communicate, the traffic deviating from stochastic models for each edge of the k-path;
• detecting the inserted k-path as anomalous, by a computing system, based on analysis of the inserted traffic, wherein
• the k-path comprises a plurality of directed edges, each directed edge comprising associated data,
• the k-path is a subgraph of size k that has diameter k,
• k is at least two, and
• the historical data comprises historical connection patterns between the plurality of computing systems.