# US 10,122,741 B2 · Non-harmful insertion of data mimicking computer network attacks

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,122,741 B2
- Document ID: US10122741B2
- Status: Granted
- Kind: B2
- Application number: 15/165,036
- Filed: 2016-05-26
- Published: 2016-09-22
- Granted: 2018-11-06
- Earliest claimed: 2012-03-22
- Assignees: Los Alamos National Security, LLC
- Applicants: Los Alamos National Security, LLC
- Inventors: Joshua Neil; Alexander Kent; Curtis Hash, Jr.; Michael Fisk; Alexander Brugh; Curtis Storlie; Benjamin Uphoff
- Web page: https://patentgrep.com/patent/US10122741B2

## CPC

- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- G06N 5/02: Knowledge representation; Symbolic representation
- G06N 5/022: Knowledge engineering; Knowledge acquisition
- G06N 5/045: Explanation of inference; Explainable artificial intelligence [XAI]; Interpretable artificial intelligence
- G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks
- H04L 1/002: {Algorithms with memory of the previous states, e.g. Markovian models}
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1433: {Vulnerability analysis}
- G06F 21/577: {Assessing vulnerabilities and evaluating computer system security}
- H04L 2463/144: Detection or countermeasures against botnets
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Non-harmful data mimicking computer network attacks may be inserted in a computer network. Anomalous real network connections may be generated between a plurality of computing systems in the network. Data mimicking an attack may also be generated. The generated data may be transmitted between the plurality of computing systems using the real network connections and measured to determine whether an attack is detected.

## Claims

### Claim 1

A computer-implemented method, comprising:
determining based on historical data, by a computing system, which anomalous real network connections to generate between a plurality of computing systems in a network to create the anomalous real network connections based on stochastic models, the anomalous real network connections forming a k-path between the plurality of computing systems comprising a plurality of directed edges, each directed edge comprising associated data;
generating, by the plurality of computing systems, the determined anomalous real network connections between the plurality of computing systems in the network and data mimicking an attack; and
transmitting, by the plurality of computing systems, the generated data mimicking the attack between the plurality of computing systems using the determined anomalous real network connections forming respective k-paths, wherein
the k-path is a subgraph of size k that has diameter k, and
k is at least two.

### Claim 2 (depends on 1)

The computer-implemented method of claim 1, wherein the generated data comprises Domain Name Server (“DNS”) traffic that is transmitted in a path comprising computing systems that have never communicated before.

### Claim 3 (depends on 1)

The computer-implemented method of claim 1, wherein the data mimicking the attack is designed to mimic one or more specific types of attacks based on known types of real attacks.

### Claim 4 (depends on 1)

The computer-implemented method of claim 1, further comprising:
building stochastic models, by the computing system, for each directed edge in k-paths of a plurality of the anomalous network connections; and
comparing historical parameters with current parameters in a time window, by the computing system, to determine a level of anomalousness of the k-paths of the plurality of the anomalous network connections.

### Claim 5 (depends on 4)

The computer-implemented method of claim 4, wherein the historical data comprises historical connection patterns between the plurality of computing systems.

### Claim 6 (depends on 1)

The computer-implemented method of claim 1, further comprising:
collecting, by the computing system, the generated data mimicking the attack;
analyzing, by the computing system, the collected data;
determining, by the computing system, whether an attack has occurred based on the collected data; and
verifying, by the computing system, that the attack was correctly detected.

### Claim 7 (depends on 6)

The computer-implemented method of claim 6, further comprising:
providing output of results, by the computing system, indicating effectiveness of the verification.

### Claim 8

A computer program embodied on a non-transitory computer-readable medium, the computer program configured to cause at least one processor to:
determine, based on historical data, which network connections to generate that form a k-path between a plurality of computing systems to create an anomaly by applying stochastic models for each edge in the k-path;
generate the determined network connections in the k-path and data mimicking an attack to create the anomaly; and
transmit the generated data mimicking the attack between the plurality of computing systems using the determined anomalous real network connections forming the k-path, wherein
the k-path is a subgraph of size k that has diameter k, and
k is at least two.

### Claim 9 (depends on 8)

The computer program of claim 8, the program further configured to cause the at least one processor to:
verify that a data collection mechanism for the network actually measured data pertaining to the generated connections; and
provide output of results indicating a degree of success or failure of the verification.

### Claim 10 (depends on 8)

The computer program of claim 8, wherein the network anomaly is designed to mimic one or more specific types of attacks based on known types of real attacks.

### Claim 11 (depends on 8)

The computer program of claim 8, wherein the generated data comprises Domain Name Server (“DNS”) traffic that is transmitted in a path comprising computing systems that have never communicated before.

### Claim 12 (depends on 8)

The computer program of claim 8, the program further configured to cause the at least one processor to:
build stochastic models for each directed edge in the k-paths of a plurality of the determined network connections; and
compare historical parameters with current parameters in a time window to determine a level of anomalousness of the k-paths of the plurality of the determined network connections.

### Claim 13 (depends on 8)

The computer program of claim 8, wherein the historical data comprises historical connection patterns between the plurality of computing systems.

### Claim 14

A computer-implemented method, comprising:
inserting, by a plurality of computing systems, traffic in a k-path in a network comprising computing systems that do not normally communicate, the traffic deviating from stochastic models for each edge of the k-path;
detecting the inserted k-path as anomalous, by a computing system, based on analysis of the inserted traffic;
verifying, by the computing system, that an attack was correctly detected based on the detected inserted k-path; and
providing output of results, by the computing system, indicating a degree of success or failure of the verification, wherein
the k-path comprises a plurality of directed edges, each directed edge comprising associated data,
the k-path is a subgraph of size k that has diameter k, and
k is at least two.

### Claim 15 (depends on 14)

The computer-implemented method of claim 14, wherein the inserted traffic is designed to mimic one or more specific types of attacks based on known types of real attacks.

### Claim 16 (depends on 14)

The computer-implemented method of claim 14, further comprising:
building stochastic models, by the computing system, for each directed edge in the k-path; and
comparing historical parameters with current parameters in a time window, by the computing system, to determine a level of anomalousness of the k-path.

### Claim 17 (depends on 14)

The computer-implemented method of claim 14, further comprising:
determining based on historical data, by the computing system, which traffic to insert between the computing systems to create an anomaly, wherein
the historical data comprises historical connection patterns between the plurality of computing systems.

### Claim 18

A computer program embodied on a non-transitory computer-readable medium, the computer program configured to cause at least one processor to:
determine, based on historical data, which network connections to generate that form a k-path between a plurality of computing systems to create an anomaly by applying stochastic models for each edge in the k-path;
generate the determined network connections in the k-path to create the anomaly;
verify that a data collection mechanism for the network actually measured data pertaining to the generated connections; and
provide output of results indicating a degree of success or failure of the verification, wherein
the k-path is a subgraph of size k that has diameter k, and
k is at least two.

### Claim 19 (depends on 18)

The computer program of claim 18, wherein the network anomaly is designed to mimic one or more specific types of attacks based on known types of real attacks.

### Claim 20 (depends on 18)

The computer program of claim 18, wherein the generated data comprises Domain Name Server (“DNS”) traffic that is transmitted in a path comprising computing systems that have never communicated before.

### Claim 21 (depends on 18)

The computer program of claim 18, the program further configured to cause the at least one processor to:
build stochastic models for each directed edge in the k-paths of a plurality of the determined network connections; and
compare historical parameters with current parameters in a time window to determine a level of anomalousness of the k-paths of the plurality of the determined network connections.

### Claim 22 (depends on 18)

The computer program of claim 18, wherein the historical data comprises historical connection patterns between the plurality of computing systems.

### Claim 23

A computer program embodied on a non-transitory computer-readable medium, the computer program configured to cause at least one processor to:
determine, based on historical data, which network connections to generate that form a k-path between a plurality of computing systems to create an anomaly by applying stochastic models for each edge in the k-path;
build stochastic models for each directed edge in the k-paths of a plurality of the determined network connections;
compare historical parameters with current parameters in a time window to determine a level of anomalousness of the k-paths of the plurality of the determined network connections; and
generate the determined network connections in the k-path to create the anomaly, wherein
the k-path is a subgraph of size k that has diameter k, and
k is at least two.

### Claim 24 (depends on 23)

The computer program of claim 23, the program further configured to cause the at least one processor to:
verify that a data collection mechanism for the network actually measured data pertaining to the generated connections; and
provide output of results indicating a degree of success or failure of the verification.

### Claim 25 (depends on 23)

The computer program of claim 23, wherein the network anomaly is designed to mimic one or more specific types of attacks based on known types of real attacks.

### Claim 26 (depends on 23)

The computer program of claim 23, wherein the generated data comprises Domain Name Server (“DNS”) traffic that is transmitted in a path comprising computing systems that have never communicated before.

### Claim 27 (depends on 23)

The computer program of claim 23, wherein the historical data comprises historical connection patterns between the plurality of computing systems.

### Claim 28

A computer-implemented method, comprising:
inserting, by a plurality of computing systems, traffic in a k-path in a network comprising computing systems that do not normally communicate, the traffic deviating from stochastic models for each edge of the k-path;
building stochastic models, by the computing system, for each directed edge in the k-path; and
comparing historical parameters with current parameters in a time window, by the computing system, to determine a level of anomalousness of the k-path; and
detecting the inserted k-path as anomalous, by a computing system, based on analysis of the inserted traffic, wherein
the k-path comprises a plurality of directed edges, each directed edge comprising associated data,
the k-path is a subgraph of size k that has diameter k, and
k is at least two.

### Claim 29 (depends on 28)

The computer-implemented method of claim 28, further comprising:
verifying, by the computing system, that an attack was correctly detected based on the detected inserted k-path; and
providing output of results, by the computing system, indicating a degree of success or failure of the verification.

### Claim 30 (depends on 28)

The computer-implemented method of claim 28, wherein the inserted traffic is designed to mimic one or more specific types of attacks based on known types of real attacks.

### Claim 31 (depends on 28)

The computer-implemented method of claim 28, further comprising:
determining based on historical data, by the computing system, which traffic to insert between the computing systems to create an anomaly, wherein
the historical data comprises historical connection patterns between the plurality of computing systems.

### Claim 32

A computer-implemented method, comprising:
determining based on historical data, by the computing system, which traffic to insert between the computing systems to create an anomaly;
inserting, by a plurality of computing systems, traffic in a k-path in a network comprising computing systems that do not normally communicate, the traffic deviating from stochastic models for each edge of the k-path;
detecting the inserted k-path as anomalous, by a computing system, based on analysis of the inserted traffic, wherein
the k-path comprises a plurality of directed edges, each directed edge comprising associated data,
the k-path is a subgraph of size k that has diameter k,
k is at least two, and
the historical data comprises historical connection patterns between the plurality of computing systems.

### Claim 33 (depends on 32)

The computer-implemented method of claim 32, further comprising:
verifying, by the computing system, that an attack was correctly detected based on the detected inserted k-path; and
providing output of results, by the computing system, indicating a degree of success or failure of the verification.

### Claim 34 (depends on 32)

The computer-implemented method of claim 32, wherein the inserted traffic is designed to mimic one or more specific types of attacks based on known types of real attacks.

### Claim 35 (depends on 32)

The computer-implemented method of claim 32, further comprising:
building stochastic models, by the computing system, for each directed edge in the k-path; and
comparing historical parameters with current parameters in a time window, by the computing system, to determine a level of anomalousness of the k-path.