Fingerprint merging and risk level evaluation for network anomaly detection

An apparatus, comprising:

• one or more network interfaces to communicate with a network;
• a processor coupled to the network interfaces and configured to execute one or more processes;
• and a memory configured to store a process executable by the processor, the process when executed configured to:
• receive two or more different fingerprints of two or more network anomalies detected in the network by different anomaly detectors at different computing levels, wherein each fingerprint of the two or more different fingerprints comprises a hash of tags that describe a detected anomaly;
• associate the fingerprints with network records captured within a timeframe in which the two or more network anomalies were detected, wherein the network records comprise 6-tuples, wherein each 6-tuple indicates a source address of a traffic flow, a source port of the traffic flow, a destination address of the traffic flow, a destination port of the traffic flow, a protocol used to convey the traffic flow, and an application associated with the traffic flow;
• compare the fingerprints associated with the network records to determine that the two or more detected anomalies are part of a singular anomaly event;
• merge the fingerprints associated with the network records that are determined to be part of the singular anomaly into a single fingerprint that describes the singular anomaly;
• computing, by the device, at least one of a plurality risk metrics associated with the singular anomaly event, wherein the least one of the plurality of risk metrics is dynamically updated based on anomaly event feedback;
• and generate a notification regarding the singular anomaly event;
• and a mitigation action, wherein the notification includes those of the fingerprints that are associated with the singular anomaly event and wherein the mitigation action to be enforced dynamically changes based on the update of the at least one of the plurality of risk metrics.

A tangible, non-transitory, computer-readable media having software encoded thereon, the software when executed by a processor configured to:

• receive two or more different fingerprints of two or more network anomalies detected in the network by different anomaly detectors at different computing levels, wherein each fingerprint of the two or more different fingerprints comprises a hash of tags that describe a detected anomaly;
• associate the fingerprints with network records captured within a timeframe in which the two or more network anomalies were detected;
• compare the fingerprints associated with the network records to determine that the two or more detected anomalies are part of a singular anomaly event, wherein the network records comprise 6-tuples, wherein each 6-tuple indicates a source address of a traffic flow, a source port of the traffic flow, a destination address of the traffic flow, a destination port of the traffic flow, a protocol used to convey the traffic flow, and an application associated with the traffic flow;
• merge the fingerprints associated with the network records that are determined to be part of the singular anomaly into a single fingerprint that describes the singular anomaly;
• computing, by the device, at least one of a plurality risk metrics associated with the singular anomaly event, wherein the least one of the plurality of risk metrics is dynamically updated based on anomaly event feedback;
• and generate a notification regarding the singular anomaly event;
• and a mitigation action, wherein the notification includes those of the fingerprints that are associated with the singular anomaly event and wherein the mitigation action to be enforced dynamically changes based on the update of the at least one of the plurality of risk metrics.