# US 10,320,825 B2 · Fingerprint merging and risk level evaluation for network anomaly detection > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,320,825 B2 - Document ID: US10320825B2 - Status: Granted - Kind: B2 - Application number: 15/072,526 - Filed: 2016-03-17 - Published: 2016-12-01 - Granted: 2019-06-11 - Earliest claimed: 2015-05-27 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Grégory Mermoud; Jean-Philippe Vasseur; Yannick Weibel - Web page: https://patentgrep.com/patent/US10320825B2 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L 63/1458: {Denial of Service} - G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A device in a network receives fingerprints of two or more network anomalies detected in the network by different anomaly detectors. Each fingerprint comprises a hash of tags that describe a detected anomaly. The device associates the fingerprints with network records captured within a timeframe in which the two or more network anomalies were detected. The device compares the fingerprints associated with the network records to determine that the two or more detected anomalies are part of a singular anomaly event. The device generates a notification regarding the singular anomaly event. The notification includes those of the fingerprints that are associated with the singular anomaly event. ## Claims ### Claim 1 A method, comprising: receiving, by a device in a network, two or more different fingerprints associated with two or more network anomalies detected in the network by different anomaly detectors at different computing levels, wherein each fingerprint of the two or more different fingerprints comprises a hash of tags that describe a detected anomaly; associating, by the device, the fingerprints with network records captured within a timeframe in which the two or more network anomalies were detected, wherein the network records comprise 6-tuples, wherein each 6-tuple indicates a source address of a traffic flow, a source port of the traffic flow, a destination address of the traffic flow, a destination port of the traffic flow, a protocol used to convey the traffic flow, and an application associated with the traffic flow; comparing, by the device, the fingerprints associated with the network records to determine that the two or more detected anomalies are part of a singular anomaly event; merging, by the device, the fingerprints associated with the network records that are determined to be part of the singular anomaly into a single fingerprint that describes the singular anomaly; computing, by the device, at least one of a plurality risk metrics associated with the singular anomaly event, wherein the least one of the plurality of risk metrics is dynamically updated based on anomaly event feedback; and generating, by the device, a notification regarding the singular anomaly event and a mitigation action, wherein the notification includes those of the fingerprints that are associated with the singular anomaly event and wherein the mitigation action to be enforced dynamically changes based on the update of the at least one of the plurality of risk metrics. ### Claim 2 (depends on 1) The method as in claim 1, wherein each tag in a fingerprint of a detected anomaly is a binary bit that indicates a specific observation regarding the detected anomaly. ### Claim 3 (depends on 1) The method as in claim 1, further comprising: identifying, by the device, a particular fingerprint from among the fingerprints as inconsistent with the fingerprints that are associated with the singular anomaly event. ### Claim 4 (depends on 1) The method as in claim 1, further comprising: clustering, by the device, the received fingerprints using a statistical model of the co-occurrence probability of fingerprints. ### Claim 5 (depends on 4) The method as in claim 4, wherein the statistical model of the co-occurrence probability of fingerprints comprises a correlation matrix. ### Claim 6 (depends on 4) The method as in claim 4, wherein clustering the received fingerprints using the statistical model comprises: reducing dimensionality of the received fingerprints by analyze the co-occurrence of the tags of the received fingerprints. ### Claim 7 (depends on 1) The method as in claim 1, further comprising: causing a risk metric to be computed for a particular node in the network associated with the singular anomaly event; and enforcing a risk mitigation policy for the particular node based on the risk metric. ### Claim 8 (depends on 1) The method as in claim 1, wherein enforcing the risk mitigation policy comprises one or more of: analyzing traffic associated with the particular node using a finer grained anomaly detector, computing a new anomaly detector to analyze the traffic associated with the particular node, or performing a network policing action on the traffic associated with the particular node. ### Claim 9 (depends on 7) The method as in claim 7, wherein the risk mitigation policy is received via a user interface. ### Claim 10 An apparatus, comprising: one or more network interfaces to communicate with a network; a processor coupled to the network interfaces and configured to execute one or more processes; and a memory configured to store a process executable by the processor, the process when executed configured to: receive two or more different fingerprints of two or more network anomalies detected in the network by different anomaly detectors at different computing levels, wherein each fingerprint of the two or more different fingerprints comprises a hash of tags that describe a detected anomaly; associate the fingerprints with network records captured within a timeframe in which the two or more network anomalies were detected, wherein the network records comprise 6-tuples, wherein each 6-tuple indicates a source address of a traffic flow, a source port of the traffic flow, a destination address of the traffic flow, a destination port of the traffic flow, a protocol used to convey the traffic flow, and an application associated with the traffic flow; compare the fingerprints associated with the network records to determine that the two or more detected anomalies are part of a singular anomaly event; merge the fingerprints associated with the network records that are determined to be part of the singular anomaly into a single fingerprint that describes the singular anomaly; computing, by the device, at least one of a plurality risk metrics associated with the singular anomaly event, wherein the least one of the plurality of risk metrics is dynamically updated based on anomaly event feedback; and generate a notification regarding the singular anomaly event; and a mitigation action, wherein the notification includes those of the fingerprints that are associated with the singular anomaly event and wherein the mitigation action to be enforced dynamically changes based on the update of the at least one of the plurality of risk metrics. ### Claim 11 (depends on 10) The apparatus as in claim 10, wherein each tag in a fingerprint of a detected anomaly is a binary bit that indicates a specific observation regarding the detected anomaly. ### Claim 12 (depends on 10) The apparatus as in claim 10, wherein the process when executed is further configured to: identify a particular fingerprint from among the fingerprints as inconsistent with the fingerprints that are associated with the singular anomaly event. ### Claim 13 (depends on 10) The apparatus as in claim 10, wherein the process when executed is further configured to: cluster the received fingerprints using a statistical model of the co-occurrence probability of fingerprints. ### Claim 14 (depends on 13) The apparatus as in claim 13, wherein the statistical model of the co-occurrence probability of fingerprints comprises a correlation matrix. ### Claim 15 (depends on 10) The apparatus as in claim 10, wherein the process when executed is further configured to: cause a risk metric to be computed for a particular node in the network associated with the singular anomaly event; and enforce a risk mitigation policy for the particular node based on the risk metric. ### Claim 16 (depends on 1) The apparatus as in claim 1, wherein the risk mitigation policy is enforced by one or more of: analyzing traffic associated with the particular node using a finer grained anomaly detector, computing a new anomaly detector to analyze the traffic associated with the particular node, or performing a network policing action on the traffic associated with the particular node. ### Claim 17 A tangible, non-transitory, computer-readable media having software encoded thereon, the software when executed by a processor configured to: receive two or more different fingerprints of two or more network anomalies detected in the network by different anomaly detectors at different computing levels, wherein each fingerprint of the two or more different fingerprints comprises a hash of tags that describe a detected anomaly; associate the fingerprints with network records captured within a timeframe in which the two or more network anomalies were detected; compare the fingerprints associated with the network records to determine that the two or more detected anomalies are part of a singular anomaly event, wherein the network records comprise 6-tuples, wherein each 6-tuple indicates a source address of a traffic flow, a source port of the traffic flow, a destination address of the traffic flow, a destination port of the traffic flow, a protocol used to convey the traffic flow, and an application associated with the traffic flow; merge the fingerprints associated with the network records that are determined to be part of the singular anomaly into a single fingerprint that describes the singular anomaly; computing, by the device, at least one of a plurality risk metrics associated with the singular anomaly event, wherein the least one of the plurality of risk metrics is dynamically updated based on anomaly event feedback; and generate a notification regarding the singular anomaly event; and a mitigation action, wherein the notification includes those of the fingerprints that are associated with the singular anomaly event and wherein the mitigation action to be enforced dynamically changes based on the update of the at least one of the plurality of risk metrics. ### Claim 18 (depends on 17) The computer-readable media as in claim 17, wherein each tag in a fingerprint of a detected anomaly is a binary bit that indicates a specific observation regarding the detected anomaly.