Securing a network

A system for processing network data that consists of at least two devices where at least one of the devices is sending data over a physical or wireless connection to the other, the system comprising:

• a data collection device for collecting a stream of flow objects from a plurality of sensors coupled to the data network, wherein the stream of flow objects consists of a finite dimensional nonlinear system;
• a preprocessing unit containing at least a Koopman mode analysis unit for decomposing the stream of flow objects into components that are at least one of (a) oscillating, (b) exponentially growing, (c) exponentially decaying, (d) mean, and (e) stochastic, wherein decomposing the stream of flow objects comprises transforming the finite dimensional nonlinear system to an infinite linear set;
• an analysis unit for sorting the components into categories including normal, anomalous known and anomalous unknown, wherein the normal category is indicative of normal behavior in the corresponding flow objects, the anomalous known category is indicative of anomalous behavior in the corresponding flow objects having a known cause, and the anomalous unknown category is indicative of anomalous behavior in the corresponding flow objects having an unknown cause;
• and
• a postprocessing unit for allowing network activity associated with normal behavior, and interdicting network activity associated with anomalous known behavior or anomalous unknown behavior.

A method of securing a data network using a programmed data processing apparatus, the programmed data processing apparatus comprising a processor and memory, the method comprising the processor performing steps according to a program including:

• creating a system baseline comprising:
• collecting a first plurality of traffic matrix data over a first time period;
• aggregating the first plurality of traffic matrix data over a specified time interval into first aggregated data;
• creating a first Koopman mode representation of the first aggregated data;
• computing a first residual by comparing the first Koopman mode representation and the first aggregated data;
• creating the system baseline out of the first Koopman mode representation and the first residual, wherein the system baseline categorizes each of the traffic matrix data of the first plurality of traffic matrix data as one of normal, anomalous known or anomalous unknown;
• creating a sample baseline comprising:
• collecting a second plurality of traffic matrix data over a second time period;
• aggregating the second plurality of traffic matrix data over a specified time interval into second aggregated data;
• creating a second Koopman mode representation of the second aggregated data;
• computing a second residual by comparing the second Koopman mode representation and the second aggregated data;
• creating a second data representation out of the second Koopman mode representation and the second residual, wherein the sample baseline categorizes each of the traffic matrix data of the second plurality of traffic matrix data as one of normal, anomalous known or anomalous unknown;
• computing a difference of the sample baseline and the system baseline;
• based on the difference between the system baseline and the sample baseline, updating the system baseline;
• and
• allowing network activity associated with normal behavior, and interdicting network activity associated with anomalous known behavior or anomalous unknown behavior.