Securing a network
AssigneePacketSled, Inc.
InventorIgor Mezic
Life of this patent
Estimating the term…
Abstract
Methods and systems for visualizing, analyzing, archiving and securing computer and internet of things (IoT) data networks are disclosed. The system includes a data collection device (sensor), preprocessing unit, analysis unit containing at least the Koopman mode analysis unit, and a postprocessing unit. The methods include Koopman mode analysis, support vector machines or deep learning used to compute the baseline, detect and rank known and unknown threats to the system, visualize and archive them.
Claims20
An apparatus comprising a non-volatile machine-readable medium storing a program having instructions which when executed by a processor will cause the processor to enhance security of a data network, the instructions of the program for:
- decomposing a stream of flow objects from a plurality of data collection devices coupled to the data network into components that are at least one of (a) oscillating, (b) exponentially growing, (c) exponentially decaying, (d) mean, or (e) stochastic;
- sorting the components into categories including at least normal, anomalous known and anomalous unknown, wherein the normal category is indicative of normal behavior in the corresponding flow objects, the anomalous known category is indicative of anomalous behavior in the corresponding flow objects having a known cause, and the anomalous unknown category is indicative of anomalous behavior in the corresponding flow objects having an unknown cause;
- and
- allowing network activity associated with normal behavior, and interdicting network activity associated with anomalous known behavior or anomalous unknown behavior;
- wherein the flow objects each comprise a single alphanumeric value or a set of alphanumeric values collected from the plurality of data collection devices over time.
A system for processing network data that consists of at least two devices where at least one of the devices is sending data over a physical or wireless connection to the other, the system comprising:
- a data collection device for collecting a stream of flow objects from a plurality of data collection devices coupled to the data network;
- a preprocessing unit containing at least a Koopman mode analysis unit for decomposing the stream of flow objects into components that are at least one of (a) oscillating, (b) exponentially growing, (c) exponentially decaying, (d) mean, or (e) stochastic;
- an analysis unit for sorting the components into categories including normal, anomalous known and anomalous unknown, wherein the normal category is indicative of normal behavior in the corresponding flow objects, the anomalous known category is indicative of anomalous behavior in the corresponding flow objects having a known cause, and the anomalous unknown category is indicative of anomalous behavior in the corresponding flow objects having an unknown cause;
- and
- a postprocessing unit for allowing network activity associated with normal behavior, and interdicting network activity associated with anomalous known behavior or anomalous unknown behavior.
A method of securing a data network using a programmed data processing apparatus, the programmed data processing apparatus comprising a processor and memory, the method comprising the processor performing steps according to a program including:
- creating a system baseline comprising:
- collecting a plurality of traffic matrix data over a time period;
- aggregating the plurality of traffic matrix data over a specified time interval into aggregated data;
- creating a Koopman mode representation of the aggregated data;
- computing a residual by comparing the Koopman mode representation and the aggregated data;
- creating the system baseline out of the Koopman mode representation and the residual, wherein the system baseline categorizes each of the traffic matrix data of the plurality of traffic matrix data as one of normal, anomalous known or anomalous unknown;
- and
- allowing network activity associated with normal behavior, and interdicting network activity associated with anomalous known behavior or anomalous unknown behavior.
Dependencies are inferred from the claim text.