Detecting anomalous network device activity
AssigneeRapid7, Inc.
InventorDustin Myers
Life of this patent
Estimating the term…
Abstract
Methods and systems for detecting anomalous network device activity. The system may include an interface for receiving an identification label associated with a host device and pre-existing traffic data associated with the host device. The system may further detect that the pre-existing traffic data associated with the host device is anomalous based on the identification label. The system may then issue an alert upon detecting that the pre-existing traffic data associated with the host device is anomalous.
Claims14
A method for detecting anomalous network device activity, the method comprising:
- receiving, using an interface, pre-existing traffic data associated with a host device;
- analyzing, using a processor executing instructions stored on a memory, the pre-existing traffic data associated with the host device;
- assigning, using the processor, an identification label to the host device based on the pre-existing traffic data;
- assigning an expected behavioral parameter to the host device based on the identification label;
- detecting the pre-existing traffic data deviates from the expected behavioral parameter;
- classifying the pre-existing traffic data as anomalous based on the data deviating from the expected behavioral parameter;
- and
- issuing, using the processor, an alert upon classifying the pre-existing traffic data associated with the host device as anomalous.
A system for detecting anomalous network device activity, the system comprising:
- an interface for receiving at least pre-existing traffic data associated with a host device;
- and
- a memory and a processor executing instructions stored on the memory to:
- analyze the pre-existing traffic data associated with the host device;
- assign an identification label to the host device based on the pre-existing traffic data;
- assign an expected behavioral parameter to the host device based on the identification label;
- detect the pre-existing traffic data deviates from the expected behavioral parameter;
- classify the pre-existing traffic data as anomalous based on the data deviating from the expected behavioral parameter;
- and
- issue an alert upon classifying the pre-existing traffic data associated with the host device as anomalous.
Dependencies are inferred from the claim text.