Apparatus having engine using artificial intelligence for detecting anomalies in a computer network

An apparatus for processing data from a network, the apparatus comprising:

• a router device coupled to the network;
• a switch device coupled to the router device, the switch comprising a switch port analyzer (SPAN) or test access point (TAP);
• a message broker module coupled to a data source, the message broker module being configured to direct data in a netflow format to one or more processing engines for analysis of an anomaly in the data, the message broker module comprising an input port coupled to either the SPAN or TAP, the netflow format comprising:
• a source IP address;
• a destination IP address;
• an IP protocol;
• a source port for UDP or TCP, or other protocols;
• a destination port for UDP or TCP, or other protocols;
• an IP type of service;
• a first processing engine coupled to the message broker module, the first processing engine comprising:
• a data feeder;
• a Random Forest processor coupled to the data feeder;
• an Adaboost processor coupled to the data feeder;
• and
• a Naive Bayes Decision Tree processor coupled to the data feeder such that the Random Forest processor, the Adaboot processor, and the Naïve Bayes Decision Tree processor are arranged in parallel and configured to receive data from the data feeder to perform the analysis of the anomaly in the data and produce a result information;
• and
• a memory resource coupled to each of the Random Forest processor, the Adaboost processor, and the Naïve Bayes Decision Tree processor, the memory resource comprising storage resources to store the result information associated with the anomaly in the data.

An apparatus for processing data from a network, the apparatus comprising:

• a router device coupled to the network;
• a switch device coupled to the router device, the switch comprising a switch port analyzer (SPAN) or test access point (TAP);
• a message broker module coupled to a data source, the message broker module being configured to direct data in a netflow format to one or more processing engines for analysis of an anomaly in the data, the message broker module comprising an input port coupled to either the SPAN or TAP, the netflow format comprising:
• a source IP address;
• a destination IP address;
• an IP protocol;
• a source port for UDP or TCP, or other protocols;
• a destination port for UDP or TCP, or other protocols;
• an IP type of service;
• a first processing engine coupled to the message broker module, the first processing engine comprising:
• a data feeder;
• a Random Forest processor coupled to the data feeder;
• an Adaboost processor coupled to the data feeder;
• and
• a Naive Bayes Decision Tree processor coupled to the data feeder such that the Random Forest processor, the Adaboot processor, and the Naïve Bayes Decision Tree processor are arranged in parallel and configured to receive data from the data feeder to perform the analysis of the anomaly in the data and produce a result information;
• and
• a memory resource coupled to each of the Random Forest processor, the Adaboost processor, and the Naïve Bayes Decision Tree processor, the memory resource comprising storage resources to store the result information associated with the anomaly in the data;
• a fifth processing engine comprising a Bayesian Network process coupled to the message broker module and coupled to each of an output of the Random Forest processor, the Adaboost processor, and the Naïve Bayes Decision Tree processor and configured to use the result information to train the fifth processing engine, the fifth processing engine configured to:
• collect a plurality of streaming packets from the message broker module for training the fifth processing engine for a predetermined amount of time or packets;
• collect the result information associated with the anomaly from the first processing engine during the predetermined amount of time or packets;
• discard the result information associated with the anomaly once the fifth processing engine has been trained;
• learn a dependency graph of the each of the protocols comprising TCP, UDP, or ICMP;
• learn one or more parameters for each of the protocols dependency graphs to form a prediction on incoming streaming packets, and performing training cycles that are iterated for a predetermined number of cycles;
• upon completing a predetermined number of training cycles that are iterated, and the fifth processing engine comprising the Bayesian Network process is updated with a predetermined score;
• process incoming streaming packets to detect whether a packet is in a normal state or an anomaly;
• and
• store information associated with the packet as the normal state or the anomaly in the memory resource;
• and
• a parallel arrangement of processing information with the fifth processing engine and the first processing engine to concurrently process the plurality of streaming packets with the fifth processing engine and process data in the netflow format with the first processing engine.