# US 11,444,876 B2 · Method and apparatus for detecting abnormal traffic pattern > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,444,876 B2 - Document ID: US11444876B2 - Status: Granted - Kind: B2 - Application number: 17/120,390 - Filed: 2020-12-14 - Published: 2021-07-01 - Granted: 2022-09-13 - Earliest claimed: 2019-12-31 - Assignees: Ajou University Industry-Academic Cooperation Foundation - Applicants: Ajou University Industry-Academic Cooperation Foundation - Inventors: Tae Shik Shon; Sung Moon Kwon - Web page: https://patentgrep.com/patent/US11444876B2 ## CPC - H04L 41/145: {involving simulating, designing, planning or modelling of a network} - H04L 41/0681: Configuration of triggering conditions - H04L 41/147: for predicting network behaviour - H04L 41/149: for prediction of maintenance - H04L 41/16: using machine learning or artificial intelligence - H04L 43/04: Processing captured monitoring data, e.g. for logfile generation - H04L 43/062: related to network traffic - H04L 43/0882: Utilisation of link capacity - H04L 43/18: Protocol analysers - H04L 47/11: Identifying congestion - H04L 47/127: by using congestion prediction - H04L 43/16: Threshold monitoring - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An operating method of a computing device operated by at least one processor includes collecting traffic packets; extracting particular field data from the traffic packets, transforming the extracted particular field data to a vector with a reduced dimension for each traffic packet, and creating training data with the vector for each traffic packet; training a traffic prediction model with the training data, the traffic prediction model predicting from an input traffic packet a next input traffic packet and whether the next input traffic packet is abnormal; and predicting with the trained traffic prediction model a frequency of abnormal traffic packets to be input, and outputting an abnormal traffic warning by comparing the predicted frequency and a threshold. ## Claims ### Claim 1 An operating method of a computing device operated by at least one processor, the operating method comprising: collecting traffic packets; extracting particular field data from the traffic packets, transforming the extracted particular field data to a vector with a reduced dimension for each traffic packet of the traffic packets, and creating training data with the vector for each traffic packet of the traffic packets; training a traffic prediction model with the training data, the traffic prediction model predicting a next input traffic packet from an input traffic packet and whether the next input traffic packet is abnormal; and predicting with the trained traffic prediction model a frequency of abnormal traffic packets to be input, and outputting an abnormal traffic warning by comparing the predicted frequency and a threshold. ### Claim 2 (depends on 1) The operating method of claim 1, wherein the particular field data comprises at least one of a type of data, a command type, flag information, port information, a source IP, or a destination IP included in each traffic packet of the traffic packets. ### Claim 3 (depends on 1) The operating method of claim 1, wherein the transforming comprises determining a type of a pattern of the collected traffic packets and transforming the particular field data for each traffic packet of the traffic packets to a vector with a minimum dimension to distinguish the type of the pattern. ### Claim 4 (depends on 2) The operating method of claim 2, wherein the vector comprises a one-hot vector having one element of true or ‘1’ and the other elements of false or ‘0’. ### Claim 5 (depends on 1) The operating method of claim 1, further comprising: receiving a series of new traffic packets in sequence and inputting the new traffic packets to the traffic prediction model; and predicting a traffic packet to come after the new traffic packets. ### Claim 6 (depends on 5) The operating method of claim 5, further comprising: extracting the particular field data from the new traffic packets, transforming the particular field data to a vector, and generating a warning when the vector is different from a form of the training data, between the inputting and the predicting. ### Claim 7 (depends on 5) The operating method of claim 5, further comprising: determining whether the predicted traffic packet is normal traffic; and generating a warning when the predicted traffic packet is determined to be abnormal traffic. ### Claim 8 A computing device comprising: a memory, and at least one processor configured to execute instructions of a program loaded in the memory, wherein the program includes instructions composed to execute the following operations: extracting particular field data from a plurality of collected traffic packets, transforming the extracted particular field data to a vector with a reduced dimension for each traffic packet of the plurality of collected traffic packets, and creating training data with the vector for each traffic packet of the plurality of collected traffic packets, training a traffic prediction model with the training data, the traffic prediction model predicting a next input traffic packet from an input traffic packet and whether the next input traffic packet is abnormal, and receiving a series of new traffic packets in sequence, extracting the particular field data from the new traffic packets, transforming the extracted particular field data to a vector and inputting the vector to the traffic prediction model, and predicting a traffic packet to come after the new traffic packet. ### Claim 9 (depends on 8) The computing device of claim 8, wherein the traffic prediction model is implemented with a bidirectional recurrent neural network (BRNN). ### Claim 10 (depends on 8) The computing device of claim 8, wherein the transforming comprises sorting the extracted field data into a plurality of groups according to a grouping rule, and transforming the field data belonging to each group of the plurality of groups to a vector in a minimum dimension to distinguish a type of the field data. ### Claim 11 (depends on 10) The computing device of claim 10, wherein the traffic prediction model is created as many as the number of groups, each traffic prediction model receiving a vector belonging to each group and performing learning. ### Claim 12 (depends on 8) The computing device of claim 8, wherein the training comprises predicting with the trained traffic prediction model a frequency of abnormal traffic packets to be input, and setting a threshold based on the frequency to output a warning. ### Claim 13 (depends on 12) The computing device of claim 12, wherein the program further includes instructions composed to execute the following operations: determining whether the predicted traffic packet is normal traffic; and when the predicted traffic packet is determined to be abnormal, computing a frequency of abnormal traffic packets input for a unit time and outputting a warning when the frequency exceeds the threshold.