# US 11,444,964 B2 · Method and arrangement for detecting anomalies in network data traffic

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,444,964 B2
- Document ID: US11444964B2
- Status: Granted
- Kind: B2
- Application number: 16/431,122
- Filed: 2019-06-04
- Published: 2020-12-10
- Granted: 2022-09-13
- Earliest claimed: 2019-06-04
- Assignees: Telefonaktiebolaget LM Ericsson (publ)
- Applicants: Telefonaktiebolaget LM Ericsson (publ)
- Inventors: Jakob Sternby; Vasileios Giannokostas; Michael Liljenstam; Erik Thormarker
- Web page: https://patentgrep.com/patent/US11444964B2

## CPC

- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- G06N 5/01: Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound
- G06N 20/00: Machine learning
- G06N 20/20: Ensemble learning
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

The present disclosure relates to a method and an apparatus for training a model for detecting anomalies in network data traffic between devices in a first part of a network and devices in a second part of the network. The method comprises collecting feature samples of network data traffic at a monitoring point between a first and a second part of the network, and training the model for detecting anomalies on the collected feature samples using a plurality of anomaly detection, AD, trees. The training comprises creating the plurality of AD trees using respective subsets of the collected feature samples, at least some of the AD tree comprising subspace selection nodes and anomaly-catching nodes to a predetermined AD tree depth limit. Each subspace selection node is arranged to bisect a set of feature samples reaching the subspace selection node to at least one anomaly-catching node when a number of feature samples leaving the subspace selection node for the at least one anomaly-catching node is below a predetermined threshold. The disclosure also relates to a method and an apparatus for anomalies in network data traffic using said model.

## Claims

### Claim 1

A method for creating a model for detecting anomalies in network data traffic between devices in a first part of a network and devices in a second part of the network, the method comprising:
collecting feature samples of network data traffic at a monitoring point between a first and a second part of the network, and
training the model for detecting anomalies on the collected feature samples using a plurality of anomaly detection, AD, trees;
wherein training comprises creating the plurality of AD trees using respective subsets of the collected feature samples, at least some of the AD tree comprising subspace selection nodes and anomaly-catching nodes to a predetermined AD tree depth limit D, wherein each subspace selection node is arranged to bisect a set of feature samples reaching the subspace selection node based on a value chosen from within a first interval that is an interval of the set of feature samples reaching the subspace selection node and each anomaly-catching node is arranged to bisect a set of feature samples reaching the anomaly-catching node based on a value chosen from a second interval that includes one or more values outside the first interval, and wherein each subspace selection node is arranged to bisect a set of feature samples reaching the subspace selection node to at least one anomaly-catching node when a number of feature samples leaving the subspace selection node for the at least one anomaly- catching node is below a predetermined threshold.

### Claim 2 (depends on 1)

The method of claim 1, wherein each anomaly-catching node is arranged to be immediately followed by a terminating node.

### Claim 3 (depends on 1)

The method of claim 1, wherein each anomaly-catching node is arranged to bisect the set of samples reaching the anomaly-catching node to the terminating node and to a subspace selection node or to a further anomaly-catching node, and wherein the set of feature samples reaching the anomaly-catching node are passed to the subspace selection node or the further anomaly-catching node.

### Claim 4 (depends on 2)

The method of claim 2, wherein each anomaly-catching node is followed by one or more further anomaly-catching nodes until reaching the AD tree depth limit D.

### Claim 5 (depends on 1)

The method of claim 1, wherein the step of collecting feature samples is performed under anomaly transparent conditions.

### Claim 6 (depends on 1)

The method of claim 1, wherein the predetermined threshold represents a fraction determined from the number of feature samples leaving the subspace selection node for the at least one anomaly-catching node and the respective subset of collected feature samples.

### Claim 7 (depends on 1)

The method of claim 1, wherein each subspace selection node is arranged to bisect the set of feature samples reaching the subspace selection node into two immediately following subspace selection nodes, when the size of the set of feature samples reaching the subspace selection node is on or above the predetermined threshold.

### Claim 8 (depends on 7)

The method of claim 7, wherein the set of feature samples reaching the subspace selection node is bisected to two immediately following subspace selection nodes under a size constraint E.

### Claim 9 (depends on 8)

The method of claim 8, wherein the set of training samples, S, with values for feature f in span(Sf)=[min xf, max xf], x in S, reaching the subspace selection node is bisected within the size constraint ε:
γ
⁡
(
S
)
f
∈
[
γ
∈
V
⁡
(
f
)
⁢
⁢
s
.
t
.

#
⁢
{
x
f
<
γ
|
x
∈
S
}
#
⁢
S
-
0
,
5

<
ɛ
]
,
wherein:
γ(S)f is a value for splitting the training samples for feature f that reach the subspace selection node;
V(f) is a value space for feature f;
γ is a value in V(f); and
#S is a size of the set of training samples, S.

### Claim 10 (depends on 1)

The method of claim 1, further comprising selecting the predetermined AD tree depth limit D:
D=round(4*max([1,log(n)−log(β)])),
wherein n is a subsample size and β is the predetermined threshold.

### Claim 11 (depends on 1)

A method for detecting anomalies in network data traffic between devices in a first part of a network and devices in a second part of the network, the method comprising:
retrieving at least one network data traffic sample;
determining an anomaly score using an Anomaly Detection Forest, ADF, model trained according to the method of claim 1 by determining an expected path length in the ADF of the network traffic; and
detecting anomalies in the network data traffic sample based on the determined anomaly score.

### Claim 12 (depends on 11)

The method of claim 11, wherein the anomaly score is determined using an Isolation Score function:
IS
⁡
(
x
)
=
2
-
E
⁡
(
h
⁡
(
x
)
)
c
⁡
(
n
)
wherein an expected path-length of a sample x through the plurality of AD trees is defined as:
E
⁡
(
h
⁡
(
x
)
)
=
1
T
⁢
∑
t
=
1
T
⁢
h
t
⁡
(
x
)
,
wherein c(n) is a normalization constant that is a function of a subsample size n, and ht(x) is a path length when passing sample x through an Anomaly Detection Tree t.

### Claim 13 (depends on 11)

The method of claim 11, further comprising selecting at least one threshold value for detecting anomalies as a minimal value achieving an expected false/positive ratio on the samples used for modelling.

### Claim 14 (depends on 11)

The method of claim 11, further comprising selecting at least one threshold value for detecting anomalies according to one or more previously observed limits for abnormality.

### Claim 15 (depends on 11)

The method of claim 11, further comprising activating an alarm based on a comparison between the determined anomaly score and a predetermined threshold.

### Claim 16 (depends on 15)

The method of claim 15, further comprising providing the alarm to a network function configured to control anomaly event handling in the network flow from one or more network devices in an external network to one or more network devices in an internal network.

### Claim 17

A non-transitory computer readable medium, having thereon a computer program comprising program instructions, the computer program being loadable into a data processing unit and configured to cause execution of a method when the computer program is run by the data processing unit, wherein the method is for creating a model for detecting anomalies in network data traffic between devices in a first part of a network and devices in a second part of the network, and wherein the method comprises:
collecting feature samples of network data traffic at a monitoring point between a first and a second part of the network, and
training the model for detecting anomalies on the collected feature samples using a plurality of anomaly detection, AD, trees;
wherein training comprises creating the plurality of AD trees using respective subsets of the collected feature samples, at least some of the AD tree comprising subspace selection nodes and anomaly-catching nodes to a predetermined AD tree depth limit D, wherein each subspace selection node is arranged to bisect a set of feature samples reaching the subspace selection node based on a value chosen from within a first interval that is an interval of the set of feature samples reaching the subspace selection node and each anomaly-catching node is arranged to bisect a set of feature samples reaching the anomaly-catching node based on a value chosen from a second interval that includes one or more values outside the first interval, and wherein each subspace selection node is arranged to bisect a set of feature samples reaching the subspace selection node to at least one anomaly-catching node when a number of feature samples leaving the subspace selection node for the at least one anomaly-catching node is below a predetermined threshold.

### Claim 18

An apparatus for creating a model for detecting anomalies in network data traffic between devices in a first part of a network and devices in a second part of the network, the apparatus comprising processing circuitry configured to cause:
collection of feature samples of network data traffic between the first and second part of the network; and
training of an anomaly detection model on the collected feature samples using a plurality of anomaly detection, AD, trees,
wherein training comprises creating the plurality of AD trees T using a subset of the collected feature samples, at least some of the AD trees comprising subspace selection nodes and anomaly-catching nodes to a predetermined AD tree depth limit D, wherein each subspace selection node is arranged to bisect a set of feature samples reaching the subspace selection node based on a value chosen from within a first interval that is an interval of the set of feature samples reaching the subspace selection node and each anomaly-catching node is arranged to bisect a set of feature samples reaching the anomaly-catching node based on a value chosen from a second interval that includes one or more values outside the first interval, and wherein each subspace selection node is arranged to bisect a set of feature samples reaching the subspace selection node to at least one anomaly-catching node when a number of feature samples leaving the subspace selection node for the at least one anomaly-catching node is below a predetermined threshold.

### Claim 19 (depends on 18)

The apparatus of claim 18, further configured to cause:
retrieval at least one network data traffic sample;
application of the trained anomaly detection model;
determination of an anomaly score based on the application of the trained anomaly detection model; and
detection of anomalies in the network data traffic based on the determined anomaly score.

### Claim 20 (depends on 18)

A server node comprising one or more of the apparatus according to claim 18.