# US 11,444,966 B2 · Automatic detection of network strain using response time metrics

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,444,966 B2
- Document ID: US11444966B2
- Status: Granted
- Kind: B2
- Application number: 16/717,783
- Filed: 2019-12-17
- Published: 2021-06-17
- Granted: 2022-09-13
- Earliest claimed: 2019-12-17
- Assignees: Arbor Networks, Inc.
- Applicants: Arbor Networks, Inc.
- Inventors: Sean O'Hara
- Web page: https://patentgrep.com/patent/US11444966B2

## CPC

- H04L 41/145: {involving simulating, designing, planning or modelling of a network}
- G06N 20/00: Machine learning
- H04L 41/14: Network analysis or design
- H04L 41/142: using statistical or mathematical methods
- H04L 43/045: for graphical visualisation of monitoring data
- H04L 43/062: related to network traffic
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 63/1458: {Denial of Service}
- H04L 67/563: Data redirection of data network streams
- H04L 69/22: Parsing or analysis of headers
- H04L 43/0864: Round trip delays
- H04L 43/16: Threshold monitoring
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

The method and system are provided for monitoring a protected network for strain. The method includes receiving a learned model having clusters of learning requests of learning network traffic observed during non-strain operation of the protected network, observing network traffic, classifying each of the traffic requests with one of the clusters based on fields of the traffic request and fields used for clustering the learning requests, determining an analysis response time for respective traffic requests associated with the classified traffic requests, determining an analysis response time characteristic per cluster based on an analysis response time associated with the respective classified traffic requests classified with the cluster, determining a difference per cluster between the analysis response time and the learning response times associated with the cluster, and notifying a mitigation device when the difference determined for enough of the clusters exceeds a predetermined threshold.

## Claims

### Claim 1

A method of monitoring a protected network for strain, the method comprising:
in an analysis phase during operation of the protected network:
receiving a learned model having clusters of learning requests of learning network traffic observed during non-strain operation of the protected network, each cluster having an associated characteristic learning response time based on learning response times determined for learning requests and corresponding learning responses of the learning network traffic;
observing network traffic having traffic requests and traffic responses to and from the protected network;
classifying each of the traffic requests with one of the clusters by comparing fields of the traffic request to fields used for clustering the learning requests with the clusters;
associating one of the traffic responses or lack of traffic response to each corresponding traffic request of the clusters;
determining an analysis response time for the respective traffic responses;
associating the analysis response time with the respective classified traffic requests that correspond to the traffic responses;
determining an analysis response time characteristic per cluster based on the analysis response time associated with the respective classified traffic requests classified with the cluster;
determining a difference per cluster between the analysis response time and the learning response time associated with the cluster; and
notifying a mitigation device when the difference determined for enough of the clusters exceeds a predetermined threshold.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
in a learning phase during non-strain operation of the protected network:
observing the learning network traffic;
clustering the learning requests based on the respective learning requests' fields;
associating one of the learning responses or lack of learning response to each corresponding learning request of the clusters;
determining the learning response time for the respective learning responses; and
determining the characteristic learning response time per cluster based on the learning response times of the learning responses that correspond to the learning requests associated with the cluster.

### Claim 3 (depends on 2)

The method of claim 2, further comprising normalizing selected fields of each learning request before clustering the learning requests using the normalized selected fields.

### Claim 4 (depends on 3)

The method of claim 3, further comprising determining a maximum return time, wherein the selected fields of the learning requests and traffic requests are normalized using the maximum return time.

### Claim 5 (depends on 4)

The method of claim 4, further comprising normalizing the selected fields of each traffic request, wherein normalizing the selected fields of the traffic requests is performed before classifying the traffic requests.

### Claim 6 (depends on 2)

The method of claim 2, further comprising buffering the observed learning requests for a time interval before clustering the learning requests that were buffered for the time interval.

### Claim 7 (depends on 2)

The method of claim 2, further comprising generating a learned histogram per cluster that represents behavior of the cluster with regard to learning response times over time.

### Claim 8 (depends on 7)

The method of claim 7, further comprising generating an analysis histogram per cluster that represents behavior of response times associated with traffic responses that correspond to traffic requests classified with the cluster over a window of time, wherein determining the difference per cluster includes comparing the learned histogram and the analysis histogram associated with the respective clusters.

### Claim 9 (depends on 1)

The method of claim 1, further comprising buffering the observed traffic requests for a time interval before classifying the traffic requests that were buffered for the time interval.

### Claim 10 (depends on 1)

The method of claim 1, further comprising, wherein for each traffic request that does not have a paired traffic response, generating a timed-out response with an assigned learned response time and associating the timed-out response to the traffic response, the assigned learned response time being larger than a predetermined acceptable response time window between receiving a traffic request and a corresponding traffic response.

### Claim 11

A network monitoring system to monitor a protected network for strain, the network monitoring system comprising:
a memory configured to store instructions; and
a processor disposed in communication with the memory, wherein the processor, upon execution of the instructions is configured to:
in an analysis phase during operation of the protected network:
receive a learned model having clusters of learning requests of learning network traffic observed during non-strain operation of the protected network, each cluster having an associated characteristic learning response time based on learning response times determined for learning requests and corresponding learning responses of the learning network traffic;
observe network traffic having traffic requests and traffic responses to and from the protected network;
classify each of the traffic requests with one of the clusters by comparing fields of the traffic request to fields used for clustering the learning requests with the clusters;
associate one of the traffic responses or lack of traffic response to each corresponding traffic request of the clusters;
determine an analysis response time for the respective traffic responses;
associate the analysis response time with the respective classified traffic requests that correspond to the traffic responses;
determine an analysis response time for the respective traffic responses;
determine a difference per cluster between the analysis response time and the learning response time associated with the cluster; and
notify a mitigation device when the difference determined for enough of the clusters exceeds a predetermined threshold.

### Claim 12 (depends on 11)

The network monitoring system of claim 11, wherein the processor, upon execution of the instructions is further configured to:
in a learning phase during non-strain operation of the protected network:
observe the learning network traffic;
cluster the learning requests based on the respective learning requests' fields;
associate one of the learning responses or lack of learning response to each corresponding learning request of the clusters;
determine the learning response time for the respective learning responses; and
determine the characteristic learning response time per cluster based on the learning response times of the learning responses that correspond to the learning requests associated with the cluster.

### Claim 13 (depends on 12)

The network monitoring system of claim 12, wherein the processor, upon execution of the instructions is further configured to normalize selected fields of each learning request before clustering the learning requests using the normalized selected fields.

### Claim 14 (depends on 13)

The network monitoring system of claim 13, wherein the processor, upon execution of the instructions is further configured to determine a maximum return time, wherein the selected fields of the learning requests and traffic requests are normalized using the maximum return time.

### Claim 15 (depends on 14)

The network monitoring system of claim 14, wherein the processor, upon execution of the instructions is further configured to normalize the selected fields of each traffic request, wherein normalizing the selected fields of the traffic requests is performed before classifying the traffic requests.

### Claim 16 (depends on 12)

The network monitoring system of claim 12, wherein the processor, upon execution of the instructions is further configured to buffer the observed learning requests for a time interval before clustering the learning requests that were buffered for the time interval.

### Claim 17 (depends on 12)

The network monitoring system of claim 12, further comprising generating a learned histogram per cluster that represents behavior of the cluster with regard to learning response times over time.

### Claim 18 (depends on 17)

The network monitoring system of claim 17, further comprising generating an analysis histogram per cluster that represents behavior of response times associated with traffic responses that correspond to traffic requests classified with the cluster over a window of time, wherein determining the difference per cluster includes comparing the learned histogram and the analysis histogram associated with the respective clusters.

### Claim 19 (depends on 11)

The network monitoring system of claim 11, wherein the processor, upon execution of the instructions is further configured to buffer the observed traffic requests for a time interval before classifying the traffic requests that were buffered for the time interval.

### Claim 20 (depends on 11)

The network monitoring system of claim 11, wherein the processor, upon execution of the instructions is further configured to:
for each traffic request that does not have a paired traffic response, generate a timed-out response with an assigned learned response time; and
associate the timed-out response to the traffic response, the assigned learned response time being larger than a predetermined acceptable response time window between receiving a traffic request and a corresponding traffic response.