US 11,457,031 B1Granted

Apparatus having engine using artificial intelligence for detecting bot anomalies in a computer network

AssigneeAkitra, Inc.

InventorsNaveen S. Bisht, Ravi Someshwar, Kanna Rajan

Life of this patent

Estimating the term…

Abstract

A system comprises an enterprise network system and engine. The engine has a discovery module coupled to a switch device, an AI and machine learning based monitoring and detection module coupled to the switch device, and a remediation module coupled to the switch device. The remediation module is configured to initiate a remediation process based upon the detection of at least one of the bot anomalies from the flow of data.

Claims16

Dependent claims

An apparatus for processing data from a network, the apparatus comprising:

a message broker module coupled to a data source, the message broker module being configured to direct data in a netflow format to one or more processing engines for analysis of a bot in the data, the netflow format comprising:
a source IP address;
a destination IP address;
an IP protocol;
a source port for UDP or TCP;
a destination port for UDP or TCP;
an IP type of service;
a graph based learning processor engine coupled to the message broker module, the graph based learning processor engine comprising:
a data feeder;
an extraction engine coupled to the data feeder to process the data to extract a plurality of netflow data comprising the source IP address, the destination IP address, the IP protocol, the source port for UDP or TCP, the destination port for UDP or TCP, and the IP type of service;
a graph engine configured to associate the plurality of netflow data that has been extracted to one or more predetermined graph based models and identify a plurality of features in the plurality of netflow data to output a plurality of objects, each of the objects including a node list, a mac address, and a plurality of graph features;
and using the node list, the mac address, and the plurality of graph features to retrain the graph based models including the plurality of objects;
a clustering engine coupled to the graph engine, the clustering engine being configured using a clustering process to self-organize the plurality of objects including the node list, the mac address, and the plurality of graph features into a plurality of clusters;
and
a bot detection engine coupled to the clustering engine, the bot detection engine being configured to identify a malicious bot from the plurality of clusters;
a memory resource coupled to the graph based learning processor, the memory resource comprising storage resources to store a result information associated with malicious bot in the data.

13 more elements

Dependencies are inferred from the claim text.

patentgrep

Loading patent…

Abstract

An apparatus for processing data from a network, the apparatus comprising:

a message broker module coupled to a data source, the message broker module being configured to direct data in a netflow format to one or more processing engines for analysis of a bot in the data, the netflow format comprising:
a source IP address;
a destination IP address;
an IP protocol;
a source port for UDP or TCP;
a destination port for UDP or TCP;
an IP type of service;
a graph based learning processor engine coupled to the message broker module, the graph based learning processor engine comprising:
a data feeder;
an extraction engine coupled to the data feeder to process the data to extract a plurality of netflow data comprising the source IP address, the destination IP address, the IP protocol, the source port for UDP or TCP, the destination port for UDP or TCP, and the IP type of service;
a graph engine configured to associate the plurality of netflow data that has been extracted to one or more predetermined graph based models and identify a plurality of features in the plurality of netflow data to output a plurality of objects, each of the objects including a node list, a mac address, and a plurality of graph features;
and using the node list, the mac address, and the plurality of graph features to retrain the graph based models including the plurality of objects;
a clustering engine coupled to the graph engine, the clustering engine being configured using a clustering process to self-organize the plurality of objects including the node list, the mac address, and the plurality of graph features into a plurality of clusters;
and
a bot detection engine coupled to the clustering engine, the bot detection engine being configured to identify a malicious bot from the plurality of clusters;
a memory resource coupled to the graph based learning processor, the memory resource comprising storage resources to store a result information associated with malicious bot in the data.

13 more elements