US 11,539,620 B2Granted

Anomaly flow detection device and anomaly flow detection method

AssigneeNational Taiwan University

InventorsPhone Lin, Xin-Xue Lin, En-Hau Yeh, Chia-Peng Lee, Char-Dir Chung

Life of this patent

Estimating the term…

Loading patent…

Abstract

An anomaly flow detection device and an anomaly flow detection method thereof are provided. The device can retrieve a plurality of training data transmitted between a monitored network and an external network, preprocess a plurality of packet headers of the pluralities of training data to obtain a plurality of training feature vectors, construct a flow recognition model with an unsupervised learning method, input the pluralities of training feature vectors to the flow recognition model to train the flow recognition model, retrieve a plurality of testing data transmitted between the monitored network and the external network, preprocess a plurality of packet headers of the pluralities of testing data to obtain a plurality of testing feature vectors, input the pluralities of testing feature vectors to the flow recognition model to identify whether the pluralities of packet headers of the pluralities of testing data are normal or abnormal, and determine the flow of the monitored network is abnormal according to the recognition result of the flow recognition model.

Claims8

Dependent claims

An anomaly flow detection device comprising:

a network interface;
a storage;
and
a processor electrically connected to the network interface and the storage;
wherein the processor performs the following steps:
retrieving a plurality of training data transmitted between a monitored network and an external network in a first time interval through the network interface;
preprocessing a plurality of packet headers of the pluralities of training data to obtain a plurality of training feature vectors and storing them in the storage, comprising steps of:
choosing the packet headers of the pluralities of training data with certain feature types, in which the feature types comprises numerical features and non-numerical features;
filling up fields of missing feature values of the feature types;
standardizing the numerical features in the feature types to obtain first sub-features;
converting the non-numerical features in the feature types to binary value features to obtain second sub-features;
and
obtaining the training feature vectors according to the first sub-features and the second sub-features;
constructing a flow recognition model with an unsupervised learning method and storing it in the storage;
inputting the pluralities of training feature vectors to the flow recognition model to train the flow recognition model;
retrieving a plurality of testing data transmitted between the monitored network and the external network through the network interface;
preprocessing a plurality of packet headers of the pluralities of testing data to obtain a plurality of testing feature vectors and storing them in the storage;
inputting the pluralities of testing feature vectors to the flow recognition model to identify whether the pluralities of packet headers of the pluralities of testing data are normal or abnormal;
and
determining the flow of the monitored network is abnormal by calculating an abnormal index according to a recognition result of the flow recognition model.

17 more elements

An anomaly flow detection method performed by an anomaly flow detection device, wherein the device comprises a network interface, a storage, and a processor electrically connected to the network interface and the storage, and the method comprises the following steps:

retrieving a plurality of training data transmitted between a monitored network and an external network in a first time interval through the network interface;
preprocessing a plurality of packet headers of the pluralities of training data to obtain a plurality of training feature vectors and storing them in the storage, comprising steps of:
choosing the packet headers of the pluralities of training data with certain feature types, in which the feature types comprises numerical features and non-numerical features;
filling up fields of missing feature values of the feature types;
standardizing the numerical features in the feature types to obtain first sub-features;
converting the non-numerical features in the feature types to binary value features to obtain second sub-features;
and
obtaining the training feature vectors according to the first sub-features and the second sub-features;
constructing a flow recognition model with an unsupervised learning method and storing it in the storage;
inputting the pluralities of training feature vectors to the flow recognition model to train the flow recognition model;
retrieving a plurality of testing data transmitted between the monitored network and the external network through the network interface;
preprocessing a plurality of packet headers of the pluralities of testing data to obtain a plurality of testing feature vectors and storing them in the storage;
inputting the pluralities of testing feature vectors to the flow recognition model to identify whether the pluralities of packet headers of the pluralities of testing data are normal or abnormal;
and
determining the flow of the monitored network is abnormal by calculating an abnormal index according to the recognition result of the flow recognition model.

12 more elements

Dependencies are inferred from the claim text.