US 11,601,339 B2Granted

Methods and systems for creating multi-dimensional baselines from network conversations using sequence prediction models

AssigneeHewlett Packard Enterprise Development LP

InventorRamsundar Janakiraman

Life of this patent

Estimating the term…

Loading patent…

Abstract

Systems and methods are provided for utilizing natural language process (NLP), namely sequence prediction approaches, in the realm of network security. Techniques include analyzing network transaction records to form network sentences representative of network activity. The network sentences are formulated by regularizing transactions records using words, allowing the network sentences to represent the network activity using natural language terminology. In some cases, multiple variations of the network sentences having different sequences of words are generated to form a corpus of network sentences related to a semantics of network activity. Accordingly, an NLP-based network prediction model can be created and trained using the corpus of network sentences. The network prediction model can be trained over to identify dimensions corresponding to particular sequences of words in the network sentences, and predict an expected dimension. Using the network prediction model predictions of expected network are provided, and anomalies efficiently detected.

Claims17

Dependent claims

A method for predicting network activity within a communication network, comprising:

receiving, by a network device, a plurality of transaction records associated with network interactions amongst a plurality of network entities in the communication network;
analyzing, by the network device, the plurality of transaction records to identify network entities within the plurality of transaction records, wherein the network entities are identified as text strings using text-based analysis;
generating, by the network device, a corpus including multiple network sentences, wherein each of the multiple network sentence corresponds to at least one transaction record and includes the identified network entities corresponding to the transaction record, and
wherein generating the corpus comprises regularizing each of the plurality of transaction records using words to formulate the corresponding network sentence such that a sequence of words in the network sentence represents the network interaction using natural language terminology;
training, by the network device, a network sequence prediction model using the network sentences in the corpus, wherein training the network sequence prediction model comprises for each network sentence in the corpus, identifying multiple dimensions correlating to the sequence of words in the network sentence;
and
applying, by the network device, the network sequence prediction model to monitored network interactions within the communication network in order to provide a prediction related to expected network activity for at least one identified network entity.

4 more elements

A network device connected to a communications network and employed for predicting network activity within the communication network, comprising:

a processor;
and
a storage medium comprising instructions, which when executed by the processor, causing the network device to:
receive a plurality of transaction records associated with network interactions amongst a plurality of network entities in the communication network;
analyze the plurality of transaction records to identify network entities within the plurality of transaction records, wherein the network entities are identified as text strings using text-based analysis;
regularize each of the plurality of transaction records using words to formulate the corresponding network sentence such that a sequence of words in the network sentence represents the network interaction using natural language terminology;
for each network sentence in the corpus, identify multiple dimensions correlating to the sequence of words in the network sentence;
generate a corpus including multiple network sentences, wherein each of the multiple network sentence corresponds to at least one transaction record and includes the identified network entities corresponding to the transaction record;
train a network sequence prediction model using the network sentences in the corpus;
and
apply the network sequence prediction model to monitored network interactions within the communication network in order to provide a prediction related to expected network activity for at least one identified network entity.

8 more elements

A non-transitory machine-readable storage medium comprising instructions executable by a processor of a network device, the instructions programming the processor to:

receive a plurality of transaction records associated with network interactions amongst a plurality of network entities in the communication network;
analyze the plurality of transaction records to identify network entities within the plurality of transaction records, wherein the network entities are identified as text strings using text-based analysis;
regularize each of the plurality of transaction records using words to formulate the corresponding network sentence such that a sequence of words in the network sentence represents the network interaction using natural language terminology;
for each network sentence in the corpus, identify multiple dimensions correlating to the sequence of words in the network sentence;
generate a corpus including multiple network sentences, wherein each of the multiple network sentence corresponds to at least one transaction record and includes the identified network entities corresponding to the transaction record;
train a network sequence prediction model using the network sentences in the corpus;
and
apply the network sequence prediction model to monitored network interactions within the communication network in order to provide a prediction related to expected network activity for at least one identified network entity.

5 more elements

Dependencies are inferred from the claim text.