Back to results
US 11,606,367 B2Granted
Systems and methods for network anomaly detection and resolution
AssigneePaypal, Inc.
InventorZhe Chen
Life of this patent
Estimating the term…
Abstract
Systems and methods for detecting network anomalies are described. These may include determining burst scores for external network resources, determining burst scores for internal network resources, and using the burst scores to construct a burst graph where the edges are weighted by the number of connections between each resource. The graph is then analyzed by a graph convolutional neural network to identify patterns from which anomalous network traffic can be detected and from which corrective action can be taken. These techniques can allow for better detection and mitigation of abusive network traffic, improve computer network security, and provide more robust access to networked computer resources.
Claims20
A system comprising:
- a non-transitory memory;
- and
- one or more hardware processors coupled with the non-transitory memory and configured to execute instructions from the non-transitory memory to cause the system to perform operations comprising:
- determining, at least in part by comparing first network traffic interactions between a first external network resource and each of one or more internal servers with second network traffic interactions of a plurality of second external network resources and the each of one or more internal servers in a same time window, an external burst score for the first external network resource, the first and second external network resources comprising a network resources of one or more external domains;
- determining, at least in part by comparing a frequency of third network traffic interactions between an internal network resource and each of the one or more external domains with a particular interaction frequency, an internal burst score for the internal network resource, the internal network resource a network resource of the one or more internal servers;
- creating a burst graph based on the internal burst score and external burst score;
- based on the burst graph, determining an interaction pattern between the first or second external network resource and the internal network resource using a graph convolutional neural network;
- and
- determining an anomalous traffic event based on a deviation of the interaction pattern from a probability density function.
6 more elements
A method comprising:
- determining a first external burst score for a first external network resource in a plurality of external network resources, the first external burst score being determined based on comparing first network traffic interactions with second network traffic interactions in a same time period, the first network traffic interactions being conducted between the first external network resource and each internal network resource in a plurality of internal network resources, the second network traffic interactions being conducted between a second external network resource and each internal network resource in the plurality of internal network resources;
- determining a first internal burst score for a first internal network resource in the plurality of internal network resources, the first internal burst score being determined based on comparing a predetermined frequency with a frequency of third network traffic interactions between the first internal network resource and each external network resource of the plurality of external network resources;
- creating a burst graph based on the first internal burst score and the first external burst score;
- based on the burst graph, determining an interaction pattern between the first external network resource and the first internal network resource using a graph convolutional neural network;
- and
- determining an anomalous traffic event based on a deviation of the interaction pattern from a probability density function.
3 more elements
A non-transitory machine-readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising:
- determining external burst scores for each of one or more external network resources, the external burst scores being determined based on comparing multiple different network traffic interactions in a same time frame, the multiple different network traffic interactions corresponding to interactions between different ones of the one or more external network resources and each internal network resource of one or more internal network resources;
- determining internal burst scores for each of one or more internal network resources, the internal burst scores being determined based on comparing a predefined frequency with a frequency of network traffic interactions between the each of the one or more internal network resources and each of the external network resources;
- creating a burst graph based on the internal burst scores and the external burst scores;
- based on the burst graph, determining an interaction pattern between the one or more external network resources and the one or more internal network resources using a graph convolutional neural network;
- and
- determining an anomalous traffic event based on a deviation of the interaction pattern from a probability density function.
3 more elements
Dependencies are inferred from the claim text.