Back to results
US 11,606,377 B1Granted
Device classification for identifying anomolous activity
AssigneeRapid7, Inc.
InventorDustin Myers
Life of this patent
Estimating the term…
Abstract
Methods and systems for detecting anomalous network device activity. The system may include an interface for receiving an identification label associated with a host device and pre-existing traffic data associated with the host device. The system may further detect that the pre-existing traffic data associated with the host device is anomalous based on the identification label. The system may then issue an alert upon detecting that the pre-existing traffic data associated with the host device is anomalous.
Claims18
A method for detecting anomalous network device activity, the method comprising:
- receiving, using an interface, pre-existing traffic data associated with a host device through a passive scanning technique to not introduce additional traffic into the network;
- determining, from among a plurality of clusters of network devices, a particular cluster comprising at least one other network device to which the host device is most similar in behavior based at least in part on the pre-existing traffic data;
- assigning, based on the determining the particular cluster, a particular identification label to the host device, wherein the particular identification label indicates that the host device is classified as belonging to the particular cluster, and wherein a different identification label is assigned to one or more network devices belonging to a different cluster of the plurality of clusters;
- determining, based on the particular identification label, an expected behavioral parameter that comprises expected port communication activity associated with at least one of (i) one or more ports that the host device is expected to use for communication, or (ii) one or more ports that the host device is expected not to use for communication;
- determining, based on an analysis of the pre-existing traffic data with respect to the expected behavioral parameter, that the pre-existing traffic data associated with the host device comprises anomalous activity indicating that the port communication activity of the host device does not comport with the expected port communication activity, wherein
- the expected behavioral parameter is a first expected behavioral parameter;
- determining, based on the particular identification label, a second expected behavioral parameter associated with a different type of behavior than the first expected behavioral parameter, wherein
- the determining that the pre-existing traffic data associated with the host device comprises anomalous activity is further based at least in part on an analysis of the pre-existing traffic data with respect to the second expected behavioral parameter;
- and
- executing a remedial action upon determining that the pre-existing traffic data comprises anomalous activity.
7 more elements
A system for detecting anomalous network device activity, the system comprising:
- a processor executing instructions stored on a memory to:
- receive pre-existing traffic data associated with a host device through a passive scanning technique to not introduce additional traffic into the network
- determine, from among a plurality of clusters of network devices, a particular cluster comprising at least one other network device to which the host device is most similar in behavior based at least in part on the pre-existing traffic data
- assign, based on the determination of the particular cluster, a particular identification label to the host device, wherein the particular identification label indicates that the host device is classified as belonging to the particular cluster, and wherein a different identification label is assigned to one or more network devices belonging to a different cluster of the plurality of clusters;
- determine, based on the particular identification label, an expected behavioral parameter that comprises expected port communication activity associated with at least one of (i) one or more ports that the host device is expected to use for communication, or (ii) one or more ports that the host device is expected not to use for communication;
- determine, based on an analysis of the pre-existing traffic data with respect to the expected behavioral parameter, that the pre-existing traffic data associated with the host device comprises anomalous activity indicating that the port communication activity of the host device does not comport with the expected port communication activity, wherein
- the expected behavioral parameter is a first expected behavioral parameter;
- determine, based on the particular identification label, a second expected behavioral parameter associated with a different type of behavior than the first expected behavioral parameter, wherein
- the determining that the pre-existing traffic data associated with the host device comprises anomalous activity is further based at least in part on an analysis of the pre-existing traffic data with respect to the second expected behavioral parameter;
- and
- execute a remedial action upon determining that the pre-existing traffic data anomalous activity.
8 more elements
Dependencies are inferred from the claim text.