Creating aggregate network flow time series in network anomaly detection systems
AssigneeLevel 3 Communications, LLC
InventorSergey Yermakov
Life of this patent
Estimating the term…
Abstract
In an embodiment, a computer implemented method receives flow data for one or more flows that correspond to a device-circuit pair. The method calculates a time difference for each flow that corresponds to a device-circuit pair. Based on the calculated time differences and the received flow data, the method updates a probability distribution model associated with the device-circuit pair. Then, the method determines whether a time bucket is complete or open based on the updated probability distribution model.
Claims18
A computer implemented method for processing a network flow with a device-circuit pair, comprising:
- obtaining, by a server, a probability distribution model associated with the device-circuit pair, the probability distribution model indicating, for different time differences of prior network flows through the device-circuit pair, corresponding numbers of occurrences;
- determining, by the server, a duration of a time bucket according to the probability distribution model associated with the device-circuit pair;
- determining, by the server, whether to ignore the network flow according to the duration of the time bucket;
- and
- detecting, by the server, a network anomaly associated with the device-circuit pair according to the determination of whether to ignore the network flow,
- wherein each of the time differences is a difference between i) a start time or an end time of a corresponding prior network flow at one of the device-circuit pair and ii) a file stamp time of the corresponding prior network flow received by the server.
A system for processing a network flow with a device-circuit pair, comprising:
- one or more processors;
- and
- a non-transitory computer readable medium storing instructions when executed by the one or more processors cause the one or more processors to:
- obtain a probability distribution model associated with the device-circuit pair, the probability distribution model indicating, for different time differences of prior network flows through the device-circuit pair, corresponding numbers of occurrences,
- determine a duration of a time bucket according to the probability distribution model associated with the device-circuit pair,
- determine whether to ignore the network flow according to the duration of the time bucket, and
- detect a network anomaly associated with the device-circuit pair according to the determination of whether to ignore the network flow,
- wherein each of the time differences is a difference between i) a start time or an end time of a corresponding prior network flow at one of the device-circuit pair and ii) a file stamp time of the corresponding prior network flow received by a server.
A non-transitory computer readable medium for processing a network flow with a device-circuit pair, the non-transitory computer readable medium storing instructions when executed by one or more processors cause the one or more processors to:
- obtain a probability distribution model associated with the device-circuit pair, the probability distribution model indicating, for different time differences of prior network flows through the device-circuit pair, corresponding numbers of occurrences;
- determine a duration of a time bucket according to the probability distribution model associated with the device-circuit pair;
- determine whether to ignore the network flow according to the duration of the time bucket;
- and
- detect a network anomaly associated with the device-circuit pair according to the determination of whether to ignore the network flow,
- wherein each of the time differences is a difference between i) a start time or an end time of a corresponding prior network flow at one of the device-circuit pair and ii) a file stamp time of the corresponding prior network flow received by a server.
Dependencies are inferred from the claim text.