US 11,770,394 B2Granted

Network security system that detects a common attacker who attacks from different source addresses

AssigneeBull SAS

InventorsHarshvardhan Parmar, Vinod Vasudevan, Rajat Mohanty

Life of this patent

Estimating the term…

Loading patent…

Abstract

A network security system that analyzes data from network attacks to determine which attacks came from the same attacker, even if the attacker tries to disguise its identity by spreading attacks out over time and attacking from multiple IP addresses. Intrusion detection systems or firewalls may log data for each attack, such as the time of the attack, the type of attack, and the source and target addresses. Embodiments may augment this data with derived attributes that may profile the attacker's behavior. For example, some attackers may spread out attacks over time, but always attack on the same day of the week; some attackers may spread out attacks over different IP addresses, but these addresses may all be in the same country. The original and augmented data may be clustered using an algorithm such as DBSCAN, and each attacker may be identified with one of the resulting clusters.

Claims12

Dependent claims

A network security system that detects a common attacker who attacks from different source addresses, comprising:

a database of attacks, wherein each attack in said database of attacks comprises original attributes comprising
a destination address;
a destination port;
a source address;
a time;
and
an attack type;
and,
a processor coupled to said database of attacks and configured to
add one or more derived attributes to each attack of said attacks to form augmented attacks,
wherein said augmented attacks comprise said original attributes and said one or more derived attributes,
wherein said one or more derived attributes comprise
one or more source location attributes derived from said source address;
and
one or more time group attributes derived from said time;
execute a clustering algorithm to group said augmented attacks into multiple clusters;
and,
identify each cluster of said multiple clusters with a corresponding attacker to group said attacks of said database of attacks based on a same attacker, such that
each cluster of said multiple clusters comprises attacks of said augmented attacks that originate from said same attacker, and
said each attack of said attacks is mapped to said each cluster based on said original attributes and said one or more derived attributes, wherein all of said augmented attacks within said each cluster are from said same attacker;
and,
normalize the destination address to a numerical value and normalize the destination port to a categorical value.

19 more elements

A network security system that detects a common attacker who attacks from different source addresses, comprising:

a database of attacks, wherein each attack in said database of attacks comprises original attributes comprising
a destination address;
a destination port;
a source address;
a time;
and
an attack type;
and,
a processor coupled to said database of attacks and configured to
normalize said destination address to a numeric value;
normalize said destination port to a categorical value;
add one or more derived attributes to each attack of said attacks to form augmented attacks,
wherein said augmented attacks comprise said original attributes and said one or more derived attributes,
wherein said one or more derived attributes comprise
one or more source location attributes derived from said source address, said one or more source location attributes comprising
a source country name;
a source latitude;
and
a source longitude;
and
one or more time group attributes derived from said time, said one or more time group attributes comprising
an hour-of-day;
a day-of-week;
a week-of-year;
an is-holiday;
and
an is-working-hours;
encode selected attributes of said augmented attacks, to form encoded attack data, wherein
said selected attributes consist of
said destination address;
said destination port;
said attack type;
said source country name;
said source latitude;
said source longitude;
said hour-of-day;
said day-of-week;
said week-of-year;
and
said is-holiday;
and
said encode selected attributes comprises encode categorical attributes of said selected attributes using one-hot encoding;
execute a density-based spatial clustering of applications with noise (DBSCAN)clustering algorithm on said encoded attack data to group said augmented attacks into multiple clusters;
and,
identify each cluster of said multiple clusters with a corresponding attacker to group said attacks of said database of attacks based on a same attacker, such that
each cluster of said multiple clusters comprises attacks of said augmented attacks that originate from said same attacker, and
said each attack of said attacks is mapped to said each cluster based on said original attributes and said one or more derived attributes, wherein all of said augmented attacks within said each cluster are from said same attacker.

44 more elements

Dependencies are inferred from the claim text.