Method and system for confident anomaly detection in computer network traffic
AssigneeNetflow Logic Corporation
InventorsIgor Balabine, Alexander Velednitsky
Life of this patent
Estimating the term…
Abstract
The present invention relates to systems and methods for detecting anomalies in computer network traffic with fewer false positives and without the need for time-consuming and unreliable historical baselines. Upon detection, traffic anomalies can be processed to determine valuable network insights, including health of interfaces, devices and network services, as well as to provide timely alerts in the event of attack.
Claims19
A method for detecting and classifying network traffic anomalies, comprising:
- determining a data traffic data collection interval (dt);
- determining a traffic observation interval (T) which is a multiple (N) of dt;
- collecting observable data from each of the N collection intervals;
- providing the observable data to a plurality of network traffic analyzers;
- identify a change point data traffic collection interval;
- computing an entropy value trend between the change point data traffic collection interval and a current data collection interval;
- classify the entropy value trend based upon its slope;
- and
- reporting a network anomaly as a function of the classification and an entropy value of the current data collection interval.
A computer program product stored on non-transitory memory, which when executed by a computer system performs the steps of:
- determining a data traffic data collection interval (dt);
- determining a traffic observation interval (T) which is a multiple (N) of dt;
- collecting observable data from each of the N collection intervals;
- providing the observable data to a plurality of network traffic analyzers;
- identify a change point data traffic collection interval;
- computing an entropy value trend between the change point data traffic collection interval and a current data collection interval;
- classify the entropy value trend based upon its slope;
- and
- reporting a network anomaly as a function of the classification and an entropy value of the current data collection interval.
Dependencies are inferred from the claim text.