# US 11,805,143 B2 · Method and system for confident anomaly detection in computer network traffic > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,805,143 B2 - Document ID: US11805143B2 - Status: Granted - Kind: B2 - Application number: 17/393,363 - Filed: 2021-08-03 - Published: 2022-01-27 - Granted: 2023-10-31 - Earliest claimed: 2011-11-07 - Assignees: Netflow Logic Corporation - Applicants: NetFlow Logic Corporation - Inventors: Igor Balabine; Alexander Velednitsky - Web page: https://patentgrep.com/patent/US11805143B2 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 21/554: {involving event detection and direct action} - H04L 43/04: Processing captured monitoring data, e.g. for logfile generation - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1458: {Denial of Service} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract The present invention relates to systems and methods for detecting anomalies in computer network traffic with fewer false positives and without the need for time-consuming and unreliable historical baselines. Upon detection, traffic anomalies can be processed to determine valuable network insights, including health of interfaces, devices and network services, as well as to provide timely alerts in the event of attack. ## Claims ### Claim 1 A method for detecting and classifying network traffic anomalies, comprising: determining a data traffic data collection interval (dt); determining a traffic observation interval (T) which is a multiple (N) of dt; collecting observable data from each of the N collection intervals; providing the observable data to a plurality of network traffic analyzers; identify a change point data traffic collection interval; computing an entropy value trend between the change point data traffic collection interval and a current data collection interval; classify the entropy value trend based upon its slope; and reporting a network anomaly as a function of the classification and an entropy value of the current data collection interval. ### Claim 2 (depends on 1) The method of claim 1, wherein dt is between 10 and 60 seconds. ### Claim 3 (depends on 1) The method of claim 1, wherein N is between 20 and 40. ### Claim 4 (depends on 1) The method of claim 1, wherein the observable data includes traffic volume and packet rate measurements. ### Claim 5 (depends on 1) The method of claim 1, wherein the change point data traffic collection interval is identified by a wavelet series algorithm. ### Claim 6 (depends on 3) The method of claim 3, wherein N is 32. ### Claim 7 (depends on 1) The method of claim 1, wherein at least one algorithm identifies change points. ### Claim 8 (depends on 1) The method of claim 1 further comprising calculating a network Node Health Score (NHS) using the change points. ### Claim 9 (depends on 8) The method of claim 8, further comprising calculating an NHS trend based upon NHS value variation patterns over data collection intervals starting with a starting change point data collection interval to a current data collection interval. ### Claim 10 A computer program product stored on non-transitory memory, which when executed by a computer system performs the steps of: determining a data traffic data collection interval (dt); determining a traffic observation interval (T) which is a multiple (N) of dt; collecting observable data from each of the N collection intervals; providing the observable data to a plurality of network traffic analyzers; identify a change point data traffic collection interval; computing an entropy value trend between the change point data traffic collection interval and a current data collection interval; classify the entropy value trend based upon its slope; and reporting a network anomaly as a function of the classification and an entropy value of the current data collection interval. ### Claim 11 (depends on 10) The computer program product of claim 10, wherein dt is between 10 and 60 seconds. ### Claim 12 (depends on 10) The computer program product of claim 10, wherein N is between 20 and 40. ### Claim 13 (depends on 10) The computer program product of claim 10, wherein the observable data includes traffic volume and packet rate measurements. ### Claim 14 (depends on 10) The computer program product of claim 10, wherein the change point data traffic collection interval is identified by a wavelet series algorithm. ### Claim 15 (depends on 14) The computer program product of claim 14, wherein N is 32. ### Claim 16 (depends on 10) The computer program product of claim 10, wherein at least one algorithm identifies change points. ### Claim 17 (depends on 10) The computer program product of claim 10, which when executed on a computer system further performs the step of calculating a network Node Health Score (NHS) using the change points. ### Claim 18 (depends on 17) The computer program product of claim 17, which when executed on a computer system further performs the step of calculating an NHS trend based upon NHS value variation patterns over data collection intervals starting with a starting change point data collection interval to a current data collection interval. ### Claim 19 (depends on 10) The computer program product of claim 10, which when executed on a computer system further performs the step of applying an exponential smoothing process to observed data in the packets.