# US 12,003,522 B2 · Method and system for adaptive network intrusion detection

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,003,522 B2
- Document ID: US12003522B2
- Status: Granted
- Kind: B2
- Application number: 17/291,617
- Filed: 2019-09-11
- Published: 2022-01-20
- Granted: 2024-06-04
- Earliest claimed: 2018-11-09
- Assignees: NEC Corporation
- Applicants: NEC Laboratories Europe GmbH; Universidad De Murcia
- Inventors: Dimitrios Papamartzivanos; Roberto Bifulco; Georgios Kambourakis; Felix Gomez Marmol
- Web page: https://patentgrep.com/patent/US12003522B2

## CPC

- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- G06F 8/60: Software deployment
- G06F 21/55: Detecting local intrusion or implementing counter-measures
- G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}
- G06N 3/088: Non-supervised learning, e.g. competitive learning
- H04L 63/1433: {Vulnerability analysis}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

A method adapts network intrusion detection. The method includes: a) deploying a network traffic capture system and collecting network packet traces; b) using a network audit tool, extracting features from the collected network packet traces; c) feeding the extracted features as unlabeled data into a representation function, and, utilizing the representation function as an unsupervised feature learning algorithm, learning a new representation of the unlabeled data; d) providing a labeled training set capturing examples of malicious network traffic, and, using the learned new representation of the unlabeled data, modifying the labeled training set to obtain a new training set; and e) using the new training set, training a traffic classification machine learning model.

## Claims

### Claim 1

A method for adaptive network intrusion detection, the method comprising:
a) deploying a network traffic capture system and collecting network packet traces;
b) using a network audit tool, extracting features from the collected network packet traces;
c) feeding the extracted features as unlabeled data into a representation function, and, utilizing the representation function as an unsupervised feature learning algorithm, learning a new representation of the unlabeled data;
d) providing a labeled training set capturing examples of malicious network traffic, and, using the learned new representation of the unlabeled data, modifying the labeled training set to obtain a new training set; and
e) using the new training set, training a traffic classification machine learning model.

### Claim 2 (depends on 1)

The method according to claim 1, wherein the representation function is an autoencoder neural network.

### Claim 3 (depends on 1)

The method according to claim 1, wherein the method further comprises:
using live traffic for the traffic classification machine learning model and deploying the traffic classification machine learning model for examining the live traffic.

### Claim 4 (depends on 3)

The method according to claim 3, wherein before using the live traffic for the traffic classification machine learning model, extracting features from the live traffic and modifying the live traffic's extracted features using the new representation of the unlabeled data learned in operation c).

### Claim 5 (depends on 1)

The method according to claim 1, wherein operations c)-e) are repeated to adapt to network traffic changes.

### Claim 6 (depends on 1)

The method according to claim 1, further comprising:
collecting, by network mappers of a monitoring subsystem, information about network characteristics, comprising a network topology, available hosts, running services, open ports, operating systems, or potential vulnerabilities.

### Claim 7 (depends on 6)

The method according to claim 6, further comprising, by the monitoring subsystem:
determining, based on the collected information, a need for adaptation, and issuing an adaptation signal towards the network audit tool for triggering execution of operations c)-e).

### Claim 8 (depends on 1)

The method according to claim 1, wherein the traffic classification machine learning model is based on a supervised learning method that uses of a support vector machine to deliver a multi-classification detection model.

### Claim 9

A system for adaptive network intrusion detection, the system comprising:
one or more hardware processors which, alone or in combination, are configured to:
extract features from network packet traces;
receive, from the network audit tool, the extracted features as unlabeled data, execute an unsupervised feature learning algorithm to learn a new representation of the unlabeled data, receive a labeled training set capturing examples of malicious network traffic, and use the learned new representation of the unlabeled data to modify the labeled training set to obtain a new training set; and
train a traffic classification model using the new training set.

### Claim 10 (depends on 9)

The system of claim 9, further comprising:
a planning subsystem that is configured to deploy the traffic classification machine learning model to examine live traffic on the network.

### Claim 11 (depends on 10)

The system according to claim 10, wherein the planning subsystem is further configured to extract features from the live traffic and to modify the live traffic's extracted features using the new representation of the unlabeled data learned by the execution of the unsupervised feature learning algorithm, before using the live traffic for the traffic classification machine learning model.

### Claim 12 (depends on 9)

The system according to claim 9, further comprising:
a monitoring subsystem comprising one or more network mappers, the network mappers being configured to collect information about network characteristics, comprising a network topology, available hosts, running services, open ports, operating systems, or potential vulnerabilities.

### Claim 13 (depends on 12)

The system according to claim 12, wherein the monitoring subsystem is further configured:
to determine, based on the collected information, a need for adaptation, and
to issue an adaptation signal towards the network audit tool for triggering activation of the representation function, the representation function preferably being an autoencoder neural network.

### Claim 14 (depends on 9)

The system according to claim 9, further comprising:
a repository that is configured to store collected network traffic and to hold the labeled training set.

### Claim 15 (depends on 9)

The system according to claim 9, further comprising a detection subsystem comprising:
a network audit tool that is configured to receive network traffic and to translate received network traffic into machine learning-ready instances, and
a feedforward autoencoder that is configured to receive the machine learning-ready instances from the network audit tool, and to acquire the same representation of the instances as the new training set, before the network traffic passes through a detection model.

### Claim 16 (depends on 9)

The system according to claim 9, further comprising a network traffic capture system configured to collect the network packet traces.

### Claim 17 (depends on 9)

The system according to claim 9, wherein the new training set is a labeled training set that is a new representation of the labeled training dataset.

### Claim 18 (depends on 1)

The method according to claim 1, wherein the new training set is a labeled training set that is a new representation of the labeled training dataset.