Quantile regression analysis method for detecting cyber attacks

A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process for detecting cyber-attacks, the process comprising:

• identifying at least one hit quantile out of a plurality of quantiles, wherein the at least one identified hit quantile falls within quantile edges of a sample of traffic directed at a protected entity, wherein each of the plurality of quantiles is characterized by a probability distribution of at least one feature of a data stream, each of the plurality of quantiles having a respective probability estimate;
• updating the probability estimates of the plurality of quantiles when the at least one hit quantile has been identified;
• and
• when the probability estimate of the at least one hit quantile is above a threshold, taking an action to mitigate existence of a cyber-attack.

A system for detecting cyber-attacks, comprising:

• a processing circuitry;
• and
• a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
• identify at least one hit quantile out of a plurality of quantiles, wherein the at least one identified hit quantile falls within quantile edges of a sample of traffic directed at a protected entity, wherein each of the plurality of quantiles is characterized by a probability distribution of at least one feature of a data stream, each of the plurality of quantiles having a respective probability estimate;
• update the probability estimates of the plurality of quantiles when the at least one hit quantile has been identified;
• and
• when the probability estimate of the at least one hit quantile is above a threshold, take an action to mitigate existence of a cyber-attack.