# US 12,003,531 B2 · Quantile regression analysis method for detecting cyber attacks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,003,531 B2 - Document ID: US12003531B2 - Status: Granted - Kind: B2 - Application number: 18/296,227 - Filed: 2023-04-05 - Published: 2023-08-10 - Granted: 2024-06-04 - Earliest claimed: 2020-12-31 - Assignees: Radware, Ltd. - Applicants: Radware Ltd. - Inventors: Lev Medvedovsky; David Aviv - Web page: https://patentgrep.com/patent/US12003531B2 ## CPC - H04L 63/1458: {Denial of Service} - G06F 17/18: for evaluating statistical data {, e.g. average values, frequency distributions, probability functions, regression analysis (forecasting specially adapted for a specific administrative, business or logistic context G06Q10/04)} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1433: {Vulnerability analysis} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system and method for detecting cyber-attacks using quantile regression analysis are disclosed. The method includes: identifying at least one hit quantile out of a plurality of quantiles, wherein the at least one identified hit quantile falls within quantile edges of a sample of traffic directed at a protected entity, wherein each of the plurality of quantiles is characterized by a probability distribution of at least one feature of a data stream, each of the plurality of quantiles having a respective probability estimate; updating the probability estimates of the plurality of quantiles when the at least one hit quantile has been identified; and when the probability estimate of the at least one hit quantile is above a threshold, taking an action to mitigate existence of a cyber-attack. ## Claims ### Claim 1 A method for detecting cyber-attacks, comprising: identifying at least one hit quantile out of a plurality of quantiles, wherein the at least one identified hit quantile falls within quantile edges of a sample of traffic directed at a protected entity, wherein each of the plurality of quantiles is characterized by a probability distribution of at least one feature of a data stream, each of the plurality of quantiles having a respective probability estimate; updating the probability estimates of the plurality of quantiles when the at least one hit quantile has been identified; and when the probability estimate of the at least one hit quantile is above a threshold, taking an action to mitigate existence of a cyber-attack. ### Claim 2 (depends on 1) The method of claim 1, wherein the data stream is divided into the plurality of quantiles based on a first feature of each of the plurality of quantiles such that a sum of a second feature of each of the plurality of quantiles at each time interval demonstrates a substantially same probability. ### Claim 3 (depends on 2) The method of claim 2, wherein the first feature is an Internet Protocol (IP) address and the second feature is an attribute related to bandwidth. ### Claim 4 (depends on 2) The method of claim 2, wherein updating the probability estimates of the plurality of quantiles further comprises: updating an average of the second feature; and updating a probability buffer with last known history probability estimates. ### Claim 5 (depends on 2) The method of claim 2, wherein identifying the hit quantile further comprises: determining if a value of the first feature is within the quantile edges of a first quantile of the plurality of quantiles, wherein the hit quantile is identified as the first quantile for which the value of the first feature is within the quantile edges of the first quantile. ### Claim 6 (depends on 1) The method of claim 1, wherein the probability estimate of each quantile is a probability that the quantile receives a byte from the traffic directed to the protected entity. ### Claim 7 (depends on 1) The method of claim 1, further comprising: setting the threshold based on at least a lower detectable attack intensity factor. ### Claim 8 (depends on 1) The method of claim 1, further comprising: characterizing an attacker of the cyber-attack wherein characterizing the attacker further comprises generating a suspected list of IP addresses from which comes a most contribution to an increased bandwidth during the cyber-attack. ### Claim 9 (depends on 1) The method of claim 1, further comprising: updating, during peacetime, the quantile edges of each of the plurality of quantiles. ### Claim 10 A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process for detecting cyber-attacks, the process comprising: identifying at least one hit quantile out of a plurality of quantiles, wherein the at least one identified hit quantile falls within quantile edges of a sample of traffic directed at a protected entity, wherein each of the plurality of quantiles is characterized by a probability distribution of at least one feature of a data stream, each of the plurality of quantiles having a respective probability estimate; updating the probability estimates of the plurality of quantiles when the at least one hit quantile has been identified; and when the probability estimate of the at least one hit quantile is above a threshold, taking an action to mitigate existence of a cyber-attack. ### Claim 11 A system for detecting cyber-attacks, comprising: a processing circuitry; and a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to: identify at least one hit quantile out of a plurality of quantiles, wherein the at least one identified hit quantile falls within quantile edges of a sample of traffic directed at a protected entity, wherein each of the plurality of quantiles is characterized by a probability distribution of at least one feature of a data stream, each of the plurality of quantiles having a respective probability estimate; update the probability estimates of the plurality of quantiles when the at least one hit quantile has been identified; and when the probability estimate of the at least one hit quantile is above a threshold, take an action to mitigate existence of a cyber-attack. ### Claim 12 (depends on 11) The system of claim 11, wherein the data stream is divided into the plurality of quantiles based on a first feature of each of the plurality of quantiles such that a sum of a second feature of each of the plurality of quantiles at each time interval demonstrates a substantially same probability. ### Claim 13 (depends on 12) The system of claim 12, wherein the first feature is an Internet Protocol (IP) address and the second feature is an attribute related to bandwidth. ### Claim 14 (depends on 12) The system of claim 12, wherein updating the probability estimates of the plurality of quantiles further comprises: updating an average of the second feature; and updating a probability buffer with last known history probability estimates. ### Claim 15 (depends on 12) The system of claim 12, wherein the system is further configured to: determine if a value of the first feature is within the quantile edges of a first quantile of the plurality of quantiles, wherein the hit quantile is identified as the first quantile for which the value of the first feature is within the quantile edges of the first quantile. ### Claim 16 (depends on 11) The system of claim 11, wherein the probability estimate of each quantile is a probability that the quantile receives a byte from the traffic directed to the protected entity. ### Claim 17 (depends on 11) The system of claim 11, wherein the system is further configured to: set the threshold based on at least a lower detectable attack intensity factor. ### Claim 18 (depends on 11) The system of claim 11, wherein the system is further configured to: characterize an attacker of the cyber-attack wherein characterizing the attacker further comprises generating a suspected list of IP addresses from which comes a most contribution to an increased bandwidth during the cyber-attack. ### Claim 19 (depends on 11) The system of claim 11, wherein the system is further configured to: update, during peacetime, the quantile edges of each of the plurality of quantiles.