Systems and methods of adaptively securing network communication channels

A method for monitoring suspicious communication network traffic comprising:

• obtaining data associated with a sequence of communication events transmitted via the communication network;
• determining, based on the obtained data, an entropy approximation measure associated with at least one event attribute for the sequence of communication events;
• generating a threat prediction value based on an anomaly classification model and the entropy approximation measure associated with the sequence of communication events, wherein the anomaly classification model is trained based on prior sequences of communication events to identify a non-outlier anomaly range associated with the at least one event attribute, and wherein the threat prediction value is generated based on classification of the entropy approximation measure relative to the non-outlier anomaly range associated with the at least one attribute for identifying a potential threat;
• and
• transmitting a signal for communicating that the sequence of communication events is a potential threat within the communication network based on the threat prediction value,
• wherein the entropy approximation measure includes a compression metric based on a compression ratio of the data associated with the sequence of communication events.

A non-transitory computer-readable medium or media having stored thereon machine interpretable instructions which, when executed by a processor, cause the processor to perform a computer-implemented method for monitoring suspicious communication network traffic, the method comprising:

• obtaining data associated with a sequence of communication events transmitted via the communication network;
• determining, based on the obtained data, an entropy approximation measure associated with at least one event attribute for the sequence of communication events;
• generating a threat prediction value based on an anomaly classification model and the entropy approximation measure associated with the sequence of communication events, wherein the anomaly classification model is trained based on prior sequences of communication events to identify a non-outlier anomaly range associated with the at least one event attribute, and wherein the threat prediction value is generated based on classification of the entropy approximation measure relative to the non-outlier anomaly range associated with the at least one attribute for identifying a potential threat;
• and
• transmitting a signal for communicating that the sequence of communication events is a potential threat within the communication network based on the threat prediction value,
• wherein the entropy approximation measure includes a compression metric based on a compression ratio of the data associated with the sequence of communication events.

A system for monitoring suspicious communication network traffic comprising:

• a processor;
• and
• a memory coupled to the processor and storing processor-executable instructions that, when executed, configure the processor to:
• obtain data associated with a sequence of communication events transmitted via the communication network;
• determine, based on the obtained data, an entropy approximation measure associated with at least one event attribute for the sequence of communication events;
• determine that the sequence of communication events is generated by a computing agent based on prior domain knowledge and the entropy approximation measure, the prior domain knowledge based on an anomaly classification model trained based on prior sequences of communication events to identify a non-outlier anomaly range associated with the at least one event attribute;
• and
• transmit a signal for communicating that the sequence of communication events is a potential anomaly generated by a computing agent based on the prior domain knowledge,
• wherein the entropy approximation measure is based on a compression ratio of the data associated with the sequence of communication events.