Data compression with signature-based intrusion detection

A method for data compression with intrusion detection, comprising the steps of:

• receiving anomalous event data, the anomalous event data comprising a computed divergence of a data stream, a computed first probability distribution of the data stream, and one or more codewords;
• comparing the anomalous event data to a database, the database comprising a plurality of signatures, the plurality of signatures comprising statistical information associated with a plurality of known vulnerabilities;
• when the comparison yields a match:
• generating an intrusion alert, the intrusion alert comprising the anomalous event data;
• and
• sending the intrusion alert to a security monitoring system.

A non-transitory computer-readable medium comprising a plurality of programming instructions that, when operating on a plurality of computing devices each comprising at least a processor, a memory, and a network interface, cause the plurality of computing devices to:

• receive anomalous event data, the anomalous event data comprising a computed divergence of a data stream, a computed first probability distribution of the data stream, and one or more codewords;
• compare the anomalous event data to a database, the database comprising a plurality of signatures, the plurality of signatures comprising statistical information associated with a plurality of known vulnerabilities;
• and
• when the comparison yields a match:
• generate an intrusion alert, the intrusion alert comprising the anomalous event data;
• and send the intrusion alert to a security monitoring system.