Methods and apparatus for monitoring network events for intrusion detection

An apparatus, comprising:

• a processor;
• and
• a memory operatively coupled to the processor, the processor configured to:
• receive a first dataset that includes an indication of a plurality of network events, each network event from the plurality of network events associated with a value indicating significance of that network event;
• generate a second dataset based on the value indicating significance for each network event from the plurality of network events;
• perform a discrete Fourier transform based on the second dataset to generate a third dataset that includes an indication of a plurality of frequency ranges;
• and
• determine, based on a comparison between the plurality of frequency ranges and the first dataset, a set of attributes associated with a network event from the plurality of network events determined to cause a periodic behavior,
• wherein the set of attributes is a first set of attributes determined at a first time, and the processor is further configured to:
• fail to determine a second set of attributes determined to cause the periodic behavior at a second time prior to the first time, the second set of attributes including more attributes than the first set of attributes.

A method, comprising:

• converting, via a processor, a plurality of sets of events associated with a first device into a time series, each set of events from the plurality of sets of events associated with the first device and a second device from a plurality of second devices that is different for remaining sets of events from the plurality of sets of events and does not include the first device;
• normalizing, via the processor, the time series to generate a normalized time series;
• performing, via the processor, a discrete Fourier transform based on providing the normalized time series as input to the discrete Fourier transform to generate an output;
• identifying, via the processor and based on the output, an attribute associated with an event from a set of events from the plurality of sets of events that is predicted to cause a periodic behavior;
• and sending, via the processor, a signal to cause an output including representation of the attribute.