US 12,592,946 B1Granted

Dynamic detection of abnormal network activity

AssigneeAmazon Technologies, Inc.

InventorsCatherine Watkins, Wayne Alan Fullen, Jared Sylvester, Patrick Collard, Evripidis Paraskevas, Jacob Nguyen, John Paul Schweitzer, Luke Kenneth Schubert, Michael Lowney, Parnavi Tamhankar, Stephen Goodman, William Kupersanin, Ravi Karnam, Sai Srinivas Vemula, Sameer Anil Murudkar

Life of this patent

Estimating the term…

patentgrep

Loading patent…

Abstract

Approaches presented herein relate to the monitoring of network traffic, and identification of potentially malicious behavior, in a networked resource environment. Values for key features of interest can be extracted from monitored network traffic. This data can be aggregated for one or more data dimensions, such as for a given region, and modeling can be performed to generate distributions for those values in that region. A threshold can be applied to this distribution to identify anomalous activity, where the same threshold can be applied to distributions for different regions and the values that meet or exceed that threshold will differ across regions based at least in part upon different levels of activity or different behavior. Such an approach scales with changes in the amount or type of traffic to be monitored, and can handle very large numbers of resources and volumes of traffic. If potentially malicious behavior is identified, one or more remedial or mitigation actions may be taken.

Claims20

Dependent claims

A computer-implemented method, comprising:

monitoring network traffic for a group of computing resources in a selected region, of a plurality of regions, in a shared resource environment;
aggregating data, for a selected feature, over sources of the network traffic for a recent period of time;
modeling the aggregated data to generate a cumulative distribution function for the selected feature in the selected region over the recent period of time, wherein the modeling is performed dynamically through updates to the cumulative distribution function over different periods of time;
applying a threshold, which represents the plurality of regions and which remains unchanged for the updates to the cumulative distribution function, to the cumulative distribution function, the threshold representing at least one maximum value for the selected feature and corresponding to at least one normal activity level for the selected region;
identifying a source of a portion of the network traffic for which a respective value of the selected feature exceeds the threshold for the selected region using the at least one maximum value, indicating a probability that the source is engaging in malicious behavior;
and
performing at least one mitigation action with respect to the identified source.

4 more elements

A computer-implemented method, comprising:

obtaining feature data, associated with a plurality of features of network traffic, for a group of computing resources in a selected region, of a plurality of regions, in a shared resource environment over a period of time;
performing modeling of the feature data to generate a feature distribution for the period of time, wherein the modeling able to be performed independent of a volume of the network traffic over the period of time, and wherein the modeling is performed dynamically through updates to the feature distribution over different periods of time;
applying a feature threshold which represents the plurality of regions, which remains unchanged for the updates to the feature distribution and which is associated with at least one maximum value for the feature distribution;
identifying a source of a portion of the network traffic for which a value of the feature data exceeds the feature threshold for the selected region using one of the at least one maximum value;
and
performing a determined action in response to the value of the feature data for the source being determined to exceed the feature threshold.

3 more elements

A system, comprising:

a processor;
and
memory including instructions that, when executed by the processor, cause the system to:
obtain feature data, associated with a plurality of features of network, traffic for a group of computing resources in a selected region, of a plurality of regions, in a shared resource environment over a period of time;
perform modeling of the feature data to generate a feature distribution for the period of time, wherein the modeling able to be performed independent of a volume of the network traffic over the period of time and wherein the modeling is performed dynamically through updates to the feature distribution over different periods of time;
apply a feature threshold which represents the plurality of regions, which remains unchanged for the updates to the feature distribution, and which is associated with at least one maximum value for the feature distribution;
identify a source of a portion of the network traffic for which a value of the feature data exceeds the feature threshold for the selected region using one of the at least one maximum value;
and
perform a determined action in response to the value of the feature data for the source exceeding the feature threshold.

6 more elements

Dependencies are inferred from the claim text.