US 12,592,955 B2Granted

System and method for network intrusion detection using a neural network implemented by a local computing system

AssigneeBank of America Corporation

InventorsNgoc Anh Tran, Manimaran Sundaravel, Maneesh Kumar Sethia

Life of this patent

Estimating the term…

Loading patent…

Abstract

A method includes intercepting requests. The requests are analyzed to identify authenticated requests. Remaining requests are identified as suspicious requests. The suspicious requests are grouped into request groups based on respective geolocation information. A first rate of requests is determined for a first request group. In response to determining that the first rate of requests is less than or equal to a request rate threshold, parameters of a first suspicious request of the first request group are analyzed to determining values of the parameters. In response to determining that the values of the parameters are not within respective acceptable parameter value ranges, the first suspicious request is analyzed using a neural network to identify if the first suspicious request is legitimate or malicious. In response to identifying that the first suspicious request is malicious, a first notification indicating that the first suspicious request is identified as malicious is send.

Claims20

Dependent claims

A system comprising:

a memory configured to store:
a request rate threshold;
and
acceptable parameter value ranges for parameters of a legitimate request, wherein the legitimate request comprises a request that originates from an authenticated user;
and
a processor communicatively coupled to the memory, the processor configured to implement a neural network module, wherein the processor is configured to:
intercept a plurality of requests corresponding network packets directed to a service provider system for a first duration, wherein each request comprises a request for a service from the service provider system;
analyze the plurality of requests to identify authenticated requests from the plurality of requests, wherein the authenticated requests originate from one or more authenticated users;
identify remaining requests as suspicious requests;
analyze each suspicious request to determine respective geolocation information of a respective location from which each suspicious request originates;
group the suspicious requests into a plurality of request groups based on the determined geolocation information, wherein:
a first request group is associated with a first geolocation information and comprises a first plurality of suspicious requests associated with the first geolocation information;
and
a second request group is associated with a second geolocation information and comprises a second plurality of suspicious requests associated with the second geolocation information, wherein the second geolocation information is different from the first geolocation information;
determine a first rate of requests for the first request group;
determine a second rate of requests for the second request group;
and in response to determining that the first rate of requests for the first request group is less than or equal to the request rate threshold:
analyze parameters of a first suspicious request of the first request group to determine values of the parameters of the first suspicious request;
and
in response to determining that the values of the parameters of the first suspicious request are not within respective acceptable parameter value ranges:
analyze the first suspicious request using the neural network module to identify if the first suspicious request is legitimate or malicious;
and
in response to identifying that the first suspicious request is malicious:
prevent the malicious request from being communicated to the service provider system by adding the values of the parameters of the malicious request to a block list;
and
send a first notification that the first suspicious request is identified as malicious.

23 more elements

A method comprising:

intercepting a plurality of requests corresponding network packets directed to a service provider system for a first duration, wherein each request comprises a request for a service from the service provider system;
analyzing the plurality of requests to identify authenticated requests from the plurality of requests, wherein the authenticated requests originate from one or more authenticated users;
identifying remaining requests as suspicious requests;
analyzing each suspicious request to determine respective geolocation information of a respective location from which each suspicious request originates;
grouping the suspicious requests into a plurality of request groups based on the determined geolocation information, wherein:
a first request group is associated with a first geolocation information and comprises a first plurality of suspicious requests associated with the first geolocation information;
and
a second request group is associated with a second geolocation information and comprises a second plurality of suspicious requests associated with the second geolocation information, wherein the second geolocation information is different from the first geolocation information;
determining a first rate of requests for the first request group;
determining a second rate of requests for the second request group;
and
in response to determining that the first rate of requests for the first request group is less than or equal to a request rate threshold:
analyzing parameters of a first suspicious request of the first request group to determining values of the parameters of the first suspicious request;
and
in response to determining that the values of the parameters of the first suspicious request are not within respective acceptable parameter value ranges:
analyzing the first suspicious request using a neural network to identify if the first suspicious request is legitimate or malicious;
and
in response to identifying that the first suspicious request is malicious:
preventing the malicious request from being communicated to the service provider system by adding the values of the parameters of the malicious request to a block list;
and
sending a first notification that the first suspicious request is identified as malicious.

18 more elements

A non-transitory computer-readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to:

intercept a plurality of requests corresponding network packets directed to a service provider system for a first duration, wherein each request comprises a request for a service from the service provider system;
analyze the plurality of requests to identify authenticated requests from the plurality of requests, wherein the authenticated requests originate from one or more authenticated users;
identify remaining requests as suspicious requests;
analyze each suspicious request to determine respective geolocation information of a respective location from which each suspicious request originates;
group the suspicious requests into a plurality of request groups based on the determined geolocation information, wherein:
a first request group is associated with a first geolocation information and comprises a first plurality of suspicious requests associated with the first geolocation information;
and
a second request group is associated with a second geolocation information and comprises a second plurality of suspicious requests associated with the second geolocation information, wherein the second geolocation information is different from the first geolocation information;
determine a first rate of requests for the first request group;
determine a second rate of requests for the second request group;
and
in response to determining that the first rate of requests for the first request group is less than or equal to a request rate threshold:
analyze parameters of a first suspicious request of the first request group to determine values of the parameters of the first suspicious request;
and
in response to determining that the values of the parameters of the first suspicious request are not within respective acceptable parameter value ranges:
analyze the first suspicious request using a neural network to identify if the first suspicious request is legitimate or malicious;
and
in response to identifying that the first suspicious request is malicious:
prevent the malicious request from being communicated to the service provider system by adding the values of the parameters of the malicious request to a block list;
and
send a first notification that the first suspicious request is identified as malicious.

18 more elements

Dependencies are inferred from the claim text.

Facts

Application: 18/473,000Filed 22 Sep 2023
Published: US 2025/0106238 A127 Mar 2025
Granted: 31 Mar 2026
Term ends: Not estimatedThe source records don’t support an estimate.

Classification5 codes

H04L 63/1433
For detecting or protecting against malicious traffic: vulnerability analysis
H04L 41/16
Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks: using machine learning…
H04L 63/1416
By monitoring network traffic: event detection, e.g. attack signature detection
H04L 63/1425
By monitoring network traffic: traffic logging, e.g. anomaly detection