System for detecting anomalous network patterns based on analyzing network traffic data and method thereof

A computer-implemented method for detecting one or more anomalous network patterns based on analyzing network traffic data, comprising:

• aggregating, by one or more servers, the network traffic data received from one or more network endpoints into network flow data,
• the network flow data configured with one or more attributes;
• generating, by the one or more servers, one or more flow features for each packet associated with the aggregated network traffic data based on a rolling window-based analysis of the one or more attributes;
• analyzing, by the one or more servers, the one or more flow features by utilizing one or more deep-learning models to detect the one or more anomalous network patterns of one or more anomalies in the network traffic data to assign a first-stage numerical score to the one or more anomalies;
• and
• converting, by the one or more servers, the first-stage numerical score into a second-stage numerical score within a pre-defined range using time-series methods based on a dynamically altered threshold score using a cumulative distribution of the first-stage numerical score to detect the one or more anomalous network patterns derived from the analysis of network traffic data
• wherein generating the one or more flow features are configured with time-series methods, and
• the time-series methods are configured to compute smoothed estimates of averages and variances for the one or more flow features over pre-defined time windows, and
• the time-series methods comprise at least one of:
• exponential-weighted smoothing, and on-line cumulative distribution updating, and wherein
• the one or more servers are configured with an alert-generating module, and
• the alert-generating module is configured to generate an outlier alert if the second-stage numerical score exceeds the dynamically altered threshold score, indicating a presence of the one or more anomalous network patterns.

A non-transitory computer-readable storage medium having programmable instructions stored therein, that when executed by one or more servers, cause the one or more servers to:

• aggregating network traffic data received from one or more network endpoints into network flow data,
• the network flow data configured with one or more attributes;
• generating one or more flow features for each packet associated with the aggregated network traffic data based on a rolling window-based analysis of the one or more attributes;
• analyzing the one or more flow features by utilizing one or more deep-learning models to detect the one or more anomalous network patterns of one or more anomalies in the network traffic data to assign a first-stage numerical score to the one or more anomalies;
• and
• converting the first-stage numerical score into a second-stage numerical score within a pre-defined range using time-series methods based on a dynamically altered threshold score using a cumulative distribution of the first-stage numerical score to detect the one or more anomalous network patterns derived from the analysis of network traffic data,
• wherein generating the one or more flow features are configured with time-series methods, and
• the time-series methods are configured to compute smoothed estimates of averages and variances for the one or more flow features over pre-defined time windows, and
• the time-series methods comprise at least one of:
• exponential-weighted smoothing, and on-line cumulative distribution updating, and wherein
• the one or more servers are configured with an alert-generating module, and
• the alert-generating module is configured to generate an outlier alert if the second-stage numerical score exceeds the dynamically altered threshold score, indicating a presence of the one or more anomalous network patterns.