Intelligence Network Anomaly Detection Using A Type II Fuzzy Neural Network
AssigneeAlcatel
InventorsChiang Yeh, Jeremy Touve, R. Leon Sangroniz
Life of this patent
Estimating the term…
Abstract
A network device (e.g., layer 3 Ethernet switch) is described herein which interfaces with an anomaly detector that implements a type II fuzzy neural network to track symptoms of an attack (which is directed at a private network) and to suggest escalating corrective actions (which can be implemented by the network device) until the symptoms of the attack begin to disappear.
Claims18
An anomaly detector comprising a type II fuzzy neural network that tracks symptoms of an attack and suggests escalating corrective actions until the symptoms of the attack begin to disappear.
A method for addressing a symptom of an attack, said method comprising the steps of:
- collecting a plurality of network statistics;
- and
- processing each of the collected network statistics into a metric which is a fraction of the collected network statistic divided by a theoretical maximum of the collected network statistic;
- calculating a plurality of averages each of which is based on a unique set of the metrics and a rate of change of the unique set of the metrics;
- aggregating a unique set of the calculated averages;
- and
- comparing the aggregated calculated averages to values in an if-then-else decision rules table to determine an action to address the symptom of the attack.
A method for addressing a symptom of an attack, said method comprising the steps of:
- collecting a plurality of network statistics;
- processing each of the collected statistics into a fractional value;
- drawing a plurality of inferences by summing a plurality of unique sets of the fractional values which are associated with the processed collected statistics;
- aggregating the plurality of inferences;
- and
- making a decision in view of the aggregated inferences and an if-then-else decision rules table to address the symptom of the attack.
A method for allowing a network administrator to identify a new anomaly and then address one or more symptoms that are associated with the new anomaly, said method comprising the steps of:
- collecting a plurality of network statistics;
- and
- processing each of the collected network statistics into a metric which is a fraction of the collected network statistic divided by a theoretical maximum of the collected network statistic;
- calculating a plurality of averages each of which is based on a unique set of the metrics and a rate of change of the unique set of the metrics;
- aggregating a unique set of the calculated averages;
- and
- monitoring the collected network statistics, the calculated averages and/or the aggregated average to identify about the symptoms of the new anomaly;
- revising an if-then-else decision rules table to include one or more actions that can be performed based on the aggregated average to address the symptoms of the new anomaly.
Dependencies are inferred from the claim text.