Network intrusion detection
AssigneeKnowledge Based Systems, Inc.
InventorsArthur Keen, Richard J. Mayer
Life of this patent
Estimating the term…
Abstract
Apparatus and systems, as well as methods and articles, may operate to monitor communications between network nodes coupled to each other via at least one network, and map the communications to one or more communications graphs which are physically distributed over a plurality of network hosts. Network intrusion is detected using distributed graph-based data mining with respect to a selected subgraph and the communications graphs. Other embodiments are described and claimed.
Claims20
A computer-implemented method, comprising:
- monitoring communications between network nodes coupled to each other via at least one network;
- mapping the communications to one or more communications graphs, wherein at least one of the one or more communication graphs is physically distributed over a plurality of network hosts;
- and
- detecting intrusion with respect to the at least one network using graph-based data mining (GDM) for a selected subgraph and the one or more communications graphs.
A machine-readable medium comprising instructions, which when executed by one or more processors, perform the following operations:
- monitoring communications between network nodes coupled to each other via at least one network;
- mapping the communications to one or more communications graphs, wherein at least one of the one or more communication graphs is physically distributed over a plurality of network hosts;
- and
- detecting intrusion with respect to the at least one network using graph-based data mining (GDM) for a selected subgraph and the one or more communications graphs.
A system, comprising:
- at least one network;
- and
- network nodes coupled to each other via the at least one network, wherein each one of a plurality of network hosts includes modules to monitor communications between some of the network nodes, map the communications to one or more communications graphs, wherein at least one of the one or more communication graphs is physically distributed over the plurality of network hosts, and detect intrusion with respect to the at least one network using graph-based data mining (GDM) for a selected subgraph and the one or more communications graphs.
Dependencies are inferred from the claim text.