Systems, methods, and media for detecting network anomalies

A system for detecting network anomalies, the system comprising:

• a processor that is configured to:
• receive a communication protocol message having an argument string that is transmitted from a first processor to a second processor across a computer network;
• apply a probabilistic model to the received communication protocol message to determine whether the communication protocol message is anomalous based on determining that at least one n-gram in the communication protocol message is anomalous,
• wherein the probabilistic model uses at least one Markov chain specified by one or more parameters to determine a probability that the argument string is anomalous based on n-grams in the argument string, and
• wherein the probabilistic model was trained based on content and structure of an argument string included in each of a plurality of communication protocol messages included in a training dataset;
• and
• perform a predetermined action in response to determining that the communication protocol message is anomalous.

A non-transitory computer-readable medium containing computer-executable instructions that, when executed by a processor, cause the processor to perform method for detecting network anomalies, the method comprising:

• receiving a communication protocol message having an argument string that is transmitted from a first processor to a second processor across a computer network;
• applying a probabilistic model to the received communication protocol message to determine whether the communication protocol message is anomalous based on determining that at least one n-gram in the communication protocol message is anomalous,
• wherein the probabilistic model uses at least one Markov chain specified by one or more parameters to determine a probability that the argument string is anomalous based on n-grams in the argument string, and
• wherein the probabilistic model was trained based on content and structure of an argument string included in each of a plurality of communication protocol messages included in a training dataset;
• and
• performing a predetermined action in response to determining that the communication protocol message is anomalous.