Network intrusion detection
AssigneeCyberflow Analytics, Inc.
InventorsHossein ESLAMBOLCHI, Louie GASPARINI, Chandra MADHEKAR, William WRIGHT
Life of this patent
Estimating the term…
Abstract
A system for identifying a network intrusion includes four modules. The first module monitors network transmissions and creates a model of regular network activity. The second module receives the model of regular network activity and sets a threshold for irregular usage based on the model. The third module receives the threshold, compares a value of a candidate inter-nodal transmission of the network to the threshold, and identifies a potential intrusion when the value exceeds the threshold. The fourth module analyzes a transmission behavior of one or more nodes of the candidate inter-nodal transmission and identifies the network intrusion.
Claims27
1-14. (canceled)
A method for identifying a network intrusion comprising:
- creating a model of regular network activity by monitoring internet protocol headers of network transmissions;
- setting a threshold for irregular usage based on the model;
- comparing a value of a candidate inter-nodal transmission of the network to the threshold;
- identifying a potential intrusion when the value exceeds the threshold;
- and
- identifying the network intrusion by analyzing a transmission behavior of one or more nodes of the candidate inter-nodal transmission.
A non-transitory computer-readable recording medium encoded with a control program for identifying a network intrusion, the control program causing a computer to execute:
- creating a model of regular network activity by monitoring internet protocol headers of network transmissions;
- setting a threshold for irregular usage based on the model;
- comparing a value of a candidate inter-nodal transmission of the network to the threshold;
- identifying a potential intrusion when the value exceeds the threshold;
- and
- identifying the network intrusion by analyzing a transmission behavior of one or more nodes of the candidate inter-nodal transmission.
Dependencies are inferred from the claim text.