# US 2016/0366169 A1 · Systems, methods, and media for detecting network anomalies > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2016/0366169 A1 - Document ID: US20160366169A1 - Status: Published application - Kind: A1 - Application number: 14/982,888 - Filed: 2015-12-29 - Published: 2016-12-15 - Earliest claimed: 2008-05-27 - Assignees: The Trustees of Columbia University in the City of New York - Inventors: Yingbo Song; Angelos D. Keromytis; Salvatore J. Stolfo - Web page: https://patentgrep.com/patent/US20160366169A1 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 69/16: Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems, methods, and media for detecting network anomalies are provided. In some embodiments, a training dataset of communication protocol messages having argument strings is received. The content and structure associated with each of the argument strings is determined and a probabilistic model is trained using the determined content and structure of each of the argument strings. A communication protocol message having an argument string that is transmitted from a first processor to a second processor across a computer network is received. The received communication protocol message is compared to the probabilistic model and then it is determined whether the communication protocol message is anomalous. ## Claims ### Claim 1 (canceled) ### Claim 2 A method for detecting network anomalies, the method comprising: receiving, by a hardware processor, a communication protocol message having an argument string that is transmitted from a first processor to a second processor across a computer network; applying a probabilistic model to the received communication protocol message to determine whether the communication protocol message is anomalous based on determining that at least one n-gram in the communication protocol message is anomalous, wherein the probabilistic model uses at least one Markov chain specified by one or more parameters to determine a probability that the argument string is anomalous based on n-grams in the argument string; and performing a predetermined action in response to determining that the communication protocol message is anomalous. ### Claim 3 (depends on 2) The method of claim 2, wherein the one or more parameters includes gram size, and wherein the probabilistic model was trained based on the gram size. ### Claim 4 (depends on 2) The method of claim 2, wherein the one or more parameters includes mixture size that specifies a number of Markov chains to use in the probabilistic model and wherein the at least one Markov chain is a mixture of Markov chains specified by the mixture size. ### Claim 5 (depends on 2) The method of claim 2, further comprising: receiving a plurality of packets transmitted from the first processor to the second processor across the computer network; assembling the plurality of packets to form the communication protocol message; and extracting the argument string from the communication protocol message. ### Claim 6 (depends on 2) The method of claim 2, wherein the communication protocol message is a Hypertext Transfer Protocol (HTTP) request message. ### Claim 7 (depends on 2) The method of claim 2, wherein the probabilistic model was trained based on content and structure of the argument string included in each of a plurality of communication protocol messages. ### Claim 8 (depends on 7) The method of claim 7, wherein the content and the structure associated with each of the argument strings further comprises one or more variable names, a corresponding argument value for each of the variable names, and a layout with respect to each of the variable names. ### Claim 9 (depends on 2) The method of claim 2, wherein the at least one Markov chain comprises one or more Markov models of transition probabilities in n-grams of the communication protocol message. ### Claim 10 (depends on 2) The method of claim 2, wherein the predetermined action comprises issuing an alert. ### Claim 11 (depends on 2) The method of claim 2, wherein applying the probabilistic model further comprises calculating a normality score for the received communication protocol message using the probabilistic model. ### Claim 12 A system for detecting network anomalies, the system comprising: a hardware processor that is configured to: receive a communication protocol message having an argument string that is transmitted from a first processor to a second processor across a computer network; apply a probabilistic model to the received communication protocol message to determine whether the communication protocol message is anomalous based on determining that at least one n-gram in the communication protocol message is anomalous, wherein the probabilistic model uses at least one Markov chain specified by one or more parameters to determine a probability that the argument string is anomalous based on n-grams in the argument string; and perform a predetermined action in response to determining that the communication protocol message is anomalous. ### Claim 13 (depends on 12) The system of claim 12, wherein the one or more parameters includes gram size, and wherein the probabilistic model was trained based on the gram size. ### Claim 14 (depends on 12) The system of claim 12, wherein the one or more parameters includes mixture size that specifies a number of Markov chains to use in the probabilistic model and wherein the at least one Markov chain is a mixture of Markov chains specified by the mixture size. ### Claim 15 (depends on 12) The system of claim 12, wherein the hardware processor is further configured to: receive a plurality of packets transmitted from the first processor to the second processor across the computer network; assemble the plurality of packets to form the communication protocol message; and extract the argument string from the communication protocol message. ### Claim 16 (depends on 12) The system of claim 12, wherein the communication protocol message is a Hypertext Transfer Protocol (HTTP) request message. ### Claim 17 (depends on 12) The system of claim 12, wherein the probabilistic model was trained based on content and structure of the argument string included in each of a plurality of communication protocol messages. ### Claim 18 (depends on 17) The system of claim 17, wherein the content and the structure associated with each of the argument strings further comprises one or more variable names, a corresponding argument value for each of the variable names, and a layout with respect to each of the variable names. ### Claim 19 (depends on 12) The system of claim 12, wherein the at least one Markov chain comprises one or more Markov models of transition probabilities in n-grams of the communication protocol message. ### Claim 20 (depends on 12) The system of claim 12, wherein the predetermined action comprises issuing an alert. ### Claim 21 (depends on 12) The system of claim 12, wherein the hardware processor further configured to calculate a normality score for the received communication protocol message using the probabilistic model. ### Claim 22 A non-transitory computer-readable medium containing computer-executable instructions that, when executed by a processor, cause the processor to perform method for detecting network anomalies, the method comprising: receiving a communication protocol message having an argument string that is transmitted from a first processor to a second processor across a computer network; applying a probabilistic model to the received communication protocol message to determine whether the communication protocol message is anomalous based on determining that at least one n-gram in the communication protocol message is anomalous, wherein the probabilistic model uses at least one Markov chain specified by one or more parameters to determine a probability that the argument string is anomalous based on n-grams in the argument string; and performing a predetermined action in response to determining that the communication protocol message is anomalous.