US 2017/0324759 A1 · NETWORK SAMPLING BASED PATH DECOMPOSITION AND ANOMALY DETECTION

Abstract

According to examples, network sampling based path decomposition and anomaly detection may include evaluating computer-generated log file data to generate a master network graph that specifies known events and transitions between the known events, and decomposing the master network graph to generate a representative network graph that includes a reduced number of paths of the master network graph. A source may be monitored to determine a cyber security threat by receiving incoming log file data related to the source, comparing the incoming log file data related to the source to the representative network graph, and determining, based on the comparison of the incoming log file data related to the source to the representative network graph, an anomaly in the representative network graph. Further, based on the monitoring, a report indicative of the cyber security threat may be generated based on the anomaly in the representative network graph.

Claims20

Dependent claims

A network sampling based path decomposition and anomaly detection system comprising:

at least one hardware processor:
a master network graph generator, executed by the at least one hardware processor, to evaluate computer-generated log file data to generate a master network graph that specifies known events and transitions between the known events;
a master network graph sampler, executed by the at least one hardware processor, to decompose the master network graph to generate a representative network graph that includes a reduced number of paths of the master network graph, wherein the reduced number of paths are selected with respect to probabilities of occurrence of the paths in the master network graph;
a source monitor, executed by the at least one hardware processor, to monitor a source to determine a cyber security threat by
receiving incoming log file data related to the source,
comparing the incoming log file data related to the source to the representative network graph, and
determining, based on the comparison of the incoming log file data related to the source to the representative network graph, an anomaly in the representative network graph;
and
an anomaly indicator, executed by the at least one hardware processor, to generate, based on the monitoring, a report indicative of the cyber security threat based on the anomaly in the representative network graph.

6 more elements

A method for network sampling based path decomposition and anomaly detection, the method comprising:

evaluating, by at least one hardware processor, computer-generated log file data to generate a master network graph that specifies known events and transitions between the known events;
decomposing, by the at least one hardware processor, the master network graph to generate a representative network graph that includes a reduced number of paths of the master network graph, wherein the reduced number of paths are selected with respect to probabilities of occurrence of the paths in the master network graph;
monitoring, by the at least one hardware processor, a source to determine a cyber security threat by
receiving incoming log file data related to the source,
comparing the incoming log file data related to the source to the representative network graph, and
determining, based on the comparison of the incoming log file data related to the source to the representative network graph, an anomaly in the representative network graph;
and
modifying, by the at least one hardware processor, an operational characteristic of the source based on the anomaly in the representative network graph.

5 more elements

A non-transitory computer readable medium having stored thereon machine readable instructions for network sampling based path decomposition and anomaly detection, the machine readable instructions when executed cause a processor to:

receive a master network graph that specifies known events and transitions between the known events;
decompose the master network graph to generate a representative network graph that includes a reduced number of paths of the master network graph, wherein the reduced number of paths are selected with respect to probabilities of occurrence of the paths in the master network graph;
receive incoming log file data;
compare the incoming log file data to the representative network graph;
and
determine, based on the comparison of the incoming log file data to the representative network graph, an anomaly in the representative network graph.

3 more elements

Dependencies are inferred from the claim text.

Network sampling based path decomposition and anomaly detection

Life of this patent

Network sampling based path decomposition and anomaly detection

Life of this patent

Abstract

Claims20