Non-harmful insertion of data mimicking computer network attacks
AssigneeTriad National Security, LLC
InventorsJoshua Neil, Alexander Kent, Curtis Hash, JR., Michael Fisk, Alexander Brugh, Curtis Storlie, Benjamin Uphoff
Life of this patent
Estimating the term…
Abstract
Non-harmful data mimicking computer network attacks may be inserted in a computer network. Anomalous real network connections may be generated between a plurality of computing systems in the network. Data mimicking an attack may also be generated. The generated data may be transmitted between the plurality of computing systems using the real network connections and measured to determine whether an attack is detected.
Claims20
A computer-implemented method, comprising:
- determining based on historical data, by a computing system, which anomalous real network connections to generate between a plurality of computing systems in a network to create the anomalous real network connections based on stochastic models, the anomalous real network connections forming a k-path between the plurality of computing systems comprising a plurality of directed edges, each directed edge comprising associated data;
- generating, by the plurality of computing systems, the determined anomalous real network connections between the plurality of computing systems in the network and data mimicking an attack;
- and
- sending, by the plurality of computing systems, the data mimicking the attack between the plurality of computing systems using the generated anomalous real network connections, wherein
- the k-path is a subgraph of size k that has diameter k, and
- k is at least two.
A computer program embodied on a non-transitory computer-readable medium, the computer program configured to cause at least one processor to:
- determine, based on historical data, which network connections to generate that form a k-path between a plurality of computing systems to create an anomaly by applying stochastic models for each edge in the k-path;
- generate the determined network connections in the k-path to create the anomaly;
- and
- send data mimicking an attack between the plurality of computing systems using the generated network connections, wherein
- the k-path is a subgraph of size k that has diameter k, and
- k is at least two.
A computer-implemented method, comprising:
- inserting, by a plurality of computing systems, traffic in a k-path in a network comprising computing systems that do not normally communicate, the traffic deviating from stochastic models for each edge of the k-path;
- and
- detecting the inserted k-path as anomalous, by a computing system, based on analysis of the inserted traffic, wherein
- the k-path comprises a plurality of directed edges, each directed edge comprising associated data,
- the k-path is a subgraph of size k that has diameter k, and
- k is at least two.
Dependencies are inferred from the claim text.