Temporal behavior analysis of network traffic

A computer system for implementing sequence data based temporal behavior analysis (SDTBA) to extract features for characterizing temporal behavior of network traffic, comprising:

• a processor device operatively coupled to a memory device, the processor device being configured to:
• extract communication and profile data associated with at least e device to determine a plurality of sequences of data associated with the at least one device;
• generate at least one temporal feature to model anomalous network traffic;
• input, into at least one anomaly detection process for anomalous network traffic, the at least one temporal feature and the plurality of sequences of data associated with the at least one device;
• and
• formulate a list of prediction results of anomalous network traffic associated with the at least one device.

A computer program product for implementing sequence data based temporal behavior analysis (SDTBA) to extract features for characterizing temporal behavior of network traffic, the computer program product comprising a non-transitory computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computing device to cause the computing device to perform the method comprising:

• extracting communication and profile data associated with at least one device to determine a plurality of sequences of data associated with the at least one device;
• generating, by a processor device, at least one temporal feature to model anomalous network traffic;
• inputting, into at least one anomaly detection process for anomalous network traffic, the at least one temporal feature and the plurality of sequences of data associated with the at least one device;
• and
• formulating a list of prediction results of anomalous network traffic associated with the at least one device.