Dynamic transaction graph analysis
AssigneeNEC Laboratories America, Inc.
InventorsLuAn Tang, Jingchao Ni, Wei Cheng, Haifeng chen, Dongjin Song, Bo Zong, Wenchao Yu
Life of this patent
Estimating the term…
Abstract
Systems and methods for implementing dynamic graph analysis (DGA) to detect anomalous network traffic are provided. The method includes processing communications and profile data associated with multiple devices to determine dynamic graphs. The method includes generating features to model temporal behaviors of network traffic generated by the multiple devices based on the dynamic graphs. The method also includes formulating a list of prediction results for sources of the anomalous network traffic from the multiple devices based on the temporal behaviors.
Claims20
A method for implementing dynamic graph analysis (DGA) to detect anomalous network traffic, comprising:
- processing communications and profile data associated with a plurality of devices to determine at least one dynamic graph;
- generating, by a processor device, at least one feature to model temporal behaviors of network traffic generated by the plurality of devices based on the at least one dynamic graph;
- and
- formulating a list of prediction results for sources of anomalous network traffic from the plurality of devices based on the temporal behaviors.
A computer system for implementing dynamic graph analysis (DGA) to detect anomalous network traffic, comprising:
- a processor device operatively coupled to a memory device, the processor device being configured to:
- process communications and profile data associated with a plurality of devices to determine at least one dynamic graph;
- generate at least one feature to model temporal behaviors of network traffic generated by the plurality of devices based on the at least one dynamic graph;
- and
- formulate a list of prediction results for sources of anomalous network traffic from the plurality of devices based on the temporal behaviors.
A computer program product for implementing dynamic graph analysis (DGA) to detect anomalous network traffic, the computer program product comprising a non-transitory computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computing device to cause the computing device to perform the method comprising:
- processing communications and profile data associated with a plurality of devices to determine at least one dynamic graph;
- generating, by the computing device, at least one feature to model temporal behaviors of network traffic generated by the plurality of devices based on the at least one dynamic graph;
- and
- formulating a list of prediction results for sources of anomalous network traffic from the plurality of devices based on the temporal behaviors.
Dependencies are inferred from the claim text.