Creating aggregate network flow time series in network anomaly detection systems
AssigneeLevel 3 Communications, LLC
InventorSergey Yermakov
Life of this patent
Estimating the term…
Abstract
In an embodiment, a computer implemented method receives flow data for one or more flows that correspond to a device-circuit pair. The method calculates a time difference for each flow that corresponds to a device-circuit pair. Based on the calculated time differences and the received flow data, the method updates a probability distribution model associated with the device-circuit pair. Then, the method determines whether a time bucket is complete or open based on the updated probability distribution model.
Claims20
A computer implemented method for processing network flow data over a time series associated with a device-circuit pair, comprising:
- receiving, by a server, flow data for one or more flows that correspond to the device-circuit pair;
- calculating, by the server, a time difference for each flow of the one or more flows that correspond to the device-circuit pair;
- based on the calculated time differences and the received flow data, updating, by the server, a probability distribution model associated with the device-circuit pair;
- and
- determining, by the server, whether a time bucket, of the time series, is complete or open based on the updated probability distribution model.
A system for processing network flow data over a time series associated with a device-circuit pair, comprising:
- a memory;
- and
- at least one processor coupled to the memory and configured to:
- receive flow data for one or more flows that correspond to the device-circuit pair;
- calculate a time difference for each flow of the one or more flows that correspond to the device-circuit pair;
- based on the calculated time differences and the received flow data, update a probability distribution model associated with the device-circuit pair;
- and
- determine whether a time bucket, of the time series, is complete or open based on the updated probability distribution model.
A non-transitory computer-readable medium having instructions stored thereon that, when executed by at least one computing device, causes the at least one computing device to perform operations for processing network flow data over a time series associated with a device-circuit pair, comprising:
- receiving flow data for one or more flows that correspond to the device-circuit pair;
- calculating a time difference for each flow of the one or more flows that correspond to the device-circuit pair;
- based on the calculated time differences and the received flow data, updating a probability distribution model associated with the device-circuit pair;
- and
- determining whether a time bucket, of the time series, is complete or open based on the updated probability distribution model.
Dependencies are inferred from the claim text.