Structures and methods for a low and slow network reconnaissance detector

A structure comprising:

• a memory;
• means for converting a non-uniformly sampled discrete network intrusion event time series for a network intrusion event into a uniformly sampled network intrusion event time series, wherein said means for converting comprises:
• specifying a bucket for use in obtaining said uniformly sampled network intrusion event time series;
• detecting said network intrusion event;
• and
• counting all occurrences of said network intrusion event in said bucket as a single occurrence for said bucket so that said bucket has a state of one of occurrence and no occurrence;
• and
• means for determining a frequency characteristic for said network intrusion event based upon said uniformly sampled network intrusion event time series wherein said frequency characteristic is an average frequency of said network intrusion event.

A computer-program product comprising a computer-readable medium containing computer program code for a method comprising:

• converting a non-uniformly sampled discrete network intrusion event time series for a network intrusion event into a uniformly sampled network intrusion event time series, wherein said converting comprises:
• specifying a bucket for use in obtaining said uniformly sampled network intrusion event time series;
• detecting said network intrusion event;
• and
• counting all occurrences of said network intrusion event in said bucket as a single occurrence for said bucket so that said bucket has a state of one of occurrence and no occurrence;
• and
• determining a frequency characteristic for said network intrusion event based upon said uniformly sampled network intrusion event time series wherein said frequency characteristic is an average frequency of said network intrusion event.

A system comprising:

• a processor;
• and
• a memory coupled to said processor, and having stored therein instructions for a method for characterizing events on a network wherein upon execution of said instructions using said processor, said method comprises:
• converting a non-uniformly sampled discrete network intrusion event time series for a network intrusion event into a uniformly sampled network intrusion event time series, wherein said converting comprises:
• specifying a bucket for use in obtaining said uniformly sampled network intrusion event time series;
• detecting said network intrusion event;
• and
• counting all occurrences of said network intrusion event in said bucket as a single occurrence for said bucket so that said bucket has a state of one of occurrence and no occurrence;
• and
• determining a frequency characteristic for said network intrusion event based upon said uniformly sampled network intrusion event time series wherein said frequency characteristic is an average frequency of said network intrusion event.

A structure comprising:

• a memory;
• a time dependent low-frequency low-amplitude network event reconnaissance detector, wherein said time dependent low-frequency low-amplitude network event reconnaissance detector detects low-frequency low-amplitude network intrusion events on a computer network, said time dependent low-frequency low-amplitude network event reconnaissance detector including:
• a low-frequency low-amplitude attenuation function module including a low-frequency low-amplitude attenuation function,
• wherein said low-frequency low-amplitude attention function (i) receives occurrences of said network intrusion event as an input signal, and (ii) generates an output signal, wherein multiple occurrences of said network intrusion event within a unit of time are considered as a single occurrence;
• and
• an update detector output with system compensation function module, coupled to said low-frequency low-amplitude attenuation function module, including a system compensation function,
• wherein said system compensation function (i) receives said output signal of said low-amplitude attenuation function module, and (ii) generates an anomalous packet indicator output signal that is a time-dependent signal;
• and
• said system compensation function compensates for bursts of activity of said network instruction event separated by periods of time.

A method comprising:

• processing computer network intrusion events using an attenuation function to generate an indicator of a number of occurrences of a network intrusion event having a particular characteristic, wherein said processing further comprises:
• setting said indicator to an initial value on a first occurrence of said network intrusion event;
• decreasing said indicator, by said attenuation function, in response to each subsequent occurrence of said network intrusion event following said first occurrence of said network intrusion event;
• and
• identifying said network intrusion event as a low-amplitude low-frequency network event when said indicator has a specified relationship with a threshold at a given point in time.

A computer-program product comprising a computer-readable medium containing computer program code for a method comprising:

• processing computer network intrusion events using an attenuation function to generate an indicator of a number of occurrences of a network intrusion event having a particular characteristic, wherein said processing further comprises:
• setting said indicator to an initial value on a first occurrence of said network intrusion event;
• decreasing said indicator, by said attenuation function, in response to each subsequent occurrence of said network intrusion event following said first occurrence of said network intrusion event;
• and
• identifying said network intrusion event as a low-amplitude low-frequency network event when said indicator has a specified relationship with a threshold at a given point in time.

A structure comprising:

• a memory;
• means for processing computer network intrusion events using an attenuation function to generate an indicator of a number of occurrences of a network intrusion event having a particular characteristic, wherein said means for processing further comprises:
• setting said indicator to an initial value on a first occurrence of said network intrusion event;
• decreasing said indicator, by said attenuation function, in response to each subsequent occurrence of said network intrusion event following said first occurrence of said network intrusion event;
• and
• means for identifying said network intrusion event as a low-amplitude low-frequency network event when said indicator has a specified relationship with a threshold at a given point in time.

A system comprising:

• a processor;
• and
• a memory coupled to said processor, and having stored therein instructions for a method for characterizing events on a network wherein upon execution of said instructions using said processor, said method comprises:
• processing computer network intrusion events using an attenuation function to generate an indicator of a number of occurrences of a network intrusion event having a particular characteristic, wherein said processing further comprises:
• setting said indicator to an initial value on a first occurrence of said network intrusion event;
• decreasing said indicator, by said attenuation function, in response to each subsequent occurrence of said network intrusion event following said first occurrence of said network intrusion event;
• and
• identifying said network intrusion event as a low-amplitude low-frequency network intrusion event when said indicator has a specified relationship with a threshold at a given point in time.

A method comprising:

• processing computer network intrusion events using an attenuation function to generate an indicator of a number of occurrences wherein an occurrence is when one or more network intrusion events having a particular characteristic occur in a time interval, wherein said processing further comprises:
• setting said indicator to an initial value on a first occurrence of said network intrusion event;
• decreasing said indicator, by said attenuation function, in response to each subsequent occurrence of said network intrusion event following said first occurrence of said network intrusion event;
• processing said indicator using a system compensation function to generate a time-dependent indicator wherein said system compensation function compensates for bursts of occurrences of said network instruction event separated by periods of time;
• and
• identifying said network intrusion event as a low-amplitude low-frequency network event when said time-dependent indicator has a specified relationship with a threshold at a given point in time.

A computer-program product comprising a computer-readable medium containing computer program code for a method comprising:

• processing computer network intrusion events using an attenuation function to generate an indicator of a number of occurrences wherein an occurrence is when one or more network intrusion events having a particular characteristic occur in a time interval, wherein said processing further comprises:
• setting said indicator to an initial value on a first occurrence of said network intrusion event;
• decreasing said indicator, by said attenuation function, in response to each subsequent occurrence of said network intrusion event following said first occurrence of said network intrusion event;
• processing said indicator using a system compensation function to generate a time-dependent indicator wherein said system compensation function compensates for bursts of occurrences of said network instruction event separated by periods of time;
• and
• identifying said network intrusion event as a low-amplitude low-frequency network event when said time-dependent indicator has a specified relationship with a threshold at a given point in time.

A structure comprising:

• a memory;
• means for processing computer network intrusion events using an attenuation function to generate an indicator of a number of occurrences wherein an occurrence is when one or more network intrusion events having a particular characteristic occur in a time interval, wherein said means for processing further comprises:
• setting said indicator to an initial value on a first occurrence of said network intrusion event;
• decreasing said indicator, by said attenuation function, in response to each subsequent occurrence of said network intrusion event following said first occurrence of said network intrusion event;
• means for processing said indicator using a system compensation function to generate a time-dependent indicator wherein said system compensation function compensates for bursts of occurrences of said network instruction event separated by periods of time;
• and
• means for identifying said network intrusion event as a low-amplitude low-frequency network event when said time-dependent indicator has a specified relationship with a threshold at a given point in time.

A system comprising:

• a processor;
• and
• a memory coupled to said processor, and having stored therein instructions for a method for characterizing events on a network wherein upon execution of said instructions using said processor, said method comprises:
• processing computer network intrusion events using an attenuation function to generate an indicator of a number of occurrences wherein an occurrence is when one or more network intrusion events having a particular characteristic occur in a time interval, wherein said processing further comprises:
• setting said indicator to an initial value on a first occurrence of said network intrusion event;
• and
• decreasing said indicator, by said attenuation function, in response to each subsequent occurrence
• of said network intrusion event following said first
• occurrence of said network intrusion event;
• processing said indicator using a system compensation function to generate a time-dependent indicator wherein said system compensation function compensates for bursts of occurrences of said network instruction event separated by periods of time;
• and
• identifying said network intrusion event as a low-amplitude low-frequency network event when said time-dependent indicator has a specified relationship with a threshold at a given point in time.