Apparatus method and medium for detecting payload anomaly using n-gram distribution of normal data

A system for detecting anomalous payloads transmitted through a network, comprising:

• a computer coupled to the network, and receiving at least one payload through the network;
• and
• one or more model distributions representative of normal payloads received through the network;
• said computer being configured to:
• determine a length for data contained in said at least one payload,
• generate a byte value statistical distribution of data contained in said at least one payload received within the network,
• selecting, from the one or more model distributions, a model byte value statistical distribution based at least in part on the determined length, wherein the model byte value statistical distribution has a predetermined length range and is selected such that the determined length for the data contained in the at least one payload is included in the predetermined length range;
• compare at least one portion of said generated byte value statistical distribution to a corresponding portion of said selected model byte value statistical distribution of said one or more model distributions, and
• identify whether said at least one payload is an anomalous payload based, at least in part, on differences detected between the at least one portion of the byte value statistical distribution for said at least one payload and the corresponding portion of said selected byte value model distribution.

A computer readable storage medium storing instructions executable by a computer for modeling payload data received in a network, the instructions causing said computer to perform the method of:

• receiving at least one payload through the network;
• determining a length for data contained in the at least one payload;
• generating a byte value statistical distribution of data contained in the at least one payload received within the network;
• selecting, from a plurality of model byte value statistical distributions, a model byte value statistical distribution representative of normal payloads transmitted through the network based at least in part on the determined length, wherein the model byte value statistical distribution has a predetermined length range and is selected such that the determined length for the data contained in the at least one payload is included within the predetermined length range;
• comparing at least one portion of the generated statistical distribution to a corresponding portion of the selected model distribution;
• and
• identifying whether the at least one payload is an anomalous payload based, at least in part, on differences detected between the at least one portion of the byte value statistical distribution for said the at least one payload and the corresponding portion of the selected model distribution.

A system for detecting anomalous payloads transmitted through a network, comprising:

• means for receiving at least one payload through the network;
• means for determining a length for data contained in said at least one payload;
• means for generating a byte value statistical distribution of data contained in said at least one payload received within the network;
• means for selecting, from a plurality of model byte value statistical distributions, a model byte value statistical distribution representative of normal payloads transmitted through the network based at least in part on the determined length, wherein the model byte value statistical distribution has a predetermined length range and is selected such that the determined length for the data contained in the at least one payload is included within the predetermined length range;
• means for comparing at least one portion of the generated statistical distribution to a corresponding portion of the selected model distribution;
• and
• means for identifying whether the at least one payload is an anomalous payload based, at least in part, on differences detected between the at least one portion of the byte value statistical distribution for said the at least one payload and the corresponding portion of said the selected model distribution.