Network intrusion detection
AssigneeKnowledge Based Systems, Inc.
InventorsArthur Keen, Richard J. Mayer
Life of this patent
Estimating the term…
Abstract
Apparatus and systems, as well as methods and articles, may operate to monitor communications between network nodes coupled to each other via at least one network, and map the communications to one or more communications graphs which are physically distributed over a plurality of network hosts. Network intrusion is detected using distributed graph-based data mining with respect to a selected subgraph and the communications graphs. Other embodiments are described and claimed.
Claims20
A computer-implemented method, comprising:
- monitoring communications between network nodes coupled to each other via at least one network;
- mapping the communications to one or more communications graphs, wherein at least one of the communication graphs is physically distributed over a plurality of mapping network hosts;
- computing relative frequency of discovered subgraphs representing behavior patterns within the communications graphs;
- and
- detecting indications of malicious behavior with respect to the at least one network without using signatures by identifying infrequent patterns of the behavior relative to frequent patterns of the behavior according to the relative frequency.
A non-transitory machine-readable medium comprising instructions, which when executed by one or more processors, perform the following operations:
- monitoring communications between network nodes coupled to each other via at least one network;
- mapping the communications to one or more communications graphs, wherein at least one of the communications graphs is physically distributed over a plurality of mapping network hosts;
- computing relative frequency of discovered subgraphs representing behavior patterns within the communications graphs;
- and
- detecting indications of malicious behavior with respect to the at least one network without using signatures by identify infrequent patterns of the behavior relative to frequent patterns of the behavior according to the relative frequency.
A system, comprising:
- at least one network;
- and
- network nodes coupled to each other via the at least one network, wherein each one of a plurality of mapping network hosts includes modules to monitor communications between some of the network nodes, map the communications to one or more communications graphs, wherein at least one of the communication graphs is physically distributed over the plurality of network hosts, compute relative frequency of discovered subgraphs representing behavior patterns within the communications graphs, and detect indications of malicious behavior with respect to the at least one network without using signatures by identifying infrequent patterns of the behavior relative to frequent patterns of the behavior according to the relative frequency.
Dependencies are inferred from the claim text.