Attack traffic signature generation using statistical pattern recognition

A system for generating packet signatures, the system comprising:

• a packet capture module configured to capture data packets during a network attack on a target computing system;
• a training data generator configured to generate a training data set from the captured data packets, wherein the training data set includes attack packets selected from the captured data packets based at least in part on a set of determined packet probabilities, each packet probability indicating a probability that an individual data packet of the captured data packets corresponds to a network attack;
• and
• a signature generator configured to generate a packet signature for attack packets based at least partly on the training data including the attack packets selected based at least partly on the determined packet probabilities that individual packets correspond to a network attack.

Non-transitory computer storage having stored thereon instructions that, when executed by a computer system, cause the computer system to:

• compare a first set of data packets captured during a network attack on a target system with a second set of data packets captured during a different time period than the network attack to determine a set of packet probabilities, each packet probability indicating a probability that an individual data packet of the first set of data packets corresponds to a network attack;
• designate at least a portion of the data packets as attack packets based at least partly on the determined packet probabilities that individual packets of the first set of data packets correspond to a network attack;
• and
• generate a packet signature for attack packets based at least partly on the identified attack packets designated based at least partly on the determined packet probabilities.