Cyphertext (CT) analytic engine and method for network anomaly detection

In a cyphertext (CT) network, a method for detecting anomalies comprising:

• analyzing cyphertext data flows within the CT network where the CT network includes one or more encryption devices for encrypting plaintext data packets into cyphertext data packets such that the cyphertext data flows are directed to one or more destination devices, where the cyphertext data includes multiple CT data packets and where each CT data packet includes header information where each header includes source address information, destination address information and differentiated service code point (DSCP) information representative of traffic class information, where the DSCP information is unchanged within the cyphertext data flows;
• and
• analyzing the traffic class information of each header, including using maximum entropy estimation for detecting one or more anomalies within the traffic class distribution of each flow based on the header information for that traffic class, including:
• identifying that a network attack is occurring within the CT network,
• identifying the IP address source of the network attack and
• defining a detection threshold for indicating the occurrence of the network attack when the detection threshold is exceeded;
• where the traffic classes have different assigned DSCP priority levels and including defining a set of alarms for multiple levels of attack, including;
• policing a higher priority level of traffic classes having a DSCP value between 18-24 by dynamically readjusting the packet speed for the detected traffic class;
• where attack detecting includes comparing current measured traffic against an established or learned baseline for normal traffic;
• where attack detecting includes comparing current measured traffic against an established or learned baseline for normal traffic where the baseline is periodically updated for normal traffic, including;
• calculating a range of maximum entropy detection threshold values for triggering alarms when the detection threshold values are exceeded;
• including using a collection of anomaly-free packets as training packets to estimate the distribution of normal traffic.