# US 9,521,162 B1 · Application-level DDoS detection using service profiling > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,521,162 B1 - Document ID: US9521162B1 - Status: Granted - Kind: B1 - Application number: 14/550,422 - Filed: 2014-11-21 - Granted: 2016-12-13 - Earliest claimed: 2014-11-21 - Assignees: Narus, Inc. - Applicants: Narus, Inc. - Inventors: Ali Zand; Gaspar Modelo-Howard; Alok Tongaonkar; Sung-Ju Lee; Christopher Kruegel; Giovanni Vigna - Web page: https://patentgrep.com/patent/US9521162B1 ## CPC - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/1458: {Denial of Service} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method for detecting a malicious network activity. The method includes extracting, based on a pre-determined criterion, a plurality of protection phase feature sequences extracted from a first plurality of network traffic sessions exchanged during a protection phase between a server device and a first plurality of client devices of a network, comparing the plurality of protection phase feature sequences and a plurality of profiling phase feature sequences to generate a comparison result, where the plurality of profiling phase feature sequences were extracted from a second plurality of network traffic sessions exchanged during a profiling phase prior to the protection phase between the server device and a second plurality of client devices of the network, and generating, in response to detecting a statistical measure of the comparison result exceeding a pre-determined threshold, an alert indicating the malicious network activity. ## Claims ### Claim 1 A method for detecting a malicious network activity, comprising: extracting, based on a first pre-determined criterion and from a network traffic session exchanged during a protection phase between a server device and a client device of a network, a plurality of consecutive segments, wherein each of the plurality of consecutive segments comprises a sequence of consecutive packets exchanged between the server device and the client device; extracting, based on a second pre-determined criterion, a feature sequence from each of the plurality of consecutive segments, wherein the feature sequence comprises a sequence of feature vectors corresponding to and representing the sequence of consecutive packets, each feature vector corresponding to a packet in the sequence of consecutive packets and including: a packet direction, a packet payload length of a server transmitted packet, a packet payload length range of a client transmitted packet, packet flags, and a packet inter-arrival time; including the feature sequence in a plurality of protection phase feature sequences extracted from a first plurality of network traffic sessions exchanged during the protection phase between the server device and a first plurality of client devices of the network, wherein the plurality of protection phase feature sequences are extracted from the plurality of network traffic sessions based on the first pre-determined criterion and the second pre-determined criterion; comparing the plurality of protection phase feature sequences and a plurality of profiling phase feature sequences to generate a comparison result, wherein the plurality of profiling phase feature sequences were extracted from a second plurality of network traffic sessions exchanged during a profiling phase prior to the protection phase between the server device and a second plurality of client devices of the network, wherein generating a comparison result includes extracting, from the plurality of protection phase feature sequences, a set of suspicious feature sequences by excluding any feature sequence not found in the plurality of profiling phase feature sequences; and generating, in response to detecting a statistical measure of the comparison result exceeding a pre-determined threshold, an alert indicating the malicious network activity. ### Claim 2 (depends on 1) The method of claim 1, wherein the plurality of consecutive segments are extracted from the network traffic session based on the first pre-determined criterion, wherein the feature sequence is extracted from each of the plurality of consecutive segments based on the second pre-determined criterion. ### Claim 3 (depends on 2) The method of claim 2, wherein the first pre-determined criterion comprises a first specification of a number of packets included in each of the plurality of consecutive segments, and wherein the second pre-determined criterion comprises a second specification of a plurality of attributes extracted from each of the plurality of consecutive packets to form a corresponding feature vector. ### Claim 4 (depends on 3) The method of claim 3, wherein the plurality of attributes represent at least one selected from a group consisting of a packet direction, a packet payload length of a server transmitted packet, a packet payload length range of a client transmitted packet, packet flags, and a packet inter-arrival time. ### Claim 5 (depends on 1) The method of claim 1, wherein the statistical measure comprises a difference between a first number of occurrence of a particular feature sequence among the plurality of protection phase feature sequences and a second number of occurrence of the particular feature sequence among the plurality of profiling phase feature sequences. ### Claim 6 (depends on 5) The method of claim 5, wherein the alert identifies the particular feature sequence. ### Claim 7 (depends on 1) The method of claim 1, wherein the malicious network activity is known to be absent during the profiling phase. ### Claim 8 A system for detecting a malicious network activity, comprising: a processor and memory; a feature sequence generator comprising instructions stored in the memory, when executed on the processor having functionality to: extract, based on a first pre-determined criterion and from a network traffic session exchanged during a protection phase between a server device and a client device of a network, a plurality of consecutive segments, wherein each of the plurality of consecutive segments comprises a sequence of consecutive packets exchanged between the server device and the client device; extract, based on a second pre-determined criterion, a feature sequence from each of the plurality of consecutive segments, wherein the feature sequence comprises a sequence of feature vectors corresponding to and representing the sequence of consecutive packets, each feature vector corresponding to a packet in the sequence of consecutive packets and including: a packet direction, a packet payload length of a server transmitted packet, a packet payload length range of a client transmitted packet, packet flags, and a packet inter-arrival time; including the feature sequence in a plurality of protection phase feature sequences extracted from a first plurality of network traffic sessions exchanged during the protection phase between the server device and a first plurality of client devices of the network, wherein the plurality of protection phase feature sequences are extracted from the plurality of network traffic sessions based on the first pre-determined criterion and the second pre-determined criterion; and extract a plurality of profiling phase feature sequences that were extracted from a second plurality of network traffic sessions exchanged during a profiling phase prior to the protection phase between the server device and a second plurality of client devices of the network; a malicious activity detector comprising instructions stored in the memory, when executed on the processor having functionality to: compare the plurality of protection phase feature sequences and the plurality of profiling phase feature sequences to generate a comparison result wherein generating a comparison result includes extracting, from the plurality of protection phase feature sequences, a set of suspicious feature sequences by excluding any feature sequence not found in the plurality of profiling phase feature sequences; and generate, in response to detecting a statistical measure of the comparison result exceeding a pre-determined threshold, an alert indicating the malicious network activity; and a repository for storing the plurality of profiling phase feature sequences, the plurality of protection phase feature sequences, and the plurality of suspicious feature sequences. ### Claim 9 (depends on 8) The system of claim 8, wherein the plurality of consecutive segments are extracted from the network traffic session based on the first pre-determined criterion, wherein the feature sequence is extracted from each of the plurality of consecutive segments based on the second pre-determined criterion. ### Claim 10 (depends on 9) The system of claim 9, wherein the first pre-determined criterion comprises a first specification of a number of packets included in each of the plurality of consecutive segments, and wherein the second pre-determined criterion comprises a second specification of a plurality of attributes extracted from each of the plurality of consecutive packets to form a corresponding feature vector. ### Claim 11 (depends on 10) The system of claim 10, wherein the plurality of attributes represent at least one selected from a group consisting of a packet direction, a packet payload length of a server transmitted packet, a packet payload length range of a client transmitted packet, packet flags, and a packet inter-arrival time. ### Claim 12 (depends on 8) The system of claim 8, wherein the statistical measure comprises a difference between a first number of occurrence of a particular feature sequence among the plurality of protection phase feature sequences and a second number of occurrence of the particular feature sequence among the plurality of profiling phase feature sequences. ### Claim 13 (depends on 12) The system of claim 12, wherein the alert identifies the particular feature sequence. ### Claim 14 (depends on 8) The system of claim 8, wherein the malicious network activity is known to be absent during the profiling phase. ### Claim 15 A non-transitory computer readable medium embodying instructions for detecting a malicious network activity, the instructions when executed by a processor of a computer, comprising functionality for: extracting, based on a first pre-determined criterion and from a network traffic session exchanged during a protection phase between a server device and a client device of a network, a plurality of consecutive segments, wherein each of the plurality of consecutive segments comprises a sequence of consecutive packets exchanged between the server device and the client device; extracting, based on a second pre-determined criterion, a feature sequence from each of the plurality of consecutive segments, wherein the feature sequence comprises a sequence of feature vectors corresponding to and representing the sequence of consecutive packets, each feature vector corresponding-to-a packet in the sequence of consecutive packets and including: a packet direction, a packet payload length of a server transmitted packet, a packet payload length range of a client transmitted packet, packet flags, and a packet inter-arrival time; including the feature sequence in a plurality of protection phase feature sequences extracted from a first plurality of network traffic sessions exchanged during the protection phase between the server device and a first plurality of client devices of the network, wherein the plurality of protection phase feature sequences are extracted from the plurality of network traffic sessions based on the first pre-determined criterion and the second pre-determined criterion; comparing the plurality of protection phase feature sequences and a plurality of profiling phase feature sequences to generate a comparison result, wherein the plurality of profiling phase feature sequences were extracted from a second plurality of network traffic sessions exchanged during a profiling phase prior to the protection phase between the server device and a second plurality of client devices of the network, wherein generating a comparison result includes extracting, from the plurality of protection phase feature sequences, a set of suspicious feature sequences by excluding any feature sequence not found in the plurality of profiling phase feature sequences; and generating, in response to detecting a statistical measure of the comparison result exceeding a pre-determined threshold, an alert indicating the malicious network activity. ### Claim 16 (depends on 15) The non-transitory computer readable medium of claim 15, wherein the plurality of consecutive segments are extracted from the network traffic session based on the first pre-determined criterion, wherein the feature sequence is extracted from each of the plurality of consecutive segments based on the second pre-determined criterion. ### Claim 17 (depends on 16) The non-transitory computer readable medium of claim 16, wherein the first pre-determined criterion comprises a first specification of a number of packets included in each of the plurality of consecutive segments, and wherein the second pre-determined criterion comprises a second specification of a plurality of attributes extracted from each of the plurality of consecutive packets to form a corresponding feature vector. ### Claim 18 (depends on 17) The non-transitory computer readable medium of claim 17, wherein the plurality of attributes represent at least one selected from a group consisting of a packet direction, a packet payload length of a server transmitted packet, a packet payload length range of a client transmitted packet, packet flags, and a packet inter-arrival time. ### Claim 19 (depends on 15) The non-transitory computer readable medium of claim 15, wherein the statistical measure comprises a difference between a first number of occurrence of a particular feature sequence among the plurality of protection phase feature sequences and a second number of occurrence of the particular feature sequence among the plurality of profiling phase feature sequences. ### Claim 20 (depends on 19) The non-transitory computer readable medium of claim 19, wherein the alert identifies the particular feature sequence.