Method and system for detecting threats using metadata vectors
AssigneeVectra Networks, Inc.
InventorsNicolas Beauchesne, David Lopes Pegna, Karl Lynn
Life of this patent
Estimating the term…
Abstract
An approach for detecting network attacks using metadata vectors may initially involve receiving network communications or packets, extracting metadata items from the packets. The metadata items describe the communications without requiring deep content inspection of the data payload or contents. The communications may be clustered into groups using the metadata items. If a cluster exceeds a threshold, an alarm may be generated.
Claims24
A method for detecting threats in networks using metadata, comprising:
- receiving one or more network communications by tapping a network device that routes network communications between a single host and multiple hosts, wherein a network communication comprises at least a first communication in a first direction from the single host to the multiple hosts and a second communication in a second direction from the multiple hosts to the single host, the first communication corresponding to the single host sending copies of a payload to the multiple hosts, the second communication corresponding to response messages sent by the multiple hosts initiated in response to receiving copies of the payload from the single host, the second direction being opposite of the first direction;
- extracting one or more metadata instances from the network communications that describe the network communications without inspecting contents of the network communications,
- grouping the metadata instances into one or more clusters based on whether the metadata instances match;
- and
- generating alert data for a cluster when an amount of metadata instances in the cluster exceeds a threshold.
A system for detecting threats in networks using metadata, comprising:
- a computer processor to execute a set of program code instructions;
- a memory to hold the set of program code instructions, in which the set of program code instructions comprises program code to perform:
- receiving one or more network communications by tapping a network device that routes network communications between a single host and multiple hosts, wherein a network communication comprises at least a first communication in a first direction from the single host to the multiple hosts and a second communication in a second direction from the multiple hosts to the single host, the first communication corresponding to the single host sending copies of a payload to the multiple hosts, the second communication corresponding to response messages sent by the multiple hosts initiated in response to receiving copies of the payload from the single host, the second direction being opposite of the first direction;
- extracting one or more metadata instances from the network communications that describe the network communications without inspecting contents of the network communications,
- grouping the metadata instances into one or more clusters based on whether the metadata instances match;
- and
- generating alert data for a cluster when an amount of metadata instances in the cluster exceeds a threshold.
A computer program product embodied on a non-transitory computer readable medium, the non-transitory computer readable medium having stored thereon a sequence of instructions which, when executed by a processor causes the processor to execute a method detecting threats, the method comprising:
- receiving one or more network communications by tapping a network device that routes network communications between a single host and multiple hosts, wherein a network communication comprises at least a first communication in a first direction from the single host to the multiple hosts and a second communication in a second direction from the multiple hosts to the single host, the first communication corresponding to the single host sending copies of a payload to the multiple hosts, the second communication corresponding to response messages sent by the multiple hosts initiated in response to receiving copies of the payload from the single host, the second direction being opposite of the first direction;
- extracting one or more metadata instances from the network communications that describe the network communications without inspecting contents of the network communications;
- grouping the metadata instances into one or more clusters based on whether the metadata instances match;
- and
- generating alert data for a cluster when an amount of metadata instances in the cluster exceeds a threshold.
Dependencies are inferred from the claim text.