Back to results
US 9,866,578 B2Granted
System and method for network intrusion detection anomaly risk scoring
AssigneeAlphaSix Corp.
InventorStephen Moore
Life of this patent
Estimating the term…
Abstract
Systems, methods, and computer-readable storage media for scoring network anomaly risk. A system identifies a baseline usage for a facet of a server and determines, for the facet, a normal range of use based on the baseline usage. The system also determines an abnormal range of use based on the baseline usage. When actual usage data is available, the system determines whether the usage data corresponds to the normal range of use or the abnormal range of use, and calculates a facet score based on the abnormality value.
Claims28
A method of network intrusion detection for use with a processor and memory comprising instructions executed by the processor, comprising:
- identifying a baseline usage for a plurality of behavioral facets relevant to network intrusion detection on a plurality of servers, wherein the baseline usage represents a measurement of use over a first period of time;
- automatically determining, for each behavioral facet, a normal range of use based on the baseline usage, such that usage of each behavioral facet within the normal range of use indicates normal behavior;
- automatically determining, for each behavioral facet, at least one abnormal range of use based on the baseline usage, such that usage of each behavioral facet within the at least one abnormal range of use indicates abnormal behavior;
- identifying usage data for a second period of time, the second period of time being distinct from the first period of time;
- determining whether the usage data corresponds to the normal range of use or one of the at least one abnormal range of use, to thereby yield a corresponding abnormality value wherein the abnormality value represents how much the facet varies statistically over time from the baseline usage;
- and
- calculating a behavioral facet score based on the corresponding abnormality value;
- automatically generating an anomaly report including behavioral facet information;
- and
- detecting network intrusion by accessing behavioral facet information from the anomaly report.
7 more elements
A system for network intrusion detection comprising:
- a processor;
- and
- a non-transitory computer-readable storage medium having instructions stored which, when executed by the processor, cause the processor to perform operations comprising:
- identifying a baseline usage for a plurality of behavioral facets relevant to network intrusion detection on a plurality of servers, wherein the baseline usage represents a measurement of use over a first period of time;
- automatically determining, for each behavioral facet, a normal range of use based on the baseline usage, such that usage of each behavioral facet within the normal range of use indicates normal behavior;
- automatically determining, for each behavioral facet, at least one abnormal range of use based on the baseline usage, such that usage of each behavioral facet within the at least one abnormal range of use indicates abnormal behavior;
- identifying usage data for a second period of time, the second period of time being distinct from the first period of time;
- determining whether the usage data corresponds to the normal range of use or one of the at least one abnormal range of use, to thereby yield a corresponding abnormality value, wherein the abnormality value represents how much the facet varies statistically over time from the baseline usage;
- calculating a behavioral facet score based on the corresponding abnormality value;
- automatically generating an anomaly report including behavioral facet information;
- and
- detecting network intrusion by accessing the behavioral facet information from the anomaly report.
9 more elements
A non-transitory computer-readable medium having instructions stored which, when executed by a computing device, cause the computing device to perform operations comprising:
- identifying a baseline usage for a plurality of behavioral facets relevant to network intrusion detection on a plurality of servers, wherein the baseline usage represents an average use over a first period of time;
- automatically determining, for each behavioral facet, a normal range of use based on the baseline usage, such that usage of each behavioral facet within the normal range of use indicates normal behavior;
- automatically determining, for each behavioral facet, at least one abnormal range of use based on the baseline usage, such that usage of each behavioral facet within the at least one abnormal range of use indicates abnormal behavior;
- identifying usage data for a second period of time, the second period of time being distinct from the first period of time;
- determining whether the usage data corresponds to the normal range of use or one of the at least one abnormal range of use, to thereby yield a corresponding abnormality value, wherein the abnormality value represents how much the facet varies statistically over time from the baseline usage;
- calculating a behavioral facet score based on the corresponding abnormality value;
- automatically generating an anomaly report including behavioral facet information;
- and
- detecting network intrusion by accessing the behavioral facet information from the anomaly report.
6 more elements
Dependencies are inferred from the claim text.