Network security analysis system
AssigneeAccenture Global Solutions Limited
InventorsEdward Marquardt, Vikram K. Desai, Patrick J. Joyce, Brandon Whiteman
Life of this patent
Estimating the term…
Abstract
A network security analysis system performs anomaly detection with low false positives by implementing a multiple perspective analysis of network data. The analysis system takes a new approach to defining the network baseline, using, as examples, topic modeling and time series algorithms. The analysis system implements natural language processing techniques to examine the content of network and time series data to establish and maintain a definition of the baseline network state model, against which new activity is compared to identify anomalies.
Claims20
A method comprising:
- in a network security system:
- establishing a baseline network model for an enterprise network, the baseline network model comprising an expected nominal operational profile for the enterprise network;
- evolving the baseline network model over time to capture changes in the expected nominal operational profile of the enterprise network;
- receiving, with data ingestion circuitry, packet data, network connection data, or both from the enterprise network;
- executing a natural language processor on the packet data, network connection data, or both to identify, in comparison with the baseline network model, a network anomaly within the enterprise network, the natural language processor comprising multiple pipeline stages comprising:
- a first pipeline stage configured to, responsive to a vocabulary, generate organized data from the packet data, network connection data, or both;
- and
- a second pipeline stage configured to simplify the organized data by:
- identifying a set of principal components within the organized data;
- and
- selecting a subset from the set of principal components;
- generating a machine interface comprising an alert on the network anomaly;
- and
- communicating the machine interface to an operator system for review.
A system comprising:
- a memory operable to store a baseline network model for an enterprise network, the baseline network model comprising an expected nominal operational profile for the enterprise network;
- analysis circuitry configured to update the baseline network model over time to capture changes in the expected nominal operational profile of the enterprise network;
- data ingestion circuitry configured to receive packet data, network connection data, or both from the enterprise network;
- processing circuitry configured to execute a natural language analysis on the packet data, network connection data, or both to identify, in comparison with the baseline network model, a network anomaly within the enterprise network, the natural language analysis comprising multiple pipeline stages comprising:
- a first pipeline stage configured to, responsive to a vocabulary, generate organized data from the packet data, network connection data, or both;
- and
- a second pipeline stage configured to simplify the organized data by:
- identifying a set of principal components within the organized data;
- and
- selecting a subset from the set of principal components;
- and
- machine interface generation circuitry configured to:
- generate a machine interface comprising an alert on the network anomaly;
- and
- communicate the machine interface to an operator system for review.
Dependencies are inferred from the claim text.