Suspicious network traffic identification method and apparatus

Patent metadata

Field	Value
Publication number	US-10609053-B2
Application number	US-201615085730-A
Country	US
Kind code	B2
Filing date	Mar 30, 2016
Priority date	Nov 24, 2015
Publication date	Mar 31, 2020
Grant date	Mar 31, 2020

Abstract

Apparatuses, methods and storage medium associated with techniques to identify suspicious network connections. In embodiments, an apparatus may include an analysis function to be operated by the one or more processors to receive a collection of network data records, and apply a latent factor model to the network data records to identify a subset of the network data records as suspicious network connections. Other embodiments may be disclosed or claimed.

First claim

What is claimed is:

1. An apparatus for identifying suspicious network connections, comprising:
one or more computer processors; and
an analysis function to be operated by the one or more computer processors to receive a collection of network flow records that include information about communications on a network or communications over a network protocol, a first portion of the collection of network flow records not having information of suspicious network connections, and a second portion of the collection of network flow records having information of suspicious network connections, and apply a latent factor model to the network flow records to identify the second portion of the collection of network flow records as having information of suspicious network connections;
wherein to identify the second portion of the network flow records as suspicious network connections, the analysis function is further to use the latent factor model to generate a probabilistic model for network traffic, by forming a sparse matrix of connections counts by type based at least in part on non-address features of the connection and/or non-address features of devices.

2. The apparatus of claim 1 , wherein the analysis function is further to train the latent factor model.

3. The apparatus of claim 2 , wherein to train the latent factor model, the analysis function is to identify connection types, and bin the network flow records by connection types.

4. The apparatus of claim 1 , wherein to identify the second portion of the network flow records as suspicious network connections, the analysis function is further to use the latent factor model to further assign a likelihood score to each connection indicating a likelihood of a particular device sending or receiving a given connection from/to another device on the network.

5. The apparatus of claim 4 , wherein forming a sparse matrix of connections counts by type and device is based at least in part on a count of a number of times each type of connection is observed, for each IP address, in a given time period.

6. The apparatus of claim 5 , wherein the analysis function is to further factor the sparse matrix into a d×k device matrix, F, and a k×w connections matrix, W, where d is a number of devices being analyzed, w is a number of connection types and k is a number of latent factors being used.

7. The apparatus of claim 6 , wherein the analysis function is to further compute a plurality of probabilities, one for each device, being involved in a particular connection as: P(Device i , connectiontype k )=F i *W k +b i +b k , where F i is a 1×k vector of factor weights for device i, W k is a k×1 vector of factor weights for connection type k and b i and b k are biases for device i and connection type k respectively.

8. The apparatus of claim 1 , wherein the analysis function is to further output the identified suspicious network connections in a graphical user interface (GUI) for analysis by an analyst.

9. The apparatus of claim 8 , wherein the analysis function is to further filter or sort the identified suspicious network connections, in response to instructions from the analyst via the GUI.

10. The apparatus of claim 8 , wherein the analysis function is to further train the latent factor model based on feedback from the analyst.

11. A method for identifying suspicious network connections, comprising:
receiving, by a computing device, a collection of network flow records that include information about communications on a network or communications over a network protocol, a first portion of the collection of network flow records not having information of suspicious network connections, and a second portion of the collection of network flow records having information of suspicious network connections; and
applying, by the computing device, a latent factor model to data to identify the second portion of the network flow records as having information of suspicious network connections;
wherein to identify the second portion of the network flow records as suspicious network connections comprises to use the latent factor model to generate a probabilistic model for network traffic, by forming a sparse matrix of connections counts by type based at least in part on non-address features of the connection and/or non-address features of devices.

12. The method of claim 11 , further comprising training the latent factor model, wherein training the latent factor model comprises identifying connection types, and binning the network flow records by connection types.

13. The method of claim 11 , wherein applying further comprises assigning a likelihood score to each connection indicating a likelihood of a particular device sending or receiving a given connection from/to another device on the network.

14. The method of claim 13 , wherein forming a sparse matrix of connections counts by type and device is based at least in part on a count of a number of times each type of connection is observed, for each IP address, in a given time period; factoring the sparse matrix into a d×k device matrix, F, and a k×w connections matrix, W, where d is a number of devices being analyzed, w is a number of connection types and k is a number of latent factors being used; and computing a plurality of probabilities, one for each device, being involved in a particular connection as: P(Device i ,connectiontype k )=F i *W k +b i +b k , where F i is a 1×k vector of factor weights for device i, W k is a k×1 vector of factor weights for connection type k and b i and b k are biases for device i and connection type k respectively.

15. The method of claim 11 , further comprising outputting, by the computing device, the identified suspicious network connections in a graphical user interface (GUI) for analysis by an analyst.

16. The method of claim 15 , further comprising filtering or sorting, by the computing device, the identified suspicious network connections, in response to instructions from the analyst via the GUI.

17. The method of claim 15 , further comprising training the latent factor model based on feedback from the analyst.

18. One or more non-transitory computer-readable storage media (CRM) having instructions to cause a computing device, in response to execution of the instructions by the computing device, to implement an analysis function to:
receive a collection of network flow records that include information about communications on a network or communications over a network protocol, a first portion of the collection of network flow records not having information of suspicious network connections, and a second portion of the collection of network flow records having information of suspicious network connections; and
apply a latent factor model to data to identify a portion of the network flow records as having information of suspicious network connections;
wherein to identify the second portion of the network flow records as suspicious network connections comprises to use the latent factor model to generate a probabilistic model for network traffic, by forming a sparse matrix of connections counts by type based at least in part on non-address features of the connection and/or non-address features of devices.

19. The one or more non-transitory CRM of claim 18 , wherein the analysis function is further to train the latent factor model; wherein to train the latent factor model, the analysis function is to identify connection types, and bin the network flow records by connection types.

20. The one or more non-transitory CRM of cl

Assignees

• Intel Corp

Inventors

• Alton Michael R
• Babb Grant
• Ross Alan D

Classifications

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• G06N20/00

  Machine learning · CPC title

• G06N7/005

  Physics · mapped topic

• G06N7/01

  Probabilistic graphical models, e.g. probabilistic networks · CPC title