Anomaly detection in protocol processes

Patent metadata

Field	Value
Publication number	US-2016149776-A1
Application number	US-201414551992-A
Country	US
Kind code	A1
Filing date	Nov 24, 2014
Priority date	Nov 24, 2014
Publication date	May 26, 2016
Grant date	—

Abstract

Systems, methods and transitory computer-readable storage media for constructing a loop free multicast tree. The methods include collecting data sample points to form a first data set, each of the data sample points representing a network feature variable, each network feature variable associated with a corresponding network feature, calculating a standard deviation and a mean value of the network feature variables for each network feature, performing normalization of the network feature variables to obtain normalized network feature variables, calculating, using the standard deviation and the mean value for each network feature, a probability value (p-value) for each normalized network feature variable, and determining if an anomaly exists with respect to each network feature based at least upon the p-value for each normalized network feature variable.

First claim

We claim:

1 . A method comprising:
collecting data sample points to form a first data set, each of the data sample points representing a network feature variable, each network feature variable associated with a corresponding network feature; calculating a standard deviation and a mean value of the network feature variables for each network feature; performing normalization of the network feature variables to obtain normalized network feature variables; calculating, using the standard deviation and the mean value for each network feature, a probability value (p-value) for each normalized network feature variable; and determining if an anomaly exists with respect to each network feature based at least upon the p-value for each normalized network feature variable.

2 . The method of claim 1 , further comprising determining if a correlation exists between at least two network features in the first data set, wherein calculating the p-value for each normalized network feature variable includes performing a multivariate distribution function for each of the normalized network feature variables if the correlation exists between the at least two network features.

3 . The method of claim 2 , wherein if the correlation exists between at least two network features, further comprising:
reducing a number of network feature variables of the first data set resulting in a second data set having a number of network feature variables that is less than the number of network feature variables of the first data set, the second data set including only uncorrelated network features.

4 . The method of claim 3 , wherein reducing the number of network feature variables of the first data resulting in a second data set having a number of network feature variables that is less than the number of network feature variables of the first data set includes performing a principal component analysis (PCA) on the first data set.

5 . The method of claim 4 , wherein calculating the p-value for each normalized network feature value includes performing an independent Gaussian distribution function for each network feature variable of the second data set.

6 . The method of claim 1 , further comprising taking remedial action to correct the anomaly when it is determined that an anomaly exists.

7 . The method of claim 1 , wherein each sample data point represents a plurality network feature variables collected over a period of time.

8 . A system comprising:
a processor; and a computer-readable storage medium having stored therein instructions which, when executed by the processor, cause the processor to perform operations comprising:
collecting data sample points to form a first data set, each of the data sample points representing a network feature variable, each network feature variable associated with a corresponding network feature;
calculating a standard deviation and a mean value of the network feature variables for each network feature;
performing normalization of the network feature variables to obtain normalized network feature variables;
calculating, using the standard deviation and the mean value for each network feature, a probability value (p-value) for each normalized network feature variable; and
determining if an anomaly exists with respect to each network feature based at least upon the p-value for each normalized network feature variable.

9 . The system of claim 8 , the computer-readable storage medium storing additional instructions which, when executed by the processor, result in an operation further comprising determining if a correlation exists between at least two network features in the first data set, wherein calculating the p-value for each normalized network feature variable includes performing a multivariate distribution function for each of the normalized network feature variables if the correlation exists between the at least two network features.

10 . The system of claim 9 , wherein if the correlation exists between at least two network features, the computer-readable storage medium storing additional instructions which, when executed by the processor, result in an operation further comprising:
reducing a number of network feature variables of the first data set resulting in a second data set having a number of network feature variables that is less than the number of network feature variables of the first data set, the second data set including only uncorrelated network features.

11 . The system of claim 10 , wherein reducing the number of network feature variables of the first data resulting in a second data set having a number of network feature variables that is less than the number of network feature variables of the first data set includes performing a principal component analysis (PCA) on the first data set.

12 . The system of claim 11 , wherein calculating the p-value for each normalized network feature value includes performing an independent Gaussian distribution function for each network feature variable of the second data set.

13 . The system of claim 8 , the computer-readable storage medium storing additional instructions which, when executed by the processor, result in an operation further comprising taking remedial action to correct the anomaly when it is determined that an anomaly exists.

14 . The system of claim 8 , wherein each sample data point represents a plurality network feature variables collected over a period of time.

15 . A non-transitory computer-readable storage medium having stored therein instructions which, when executed by a processor, cause the processor to perform operations comprising:
collecting data sample points to form a first data set, each of the data sample points representing a network feature variable, each network feature variable associated with a corresponding network feature; calculating a standard deviation and a mean value of the network feature variables for each network feature; calculating, using the standard deviation and the mean value for each network feature, a probability value (p-value) for each normalized network feature variable; and determining if an anomaly exists with respect to each network feature based at least upon the p-value for each normalized network feature variable.

16 . The non-transitory computer-readable storage medium of claim 15 , storing additional instructions which, when executed by the processor, result in operations further comprising:
determining if a correlation exists between at least two network features in the first data set, wherein calculating the p-value for each normalized network feature variable includes performing a multivariate distribution function for each of the normalized network feature variables if the correlation exists between the at least two network features.

17 . The non-transitory computer-readable storage medium of claim 16 , wherein if the correlation exists between at least two network features, storing additional instructions which, when executed by the processor, result in operations further comprising:
reducing a number of network feature variables of the first data set resulting in a second data set having a number of network feature variables that is less than the number of network feature variables of the first data set, the second data set including only uncorrelated network features.

18 . The non-transitory computer-readable storage medium of claim 17 , wherein reducing the number of network feature variables of the first data resulting in a second data set having a number of network feature variables

Assignees

• Cisco Tech Inc

Inventors

• Pani Ayaskant
• Kulkarni Gautam Sanjiv

Classifications

• H04L43/0817

  by checking functioning · CPC title

• G06F17/18

  for evaluating statistical data {, e.g. average values, frequency distributions, probability functions, regression analysis (forecasting specially adapted for a specific administrative, business or logistic context G06Q10/04)} · CPC title

• H04L43/04 Primary

  Processing captured monitoring data, e.g. for logfile generation · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L41/142 Primary

  using statistical or mathematical methods · CPC title