Deep learning network intrusion detection

Patent metadata

Field	Value
Publication number	US-2022014554-A1
Application number	US-202016925410-A
Country	US
Kind code	A1
Filing date	Jul 10, 2020
Priority date	Jul 10, 2020
Publication date	Jan 13, 2022
Grant date	—

Abstract

One or more computer processors intercept one or more network inputs entering or existing an internal network; synthesize one or more network input images from a random noise vector sampled from a normal distribution of textually embedded network inputs utilizing a trained generative adversarial network; classify one or more synthesized network input images by identifying contained objects utilizing a trained convolutional neural network with rectified linear units, wherein the objects include patterns, sequences, trends, and signatures; predict a security profile of the one or more classified network input images and associated one or more network inputs, wherein the security profiles includes a set of rules and associated mitigation actions, analogous historical network traffic, a probability of infection, a probability of signature match with historical malicious network inputs, and a harm factor; apply one or more mitigation actions based on the predicted security profile.

First claim

What is claimed is:

1 . A computer-implemented method comprising:
intercepting, by one or more computer processors, one or more network inputs entering or existing an internal network; synthesizing, by one or more computer processors, one or more network input images from a random noise vector sampled from a normal distribution of textually embedded network inputs utilizing a trained generative adversarial network; classifying, by one or more computer processors, one or more synthesized network input images by identifying contained objects utilizing a trained convolutional neural network with rectified linear units, wherein the objects include patterns, sequences, trends, and signatures; predicting, by one or more computer processors, a security profile of the one or more classified network input images and associated one or more network inputs, wherein the security profiles includes a set of rules and associated mitigation actions, analogous historical network traffic, a probability of infection, a probability of signature match with historical malicious network inputs, and a harm factor; and applying, by one or more computer processors, one or more mitigation actions based on the predicted security profile associated with the one or more network inputs.

2 . The method of claim 1 , further comprising:
reducing, by one or more computer processors, subsequent false positives by updating one or more intrusion detection system signatures with the predicted security profile.

3 . The method of claim 1 , further comprising:
monitoring, by one or more computer processors, inbound and outbound network inputs utilizing a host intrusion detection system and a library containing textual, graphic-based, image-based, and video-based anomaly signatures.

4 . The method of claim 1 , further comprising:
monitoring, by one or more computer processors, all network traffic utilizing a network intrusion detection system to perform an analysis of passing network traffic on a subnet, wherein the network intrusion detection system analyzes packets, flow, sessions, packet payloads, traffic groupings, network session transitions and transmissions; and matching, by one or more computer processors, the monitored network traffic to a library of malicious signatures.

5 . The method of claim 1 , wherein classifying one or more synthesized network input images by identifying contained objects utilizing the trained convolutional neural network with rectified linear units, wherein the objects include patterns, sequences, trends, and signatures further comprises:
calculating, by one or more computer processors, a similarity score indicating a probability of image similarity for the synthesized image to a respective historical network image.

6 . The method of claim 1 , wherein the mitigation actions include transmitting, monitoring, modifying, suspending, flagging, quarantining, diverting, storing, or logging based on one or more factors, scores, and probabilities contained in the predicted security profile.

7 . The method of claim 1 , wherein synthesizing one or more network input images from the random noise vector sampled from the normal distribution of textually embedded network inputs utilizing the trained generative adversarial network, further comprises:
applying, by one or more computer processors, text-to-image generation through re-description comprising a semantic text embedding, global-local collaborative attentive for cascaded image generation, semantic text regeneration, and semantic text regeneration alignment.

8 . A computer program product comprising:
one or more computer readable storage media and program instructions stored on the one or more computer readable storage media, the stored program instructions comprising: program instructions to intercept one or more network inputs entering or existing an internal network; program instructions to synthesize one or more network input images from a random noise vector sampled from a normal distribution of textually embedded network inputs utilizing a trained generative adversarial network; program instructions to classify one or more synthesized network input images by identifying contained objects utilizing a trained convolutional neural network with rectified linear units, wherein the objects include patterns, sequences, trends, and signatures; program instructions to predict a security profile of the one or more classified network input images and associated one or more network inputs, wherein the security profiles includes a set of rules and associated mitigation actions, analogous historical network traffic, a probability of infection, a probability of signature match with historical malicious network inputs, and a harm factor; and program instructions to apply one or more mitigation actions based on the predicted security profile associated with the one or more network inputs.

9 . The computer program product of claim 8 , wherein the program instructions, stored on the one or more computer readable storage media, further comprise:
program instructions to reduce subsequent false positives by updating one or more intrusion detection system signatures with the predicted security profile.

10 . The computer program product of claim 8 , wherein the program instructions, stored on the one or more computer readable storage media, further comprise:
program instructions to monitor inbound and outbound network inputs utilizing a host intrusion detection system and a library containing textual, graphic-based, image-based, and video-based anomaly signatures.

11 . The computer program product of claim 8 , wherein the program instructions, stored on the one or more computer readable storage media, further comprise:
program instructions to monitor all network traffic utilizing a network intrusion detection system to perform an analysis of passing network traffic on a subnet, wherein the network intrusion detection system analyzes packets, flow, sessions, packet payloads, traffic groupings, network session transitions and transmissions; and program instructions to match the monitored network traffic to a library of malicious signatures.

12 . The computer program product of claim 8 , wherein the program instructions to classify one or more synthesized network input images by identifying contained objects utilizing the trained convolutional neural network with rectified linear units, wherein the objects include patterns, sequences, trends, and signatures, further comprise:
program instructions to calculate a similarity score indicating a probability of image similarity for the synthesized image to a respective historical network image.

13 . The computer program product of claim 8 , wherein mitigation actions includes transmitting, monitoring, modifying, suspending, flagging, quarantining, diverting, storing, or logging based on one or more factors, scores, and probabilities contained in the predicted security profile.

14 . The computer program product of claim 8 , wherein the program instructions to synthesize one or more network input images from the random noise vector sampled from the normal distribution of textually embedded network inputs utilizing the trained generative adversarial network, further comprise:
program instructions to apply text-to-image generation through re-description comprising a semantic text embedding, global-local collaborative attentive for cascaded image generation, semantic text regeneration, and semantic text regeneration alignment.

15 . A computer system comprising:
one or more computer processors; one or more co

Assignees

• IBM

Inventors

• Vasu Karthick

Classifications

• G06N3/045

  Combinations of networks · CPC title

• G06N3/047

  Probabilistic or stochastic networks · CPC title

• G06N3/048

  Activation functions · CPC title

• G06N3/088 Primary

  Non-supervised learning, e.g. competitive learning · CPC title

• G06N3/0464

  Convolutional networks [CNN, ConvNet] · CPC title