Methods and systems for statistical aberrant behavior detection of time-series data

Patent metadata

Field	Value
Publication number	US-9300684-B2
Application number	US-201213491425-A
Country	US
Kind code	B2
Filing date	Jun 7, 2012
Priority date	Jun 7, 2012
Publication date	Mar 29, 2016
Grant date	Mar 29, 2016

Abstract

Methods and systems for detecting aberrant behavior in time-series observation data, such as non-existent domain data, are disclosed. The methods and systems analyze the time-series observation data to determine time-series prediction data. The time-series observation data and time-series prediction data are used to determine a threshold that is based on the standard deviation of deviation values between the time-series observation data and time-series prediction data. The threshold may be used to detect aberrant behavior in subsequently obtained time-series observation data.

First claim

What is claimed is:

1. A computer-implemented method for detecting aberrant behavior in time-series data, comprising:
obtaining, via one or more processors, from a database associated with a Domain Name System (DNS) server, first time-series observation data;
storing, via the one or more processors, in a round robin database and as an entry in a first layer of the round robin database, a first value corresponding to a number of queries that occurred during a first time interval of a first length, wherein each entry in the first layer of the round robin database corresponds to a time interval of the first length;
storing, via the one or more processors, in the round robin database and as an entry in the first layer of the round robin database, a second value corresponding to a number of queries that occurred during a second time interval of the first length;
storing, via the one or more processors, in the round robin database and as an entry in a second layer of the round robin database, a third value corresponding to a number of queries that occurred during a third time interval of a second length larger than the first length, wherein:
each entry in the second layer of the round robin database corresponds to a time interval of the second length;
the third value comprises an aggregation of the first value and the second value; and
the third time interval comprises the first time interval and the second time interval;

determining, via the one or more processors and using entries in the second layer of the round robin database, time-series prediction data representative of a predicted trend of the first time-series observation data;
determining, via the one or more processors, a standard deviation value representative of a deviation between the first time-series observation data and the time-series prediction data;
determining, via the one or more processors, a threshold based, at least in part, on the standard deviation value; and
detecting, via the one or more processors, aberrant behavior corresponding to malicious software in second time-series observation data by:
determining second time-series prediction data representative of a predicted trend of the second time-series observation data;
determining second time-series deviation data between the second time-series observation data and the second time-series prediction data; and
comparing one or more values of the second time-series deviation data with a threshold;

replacing the threshold with an updated threshold based, at least in part, on the second time-series observation data; and
providing, via one or more input/output (I/O) devices, an indication that botnet activity exists based on detecting the aberrant behavior corresponding to malicious software.

2. The method of claim 1 , wherein the first time-series observation data is representative of queries for non-existent domains.

3. The method of claim 2 , wherein providing the indication that botnet activity exists is in response to detecting the first time-series observation data is representative of queries for non-existent domains.

4. The method of claim 1 , wherein the determining the time-series prediction data further comprises applying an exponential smoothing technique to the first time-series observation data.

5. The method of claim 1 , wherein the determining the standard deviation value further comprises:
determining time-series deviation data between the first time-series observation data and the time-series prediction data;
determining the mean of the time-series deviation data; and
determining the standard deviation value by analyzing the time-series deviation data and the mean.

6. The method of claim 5 , wherein the determining the time-series deviation data further comprises applying an exponential smoothing technique to differences between the first time-series observation data and the time-series prediction data.

7. The method of claim 1 , wherein the detecting aberrant behavior in the second time-series observation data further comprises determining that a predetermined number of values of the second time-series deviation data exceed the threshold.

8. The method of claim 1 , further comprising:
detecting aberrant behavior in third time-series observation data based, at least in part, on the updated threshold.

9. A system for detecting aberrant behavior in time-series data, comprising:
one or more processors;
one or more memory;
one or more input/output (I/O) devices; and
program code stored on the one or more memory, which, when executed by the one or more processors, causes the system to perform operations comprising:
obtaining, from a database associated with a Domain Name System (DNS) server, first time-series observation data;
storing, in a round robin database and as an entry in a first layer of the round robin database, a first value corresponding to a number of queries that occurred during a first time interval of a first length, wherein each entry in the first layer of the round robin database corresponds to a time interval of the first length;
storing, in the round robin database and as an entry in the first layer of the round robin database, a second value corresponding to a number of queries that occurred during a second time interval of the first length;
storing, in the round robin database and as an entry in a second layer of the round robin database, a third value corresponding to a number of queries that occurred during a third time interval of a second length larger than the first length, wherein:
each entry in the second layer of the round robin database corresponds to a time interval of the second length;
the third value comprises an aggregation of the first value and the second value; and
the third time interval comprises the first time interval and the second time interval;

determining, using entries in the second layer of the round robin database, time-series prediction data representative of a predicted trend of the first time-series observation data;
determining a standard deviation value representative of a deviation between the first time-series observation data and the time-series prediction data;
determining a threshold based, at least in part, on the standard deviation value; and
detecting aberrant behavior corresponding to malicious software in second time-series observation data by:
determining second time-series prediction data representative of a predicted trend of the second time-series observation data;
determining second time-series deviation data between the second time-series observation data and the second time-series prediction data; and
comparing one or more values of the second time-series deviation data with a threshold;

replacing the threshold with an updated threshold based, at least in part, on the second time-series observation data; and
providing, via the I/O devices, an indication that botnet activity exists based on detecting the aberrant behavior corresponding to malicious software.

10. The system of claim 9 , wherein the first time-series observation data is representative of queries for non-existent domains.

11. The system of claim 10 , wherein providing the indication that botnet activity exists is in response to detecting the first time-series observation data is representative of queries for non-existent domains.

12. The system of claim 9 , wherein the determining the time-series prediction data further comprises applying an exponential smoothing technique to the first time-series observation data.

13. The system of claim 9 , wherein the determining the standard deviation value further comprises:
determining time-series d

Assignees

• Luiset Sylvain
• Thomas Matthew
• Verisign Inc

Inventors

• Luiset Sylvain
• Thomas Matthew

Classifications

• H04L63/14

  for detecting or protecting against malicious traffic · CPC title

• H04L63/145

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title

• H04L63/16

  Implementing security features at a particular protocol layer · CPC title

• H04L61/103

  across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP] · CPC title

• H04L63/1441 Primary

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title