System and method for correlating historical attacks with diverse indicators to generate indicator profiles for detecting and predicting future network attacks

Patent metadata

Field	Value
Publication number	US-9386030-B2
Application number	US-201314029474-A
Country	US
Kind code	B2
Filing date	Sep 17, 2013
Priority date	Sep 18, 2012
Publication date	Jul 5, 2016
Grant date	Jul 5, 2016

Abstract

An apparatus and method predict and detect network attacks by using a diverse set of indicators to measure aspects of the traffic and by encoding traffic characteristics using these indicators of potential attacks or anomalous behavior. The set of indicators is analyzed by supervised learning to automatically learn a decision rule which examines the temporal patterns in the coded values of the set of indicators to accurately detect and predict network attacks. The rules automatically evolve in response to new attacks as the system updates its rules periodically by analyzing new data and feedback signals about attacks associated with that data. To assist human operators, the system also provides human interpretable explanations of detection and prediction rules by pointing to indicators whose values contribute to a decision that there is an existing network attack or an imminent network attack. When such indictors are detected, an operator can take remediation actions.

First claim

What is claimed is:

1. A method for detecting and predicting network attacks, the method comprising:
acquiring attack alerts and indicator values representative of network traffic;
converting the alerts and indicator values into vectors;
using the vectors to generate training data representative of the alerts and the indicator values;
implementing a learning algorithm to process the training data to generate decision rules; and
performing network attack detection or prediction based on the generated decision rules, the performing network attack detection or prediction comprising:
processing network traffic to generate indicator values, each indicator value indicative of whether a respective attack characteristic is observed in the network traffic, wherein the indicator values are representative of indicators that include volume of traffic, rate of spoofing, rate of occurrence of unique source addresses, rate of occurrence of unique geographical locations of the source of traffic, ratio of SYN to non-SYN traffic and rate of occurrence of malicious source addresses, wherein each indicator value has a respective dynamic threshold associated therewith based on which the indicator value is set to indicate whether the respective attack characteristic is observed, and wherein the dynamic threshold varies over time based at least in part on historical values for the dynamic threshold; and
determining, based on the generated indicator values, whether a network attack is indicated by the network traffic.

2. The method of claim 1 , wherein the performing network attack detection further comprises:
converting the generated indicator values to vectors,
wherein the determining whether the network attack is indicated comprises using the decision rules to process the vectors to determine whether a network attack is occurring.

3. The method of claim 2 , wherein the indicator values have time stamps representative of their time of occurrence, and wherein the method further comprises using a sliding window to collect indicators for processing during the window to determine if an alert should be issued.

4. The method of claim 1 , further comprising using a flow agent to acquire network data.

5. The method of claim 4 , further comprising routing the data to a collector for storing the network data for further processing.

6. The method of claim 5 , further comprising routing stored network data to a real time flow filter for further processing of the network data to produce the indicator values.

7. The method of claim 1 , further comprising routing network data to a real time flow filter for processing of the network data to produce the indicator values.

8. The method of claim 1 , further comprising updating a dynamic threshold associated with an indicator value, the updating comprising determining an updated dynamic threshold as a weighted combination of one or more historical values of the dynamic threshold and a current value of the network traffic.

9. A system for detecting and predicting network attacks, the system comprising:
a data processor; and
a memory in communication with the processor, the memory storing instructions readable by the data processor to perform a method comprising:
acquiring attack alerts and indicator values representative of network traffic;
converting the alerts and indicator values into vectors;
using the vectors to generate training data representative of the alerts and the indicator values;
implementing a learning algorithm to process the training data to generate decision rules; and
performing network attack detection or prediction based on the generated decision rules, the performing network attack detection or prediction comprising:
processing network traffic to generate indicator values, each indicator value indicative of whether a respective attack characteristic is observed in the network traffic, wherein the indicator values are representative of indicators that include volume of traffic, rate of spoofing, rate of occurrence of unique source addresses, rate of occurrence of unique geographical locations of the source of traffic, ratio of SYN to non-SYN traffic and rate of occurrence of malicious source addresses, wherein each indicator value has a respective dynamic threshold associated therewith based on which the indicator value is set to indicate whether the respective attack characteristic is observed, and wherein the dynamic threshold varies over time based at least in part on historical values for the dynamic threshold; and
determining, based on the generated indicator values, whether a network attack is indicated by the network traffic.

10. The system of claim 9 , wherein the performing network attack detection further comprises:
converting the generated indicator values to vectors,
wherein the determining whether the network attack is indicated comprises using the decision rules to process the vectors to determine whether a network attack is occurring.

11. The system of claim 10 , wherein the indicator values have time stamps representative of their time of occurrence, and wherein the method further comprises using a sliding window to collect indicators for processing during the window to determine if an alert should be issued.

12. The system of claim 9 , further comprising a flow agent to acquire network data.

13. The system of claim 12 , further comprising a collector for storing the network data for further processing.

14. The system of claim 13 , further comprising a real time flow filter for further processing of the network data to produce the indicator values.

15. The system of claim 9 , further comprising a real time flow filter for processing of the network data to produce the indicator values.

16. The system of claim 9 , wherein the method further comprises updating a dynamic threshold associated with an indicator value, the updating comprising determining an updated dynamic threshold as a weighted combination of one or more historical values of the dynamic threshold and a current value of the network traffic.

17. A system for detecting a predicting network attacks, the system comprising:
first apparatus for acquiring attack alerts and indicator values representative of network traffic;
second apparatus for converting the alerts and indicator values into vectors;
third apparatus for using the vectors to generate training data representative of the alerts and the indicator values;
fourth apparatus for implementing a learning algorithm to process the training data to generate decision rules; and
fifth apparatus for performing network attack detection or prediction based on the generated decision rules, the performing network attack detection or prediction comprising:
processing network traffic to generate indicator values, each indicator value indicative of whether a respective attack characteristic is observed in the network traffic, wherein the indicator values are representative of indicators that include volume of traffic, rate of spoofing, rate of occurrence of unique source addresses, rate of occurrence of unique geographical locations of the source of traffic, ratio of SYN to non-SYN traffic and rate of occurrence of malicious source addresses, wherein each indicator value has a respective dynamic threshold associated therewith based on which the indicator value is set to indicate whether the respective attack characteristic is observed, and wherein the dynamic threshold varies over time based at least in part on historical values for the dynamic threshold; and
determining, based on the generated indicator va

Assignees

• Tt Government Solutions Inc
• Kddi Corp
• Vencore Labs Inc

Inventors

• Vashist Akshay
• Chadha Ritu
• Ghosh Abhrajit
• Poylisher Alexander
• Sawaya Yukiko
• Yamada Akira
• Kubota Ayumu

Classifications

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title

• H04L67/535 Primary

  Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34) · CPC title

• H04L67/22

  Electricity · mapped topic