Network attack detection using combined probabilities

Patent metadata

Field	Value
Publication number	US-9450972-B2
Application number	US-201414338751-A
Country	US
Kind code	B2
Filing date	Jul 23, 2014
Priority date	Jul 23, 2014
Publication date	Sep 20, 2016
Grant date	Sep 20, 2016

Abstract

In one embodiment, a device in a network receives a set of output label dependencies for a set of attack detectors. The device identifies applied labels that were applied by the attack detectors to input data regarding a network, the applied labels being associated with probabilities. The device determines a combined probability for two or more of the applied labels based on the output label dependencies and the probabilities associated with the two or more labels. The device selects one of the applied labels as a finalized label for the input data based on the probabilities associated with the applied labels and on the combined probability for the two or more labels.

First claim

What is claimed is:

1. A method, comprising:
receiving, at a device in a network, a set of output label dependencies for a set of attack detectors that exploit dependencies between overlapping labels used by different attack detection classifiers;
identifying, by the device, applied labels that were applied by the attack detectors to input data regarding the network, wherein probabilities are associated with the applied labels;
determining, by the device, a combined probability for two or more of the applied labels based on the output label dependencies and the probabilities associated with the two or more labels; and
selecting, by the device, one of the applied labels as a finalized label for the input data based on the probabilities associated with the applied labels and on the combined probability for the two or more labels.

2. The method as in claim 1 , further comprising:
determining, by the device, that a probability associated with the finalized label for the input data is greater than a threshold value; and
generating, by the device, an attack detection alert using the finalized label, in response to determining that a probability associated with the finalized label for the input data is greater than a threshold value.

3. The method as in claim 1 , further comprising:
generating, by the device, at least one of the applied labels by executing one or more of the attack detectors to label the input data regarding the network.

4. The method as in claim 3 , further comprising:
generating, by the device, all of the applied labels by executing each of the attack detectors to label the input data regarding the network.

5. The method as in claim 1 , wherein a particular label dependency in the set of output label dependencies corresponds to an inverse relationship between labels.

6. The method as in claim 1 , further comprising:
receiving, at the device, at least one of the applied labels from another device in the network that hosts at least one of the attack detectors.

7. The method as in claim 1 , wherein the attack detectors use differing sets of output labels.

8. The method as in claim 1 , wherein the input data regarding the network is a validation data set that has an associated ground truth label.

9. A method, comprising:
identifying, by a device in a network and for each of a plurality of attack detectors, a set of output labels used by the attack detector, wherein the attack detector is configured to apply one of the set of output labels to an input data set regarding the network;
determining, by the device, a set of output label dependencies between the sets of output labels for the attack detectors that exploit dependencies between overlapping labels used by different attack detection classifiers;
providing, by the device, the attack detectors to one or more nodes in the network; and
providing, by the device, the set of output label dependencies to the one or more nodes in the network, wherein the one or more nodes use the set of output label dependencies to select a finalized label from among output labels applied by the attack detectors.

10. The method as in claim 9 , wherein a particular label dependency in the set of output label dependencies corresponds to an inverse relationship between labels.

11. The method as in claim 9 , wherein the attack detectors use differing sets of output labels.

12. The method as in claim 9 , further comprising:
providing, by the device, a validation data set to the one or more nodes, wherein the one or more nodes use the attack detectors and the set of output label dependencies to label the validation data set;
receiving, at the device, an indication of the labeled validation set; and
providing a different set of attack detectors and output label dependencies to the one or more nodes based on a determination that the labeled validation set does not satisfy a performance metric.

13. An apparatus, comprising:
one or more network interfaces to communicate with a network;
a processor coupled to the network interfaces and configured to execute one or more processes; and
a memory configured to store a process executable by the processor, the process when executed operable to:
receive a set of output label dependencies for a set of attack detectors that exploit dependencies between overlapping labels used by different attack detection classifiers;
identify applied labels that were applied by the attack detectors to input data regarding the network, wherein probabilities are associated with the applied labels;
determine a combined probability for two or more of the applied labels based on the output label dependencies and the probabilities associated with the two or more labels; and
select one of the applied labels as a finalized label for the input data based on the probabilities associated with the applied labels and on the combined probability for the two or more labels.

14. The apparatus as in claim 13 , wherein the process when executed is further operable to:
determine that a probability associated with the finalized label for the input data is greater than a threshold value; and
generate an attack detection alert using the finalized label, in response to determining that a probability associated with the finalized label for the input data is greater than a threshold value.

15. The apparatus as in claim 13 , wherein the process when executed is further operable to:
generate at least one of the applied labels by executing one or more of the attack detectors to label the input data regarding the network.

16. The apparatus as in claim 15 , wherein the process when executed is further operable to:
generate all of the applied labels by executing each of the attack detectors to label the input data regarding the network.

17. The apparatus as in claim 13 , wherein a particular label dependency in the set of output label dependencies corresponds to an inverse relationship between labels.

18. The apparatus as in claim 13 , wherein the process when executed is further operable to:
receive at least one of the applied labels from another device in the network that hosts at least one of the attack detectors.

19. The apparatus as in claim 13 , wherein the attack detectors use differing sets of output labels.

20. The apparatus as in claim 13 , wherein the input data regarding the network is a validation data set that has an associated ground truth label.

21. An apparatus, comprising:
one or more network interfaces to communicate with a network;
a processor coupled to the network interfaces and configured to execute one or more processes; and
a memory configured to store a process executable by the processor, the process when executed operable to:
identify, for each of a plurality of attack detectors, a set of output labels used by the attack detector, wherein the attack detector is configured to apply one of the set of output labels to an input data set regarding the network;
determine a set of output label dependencies between the sets of output labels for the attack detectors that exploit dependencies between overlapping labels used by different attack detection classifiers;
provide the attack detectors to one or more nodes in the network; and
provide the set of output label dependencies to the one or more nodes in the network, wherein the one or more nodes use the set of output label dependencies to select a finalized label from among output labels applied by the attack detectors.

22. The ap

Assignees

• Cisco Tech Inc

Inventors

• Cruz Mota Javier
• Di Pietro Andrea
• Vasseur Jean-Philippe

Classifications

• H04W4/70

  Services for machine-to-machine communication [M2M] or machine type communication [MTC] · CPC title

• H04L63/1408 Primary

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• H04L63/1458

  Denial of Service · CPC title

• H04L63/1466

  Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks · CPC title

• H04W12/126

  Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning · CPC title