Methods and apparatus to identify malicious activity in a network

Patent metadata

Field	Value
Publication number	US-9503465-B2
Application number	US-201314080532-A
Country	US
Kind code	B2
Filing date	Nov 14, 2013
Priority date	Nov 14, 2013
Publication date	Nov 22, 2016
Grant date	Nov 22, 2016

Abstract

Methods, apparatus, systems and articles of manufacture are disclosed to learn malicious activity. An example method includes assigning weights of a distance function to respective statistical features; iteratively calculating, with a processor, the distance function to adjust the weights (1) to cause a reduction in a first distance calculated according to the distance function for a first pair of entities in a reference group associated with malicious activity and (2) to cause an increase in a second distance calculated according to the distance function for a first one of the entities included in the reference group and a second entity not included in the reference group; and determining whether a first statistical feature is indicative of malicious activity based on a respective adjusted weight of the first statistical feature determined after calculating the distance function for a number of iterations.

First claim

What is claimed is:

1. A method comprising:
generating, with a processor, a set of statistical features based on communications between a plurality of network devices including a set of suspect devices classified as being associated with malicious activity and a set of unclassified devices;
iteratively adjusting, with the processor and for a first number of iterations, a set of weights of a distance function representing differences between vectors of statistical features for di…

Assignees

• At & T Ip I Lp

Inventors

• Coskun Baris

Classifications

• H04L63/1416

  Electricity · mapped topic

• H04L43/04

  Electricity · mapped topic

• G06F16/951

  Physics · mapped topic

• H04L63/1425 Primary

  Electricity · mapped topic

• H04L63/0254

  Electricity · mapped topic