Vector-based anomaly detection

Patent metadata

Field	Value
Publication number	US-9716723-B2
Application number	US-201514887842-A
Country	US
Kind code	B2
Filing date	Oct 20, 2015
Priority date	Nov 18, 2010
Publication date	Jul 25, 2017
Grant date	Jul 25, 2017

Abstract

Methods of detecting anomalous behaviors associated with a fabric are presented. A network fabric can comprise many fungible networking nodes, preferably hybrid-fabric apparatus capable of routing general purpose packet data and executing distributed applications. A nominal behavior can be established for the fabric and represented by a baseline vector of behavior metrics. Anomaly detection criteria can be derived as a function of a variation from the baseline vector based on measured vectors of behavior metrics. Nodes in the fabric can provide a status for one or more anomaly criterion, which can be aggregated to determine if an anomalous behavior has occurred, is occurring, or is about to occur.

First claim

What is claimed is:

1. A method of detecting anomalous behavior of a network fabric, comprising:
determining a baseline vector corresponding to nominal behavior of a fabric, the baseline vector comprising at least two different behavior metrics that are correlated with each other;
disaggregating anomaly detection criteria into a plurality of anomaly criterion to be distributed among nodes of the fabric, the anomaly detection criteria characterizing a variation from the baseline vector, and each of the plurality of anomaly criterion comprising a function of a measured vector of behavior metrics, the variation calculated based on a variation function applied to a vector of measured behavior metrics having elements corresponding to member elements of the baseline vector;
aggregating anomaly criterion statuses calculated by at least some of the nodes to detect anomalous behavior, each anomaly criterion status being calculated by a network node as a function of the node's anomaly criterion and a measured vector of the at least two different behavior metrics; and
notifying a manager of the fabric anomalous behavior.

2. The method recited in claim 1 , wherein aggregating comprises detecting satisfaction of the anomaly detection criteria as a function of the anomaly criterion statuses indicating occurrence of the fabric's anomalous behavior relative to the nominal behavior.

3. The method recited in claim 1 , wherein the anomaly detection criteria is established by at least one of simulating an anomalous behavior within the fabric while the fabric is active; modeling an anomalous behavior within the fabric to derive the variation from the baseline vector by constructing a logical representation of the fabric using nodes of the fabric; and modeling an anomalous behavior by running a live drill.

4. The method recited in claim 1 , further comprising at least one of collecting fabric-level metrics as a portion of measured behaviors metrics; collecting apparatus-level metrics as a portion of the measured behaviors metrics; collecting component-level metrics as a portion of the measured behaviors metrics; collecting application metrics as a portion of the measured behaviors metrics; and collecting external metrics as a portion of the measured behaviors metrics.

5. The method of claim 1 , further comprising at least some of the nodes calculating their anomaly criterion status as a function of a trend of measured behavior metrics.

6. The method of claim 1 , further comprising generating a leading indicator of a likelihood that anomalous behavior is about to occur as a function of aggregated anomaly criterion statuses.

7. The method of claim 6 , wherein generating the leading indicator includes calculating a likelihood of the anomalous behavior occurring while an anomaly detection criteria remains unsatisfied.

8. The method of claim 1 , further comprising at least one of identifying an anomaly type of the anomalous behavior based on the anomaly criterion statuses automatically responding to the anomalous behavior according to a prior defined action based at least in part on the anomaly type; migrating anomalous traffic to a monitored data channel within the fabric; updating the anomaly detection criteria according to a known change in the fabric and sending the nodes correspondingly updated anomaly criterion; and updating the anomaly detection criteria according to an expected behavior change vector reflecting expected behavior changes due to deployment of an application within the fabric and sending the nodes correspondingly updated anomaly criterion.

9. The method of claim 1 , further comprising storing a history of the anomaly criterion statuses in a black box memory.

10. The method of claim 9 , wherein the step of storing the history includes migrating the history from a first one of the networking nodes to the black box memory housed within a second, different one of the nodes in response to the anomaly criterion statuses satisfying a migration triggering condition.

11. A non-transitory computer readable medium comprising instructions for:
determining a baseline vector corresponding to nominal behavior of a fabric, the baseline vector comprising at least two different behavior metrics that are correlated with each other;
disaggregating anomaly detection criteria into a plurality of anomaly criterion to be distributed among nodes of the fabric, the anomaly detection criteria characterizing a variation from the baseline vector, and each of the plurality of anomaly criterion comprising a function of a measured vector of behavior metrics, the variation calculated based on a variation function applied to a vector of measured behavior metrics having elements corresponding to member elements of the baseline vector;
aggregating anomaly criterion statuses calculated by at least some of the nodes to detect anomalous behavior, each anomaly criterion status being calculated by a network node as a function of the node's anomaly criterion and a measured vector of the at least two different behavior metrics; and
notifying a manager of the fabric anomalous behavior.

12. The non-transitory computer readable medium recited in claim 11 , wherein aggregating comprises detecting satisfaction of the anomaly detection criteria as a function of the anomaly criterion statuses indicating occurrence of the fabric's anomalous behavior relative to the nominal behavior.

13. The non-transitory computer readable medium recited in claim 11 , wherein the anomaly detection criteria is established by at least one of simulating an anomalous behavior within the fabric while the fabric is active; modeling an anomalous behavior within the fabric to derive the variation from the baseline vector by constructing a logical representation of the fabric using nodes of the fabric; and modeling an anomalous behavior by running a live drill.

14. The non-transitory computer readable medium recited in claim 11 , further comprising at least one of collecting fabric-level metrics as a portion of measured behaviors metrics; collecting apparatus-level metrics as a portion of the measured behaviors metrics; collecting component-level metrics as a portion of the measured behaviors metrics; collecting application metrics as a portion of the measured behaviors metrics; and collecting external metrics as a portion of the measured behaviors metrics.

15. The non-transitory computer readable medium of claim 11 , further comprising at least some of the nodes calculating their anomaly criterion status as a function of a trend of measured behavior metrics.

16. The non-transitory computer readable medium of claim 11 , further comprising generating a leading indicator of a likelihood that anomalous behavior is about to occur as a function of aggregated anomaly criterion statuses.

17. The non-transitory computer readable medium of claim 16 , wherein generating the leading indicator includes calculating a likelihood of the anomalous behavior occurring while an anomaly detection criteria remains unsatisfied.

18. The non-transitory computer readable medium of claim 11 , further comprising at least one of identifying an anomaly type of the anomalous behavior based on the anomaly criterion statuses automatically responding to the anomalous behavior according to a prior defined action based at least in part on the anomaly type; migrating anomalous traffic to a monitored data channel within the fabric; updating the anomaly detection criteria according to a known change in the fabric and sending the nodes correspondingly updated anomaly criterion; and upda

Assignees

• Nant Holdings Ip Llc

Inventors

• Wittenschlaeger Thomas

Classifications

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• G06F21/552 Primary

  involving long-term monitoring or reporting · CPC title

• H04L63/18

  using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215) · CPC title