System, method, and computer program for detecting and measuring changes in network behavior of communication networks utilizing real-time clustering algorithms

Patent metadata

Field	Value
Publication number	US-9729571-B1
Application number	US-201514815715-A
Country	US
Kind code	B1
Filing date	Jul 31, 2015
Priority date	Jul 31, 2015
Publication date	Aug 8, 2017
Grant date	Aug 8, 2017

Abstract

A system, method, and computer program product are provided for detecting and measuring changes in network behavior of communication networks utilizing real-time clustering algorithms. In use, network traffic associated with at least one communication network is received. Additionally, the network traffic is characterized and classified based on similarities in the network traffic utilizing one or more real-time clustering algorithms. Further, changes in network behavior of the at least one communication network are detected and measured utilizing information associated with the classified network traffic.

First claim

What is claimed is:

1. A computer program product embodied on a non-transitory computer readable medium, comprising:
computer code for receiving network traffic associated with at least one communication network;
computer code for characterizing and classifying the network traffic based on similarities in the network traffic utilizing one or more real-time clustering algorithms including:
creating clusters for each feature in the network traffic with each feature being clustered independently from each other feature, wherein results of creating the clusters for each feature in the network traffic are represented in a matrix with each row vector in the matrix representing a cluster definition and containing a norm for each time unit, and wherein the matrix includes as many rows as clusters found in the network traffic, and
applying a normalizing function to the matrix to generate a real number; and

computer code for detecting and measuring changes in network behavior of the at least one communication network utilizing information associated with the classified network traffic.

2. The computer program product of claim 1 , wherein the computer program product is operable such that a combination of time units are selected to generate a plurality of periods and associated information that are stored in a time window matrix.

3. The computer program product of claim 2 , wherein the computer program product is operable such that a similarity score is calculated between each feature from a current time period and a previous time period.

4. The computer program product of claim 3 , wherein the computer program product is operable such that the similarity score is used to profile the network traffic in real time and to determine how different current network traffic is compared to an expected behavior of the network traffic.

5. The computer program product of claim 3 , wherein the computer program product is operable such that the similarity score is used to detect dangerous network traffic in early stages.

6. The computer program product of claim 1 , wherein the computer program product is operable such that characterizing and classifying the network traffic based on similarities in the network traffic utilizing the one or more real-time clustering algorithms includes modeling the network traffic of the at least one communications network in numerical matrices.

7. The computer program product of claim 1 , wherein the computer program product is operable such that characterizing and classifying the network traffic based on similarities in the network traffic utilizing the one or more real-time clustering algorithms includes encapsulating the network traffic in windows of time and expressing the network traffic in at least one algebraic expression.

8. The computer program product of claim 1 , wherein the computer program product is operable such that characterizing and classifying the network traffic based on similarities in the network traffic utilizing the one or more real-time clustering algorithms includes calculating a similarity between past behavior of the at least one communication network and present behavior of the at least one communication network in real time.

9. The computer program product of claim 1 , wherein the computer program product is operable such that characterizing and classifying the network traffic based on similarities in the network traffic utilizing the one or more real-time clustering algorithms includes calculating a delta representing a distance between an expected behavior of the at least one communication network and an observed behavior of the at least one communication network.

10. The computer program product of claim 1 , wherein the computer program product is operable such that characterizing and classifying the network traffic based on similarities in the network traffic utilizing the one or more real-time clustering algorithms includes calculating a degree of similarity of current network traffic and previously identified network traffic types.

11. The computer program product of claim 1 , wherein the computer program product is operable such that characterizing and classifying the network traffic based on similarities in the network traffic utilizing the one or more real-time clustering algorithms includes executing a plurality of clustering processes in parallel, one clustering process per feature of the network traffic, to provide a level of dependency among variables included in the network traffic.

12. The computer program product of claim 1 , further comprising computer code for generating a grade of accuracy of the classification of the network traffic.

13. The computer program product of claim 1 , wherein the computer program product is operable such that detecting and measuring changes in the network behavior of the at least one communication network utilizing the classified network traffic includes detecting concept drift situations and distinguishing novelty from anomaly.

14. A method, comprising:
receiving network traffic associated with at least one communication network;
characterizing and classifying the network traffic based on similarities in the network traffic utilizing one or more real-time clustering algorithms, including:
creating clusters for each feature in the network traffic with each feature being clustered independently from each other feature, wherein results of creating the clusters for each feature in the network traffic are represented in a matrix with each row vector in the matrix representing a cluster definition and containing a norm for each time unit, and wherein the matrix includes as many rows as clusters found in the network traffic, and
applying a normalizing function to the matrix to generate a real number; and

detecting and measuring changes in network behavior of the at least one communication network utilizing information associated with the classified network traffic.

15. A system, comprising:
a memory system; and
one or more processing cores coupled to the memory system and that are each configured to:
receive network traffic associated with at least one communication network;
characterize and classify the network traffic based on similarities in the network traffic utilizing one or more real-time clustering algorithms, including:
creating clusters for each feature in the network traffic with each feature being clustered independently from each other feature, wherein results of creating the clusters for each feature in the network traffic are represented in a matrix with each row vector in the matrix representing a cluster definition and containing a norm for each time unit, and wherein the matrix includes as many rows as clusters found in the network traffic, and
applying a normalizing function to the matrix to generate a real number; and

detect and measure changes in network behavior of the at least one communication network utilizing information associated with the classified network traffic.

Assignees

• Amdocs Software Systems Ltd
• Amdocs Dev Ltd

Inventors

• Ferguson Paul Andrew
• Llopis Roman Ferrando
• Cogan Peter John

Classifications

• H04L63/306

  intercepting packet switched data communications, e.g. Web, Internet or IMS communications · CPC title

• H04L63/1441 Primary

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04L45/46

  Cluster building · CPC title

• H04L63/1408 Primary

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• H04L47/2441

  relying on flow classification, e.g. using integrated services [IntServ] · CPC title