Network data processing driver for a cognitive artifical intelligence system

• US 10,454,777 B2
• Filed: 04/06/2017
• Issued: 10/22/2019
• Est. Priority Date: 04/06/2016
• Status: Active Grant

• Current Assignee: Intellective Ai, Inc.
• Original Assignee: Omni AI, Inc.
• Inventors: Yang, Tao, Seow, Ming-Jung
• Primary Examiner(s): Lee, Gil H.
• Application Number:
  US15/481,320
• Publication Number:
  US 20170295070A1
• Time in Patent Office: 929 Days
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/142 using statistical or mathematical methods
• CPC Class Codes: H04L 41/16 using machine learning or artificial intelligence
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

Techniques are disclosed for processing data collected from network components for analysis by a machine learning engine of a Cognitive AI System. A network data processing driver receives a stream of data from a data collector which obtains data from one or more network data sources. The driver normalizes the stream of data to one or more feature values each corresponding to the network data sources and generates a sample vector from the feature values. The sample vector is formatted to be analyzed by the machine learning engine.

Claims

1. A computer-implemented method to generate a logical network topology for a network, the method comprising:

receiving a first stream of data from a data collector within a network, the first stream of data obtained from a data source within the network;

identifying a packet header from the first stream of data and extracting address information from the packet header;

separating the extracted address information into multiple components and converting the separated address information components to feature values;

normalizing the feature values, the feature values associated with the data source;

generating, via a neuro-linguistic model, patterns associated with the normalized feature values and related to network traffic attributes;

generating statistics from the patterns;

generating a logical network topology based on the generated statistics;

generating a context-aware description of network activity based at least in part on a mapping of the normalized feature values in the logical network topology to corresponding network components;

detecting an anomaly in the network activity based on the patterns, wherein the anomaly is associated with a network attack;

generating an alert signal in response to detecting the anomaly, the alert signal representing a context-aware description of the anomaly; and

sending the alert signal.

2. The computer-implemented method of claim 1, wherein the address information includes at least one of:

source Media Access Control (MAC) address;

destination MAC address;

network address; and

data payload.

3. The computer-implemented method of claim 1, wherein at least one of the feature values includes a value between 0 and 1.

4. The computer-implemented method of claim 1, further comprising:

receiving a second stream of data from the data collector; and

updating the logical network topology based on the second stream of data.

5. The computer-implemented method of claim 4, wherein updating the logical network topology includes:

extracting at least one feature value of the feature values from the second stream of data;

updating, via the neuro-linguistic model, patterns associated with the extracted at least one feature value; and

updating the statistics based on the updated patterns associated with the extracted at least one feature value.

6. The computer-implemented method of claim 1, further comprising:

generating connectivity patterns representing network traffic attributes for the network.

7. The computer-implemented method of claim 1, further comprising:

converting the alert signal representing the anomaly to human-readable description of the anomaly data.

8. The computer-implemented method of claim 1, further comprising:

determining whether to analyze the network attack.

9. The computer-implemented method of claim 1, wherein the network attack is one of:

a distributed denial of service (DDoS) attack, an Internet Control Message Protocol (ICMP) flood attack, or network address spoofing.

10. The computer-implemented method of claim 1, further comprising:

learning, via a machine learning engine, an association between at least one of the patterns and the network attack; and

analyzing the anomaly to determine that the anomaly is associated with the network attack.

11. The computer-implemented method of claim 10, wherein the network attack is one of:

a DDoS attack, an ICMP flood attack, or network address spoofing.