Vector-based anomaly detection

• US 10,542,027 B2
• Filed: 01/15/2019
• Issued: 01/21/2020
• Est. Priority Date: 11/18/2010
• Status: Active Grant

• Current Assignee: Nant Holdings IP, LLC (NantWorks, LLC)
• Original Assignee: Nant Holdings IP, LLC (NantWorks, LLC)
• Inventors: Wittenschlaeger, Thomas
• Primary Examiner(s): Parsons, Theodore C
• Application Number:
  US16/248,305
• Publication Number:
  US 20190238578A1
• Time in Patent Office: 371 Days
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215

Abstract

A hybrid-fabric apparatus comprises a black box memory configured to store a plurality of behavior metrics and an anomaly agent coupled to the black box. The anomaly agent determines a baseline vector corresponding to nominal behavior of the fabric, wherein the baseline vector comprises at least two different behavior metrics that are correlated with each other. The anomaly agent disaggregates anomaly detection criteria into a plurality of anomaly criterion to be distributed among network nodes in the fabric.

Claims

1. A hybrid-fabric apparatus for detecting anomalous behavior of a network fabric comprising a plurality of network nodes, the hybrid-fabric apparatus comprising:

at least one memory configured to at least store a plurality of behavior metrics;

at least one processor coupled to the at least one memory; and

software code configured to use the at least one processor, access the at least one memory, and cause the apparatus to at least;

disaggregate a set of anomaly detection criteria into a plurality of anomaly criterion to be distributed among the plurality of network nodes, the set of anomaly detection criteria characterizing a variation from a baseline vector corresponding to nominal traffic flow through the network fabric, and the plurality of anomaly criterion comprising a function of a measured vector of behavior metrics comprising a threshold;

aggregate anomaly criterion statuses calculated by at least some of the plurality of network nodes to detect anomalous behavior, each anomaly criterion status being calculated with respect to a network node as a function of the network node'"'"'s anomaly criterion and the measured behavior vector of behavior metrics; and

initiate a notification regarding the anomalous behavior.

2. The hybrid-fabric apparatus of claim 1, wherein the baseline vector comprises at least two correlated behavior metrics.

3. The hybrid-fabric apparatus of claim 1, further caused to at least establish the anomaly detection criteria by at least:

simulating an anomalous behavior within the network fabric while the network fabric is active to derive the variation from the baseline vector.

4. The hybrid-fabric apparatus of claim 1, further caused to at least establish the anomaly detection criteria by at least:

modeling an anomalous behavior within the network fabric while the network fabric is active to derive the variation from the baseline vector by at least constructing a logical representation of the network fabric by at least using nodes of the network fabric.

5. The hybrid-fabric apparatus of claim 1, further caused to at least establish the anomaly detection criteria by at least:

modeling the anomalous behavior by at least running a live drill.

6. The hybrid-fabric apparatus of claim 1, wherein at least some of the plurality of network nodes calculate their anomaly criterion statuses as a function of a trend of the measured vector of the behavior metrics.

7. The hybrid-fabric apparatus of claim 1, further caused to at least generate a leading indicator of a likelihood that anomalous behavior is about to occur as a function of the aggregated anomaly criterion statuses.

8. The hybrid-fabric apparatus of claim 7, further caused to at least generate the leading indicator by at least calculating a likelihood of the anomalous behavior occurring while the anomaly detection criteria remains unsatisfied.

9. The hybrid-fabric apparatus of claim 1, further caused to at least identify an anomaly type of the anomalous behavior based on the anomaly criterion statuses.

10. The hybrid-fabric apparatus of claim 8, further caused to at least automatically respond to the anomalous behavior according to a prior defined action based at least in part on the anomaly type.

11. The hybrid-fabric apparatus of claim 1, further caused to at least migrate anomalous traffic to a monitored data channel within the network fabric.

12. The hybrid-fabric apparatus of claim 1, further caused to at least update the anomaly detection criteria according to a known change in the network fabric and sending the receiving nodes correspondingly updated anomaly criterion.

13. The hybrid-fabric apparatus of claim 12, wherein the known change comprises an expected behavior change vector reflecting expected behavior changes due to deployment of an application within the network fabric.

14. The hybrid-fabric apparatus of claim 1, further caused to at least store a history of the anomaly criterion statuses in the at least one memory.