×

Detecting network anomalies using node scoring

  • US 10,560,364 B1
  • Filed: 03/15/2017
  • Issued: 02/11/2020
  • Est. Priority Date: 03/15/2017
  • Status: Active Grant
First Claim
Patent Images

1. A computer-implemented method comprising:

  • receiving training data, the training data having a data structure including a first directed graph, the first directed graph having first nodes and first directed edges between the first nodes, each of the first nodes representing a respective first computer in a network in a first time period, each of the first directed edges representing a respective first request from a first computer to access another first computer that occurred in the first time period;

    determining, using a link analysis algorithm, a respective first node score for each of the first nodes in the first directed graph, each of the respective first node scores indicating a respective popularity of each of the first nodes during the first time period;

    receiving test data, the test data having a data structure including a second directed graph, the second directed graph having second nodes and second directed edges, each of the second nodes representing a respective second computer in the network in a second time period, each of the second edges representing a respective second request from a second computer to access another second computer that occurred in the second time period;

    generating a reduced second directed graph including;

    identifying edges that appear respectively between nodes occurring in both the first directed graph and the second directed graph, andremoving, from the second directed graph, the identified edges that also appear in the first directed graph;

    determining, using the link analysis algorithm, a respective second node score for each of the second nodes in the reduced second directed graph, each of the respective second node scores indicating a respective popularity of each of the second nodes during the second time period;

    for each particular node that is in the first directed graph and the reduced second directed graph, determining a respective difference between the first node score of the particular node and the second node score of the particular node; and

    designating a particular computer corresponding to a particular node as an anomalous computer upon determining that the difference corresponding to the particular node exceeds a threshold value,wherein the method is performed by one or more computers.

View all claims
  • 1 Assignment
Timeline View
Assignment View
    ×
    ×