NETWORK ACTIVITY ANOMALY DETECTION
First Claim
1. A method for determining whether anomalous activity exists on a network, comprising:
- receiving a packet from the network, the packet including one or more fields;
determining a classification of the packet based on the one or more fields;
incrementing, based on the classification, a first counter of one or more counters associated with detecting the anomalous activity;
determining, based on the incrementing, an activity metric associated with the one or more counters wherein the activity metric is anticipated to fall within a threshold; and
determining whether the anomalous activity exists on the network based on whether the activity metric falls within the threshold.
4 Assignments
0 Petitions
Accused Products
Abstract
A method for determining whether anomalous activity exists on a network includes receiving a packet from the network, the packet including one or more fields. A classification of the packet based on the one or more fields is determined. A first counter of one or more counters associated with detecting the anomalous activity is incremented based on the classification. An activity metric associated with the one or more counters is determined based on the incrementing, wherein the activity metric is anticipated to fall within a threshold. Whether the anomalous activity exists on the network is determined based on whether the activity metric falls within the threshold.
-
Citations
20 Claims
-
1. A method for determining whether anomalous activity exists on a network, comprising:
-
receiving a packet from the network, the packet including one or more fields; determining a classification of the packet based on the one or more fields; incrementing, based on the classification, a first counter of one or more counters associated with detecting the anomalous activity; determining, based on the incrementing, an activity metric associated with the one or more counters wherein the activity metric is anticipated to fall within a threshold; and determining whether the anomalous activity exists on the network based on whether the activity metric falls within the threshold. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10)
-
-
11. A network device associated comprising:
-
a parser configured to parse a packet into one or more fields; a classification module configured to determine a classification of the packet based on the one or more fields; an action table including the classification of the packet and one or more corresponding actions; a monitor configured to determine when a counter is incremented based on the corresponding actions, wherein the counter is associated with a set of one or more counters; an activity engine configured to determine, based on the set of one or more counters and including the incremented counter, an activity metric associated with the packet; and comparison logic configured to determine whether anomalous activity exists on the network based on a comparison of the activity metric to a threshold associated with the anomalous activity. - View Dependent Claims (12, 13, 14, 15, 16, 17, 18)
-
-
19. A computer program product for detecting anomalous activity on a network, the computer program product being tangibly embodied on a computer-readable medium configured to cause a data processing apparatus to detect the anomalous activity on the network, the computer program product configured to:
-
determine a classification of a packet received from the network based on one or more classification rules associated with the classification; determine one or more actions to be performed based on the classification, the one or more actions including incrementing a first counter of a plurality of counters associated with detecting the anomalous activity; determine an activity metric based on the plurality of counters, wherein the activity metric is anticipated to fall within a threshold; and determine a response to the anomalous activity based upon a determination that the activity metric falls beyond the threshold. - View Dependent Claims (20)
-
Specification