APPARATUS METHOD AND MEDIUM FOR DETECTING PAYLOAD ANOMALY USING N-GRAM DISTRIBUTION OF NORMAL DATA
0 Assignments
0 Petitions
Accused Products
Abstract
A method, apparatus and medium are provided for detecting anomalous payloads transmitted through a network. The system receives payloads within the network and determines a length for data contained in each payload. A statistical distribution is generated for data contained in each payload received within the network, and compared to a selected model distribution representative of normal payloads transmitted through the network. The model payload can be selected such that it has a predetermined length range that encompasses the length for data contained in the received payload. Anomalous payloads are then identified based on differences detected between the statistical distribution of received payloads and the model distribution. The system can also provide for automatic training and incremental updating of models.
-
Citations
67 Claims
-
1-28. -28. (canceled)
-
29. A method of modeling payload data received in a network, comprising the steps of:
-
receiving a plurality of payload data in the network; creating a payload length distribution for all payload data received; partitioning the payload length distribution into a plurality of payload ranges; generating a statistical distribution for each received payload data; and constructing a model payload for each payload range based on the statistical distributions of all received payload data encompassed by the payload range. - View Dependent Claims (30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46)
-
-
47-50. -50. (canceled)
-
51. A system for modeling payload data received in a network, comprising:
-
a computer coupled to the network, and receiving a plurality of payload data through the network; said computer being configure to; create a payload length distribution for all payload data received, partition said payload length distribution into a plurality of payload ranges, generate a statistical distribution for each received payload data, and construct a model payload for each payload range based on the statistical distributions of all received payload data encompassed by said payload range. - View Dependent Claims (52, 53)
-
-
54-57. -57. (canceled)
-
58. A computer readable medium carrying instructions executable by a computer for modeling payload data received in a network, said instructions causing said computer to perform the acts of:
-
receiving a plurality of payload data through the network; creating a payload length distribution for all payload data received; partitioning said payload length distribution into a plurality of payload ranges; generating a statistical distribution for each received payload data; and constructing a model payload for each payload range based on the statistical distributions of all received payload data encompassed by the payload range. - View Dependent Claims (59, 60)
-
-
61-64. -64. (canceled)
-
65. A system for modeling payload data received in a network, comprising:
-
means for receiving a plurality of payload data through the network; means for creating a payload length distribution for all payload data received; means for partitioning said payload length distribution into a plurality of payload ranges; means for generating a statistical distribution for each received payload data; and means for constructing a model payload for each payload range based on the statistical distributions of all received payload data encompassed by the payload range. - View Dependent Claims (66, 67)
-
Specification