NETWORK INTRUSION DETECTION VISUALIZATION

• US 20110067106A1
• Filed: 09/15/2009
• Published: 03/17/2011
• Est. Priority Date: 09/15/2009
• Status: Active Grant

• Current Assignee: Lockheed Martin Corporation (Martin Marietta Corporation)
• Original Assignee: Lockheed Martin Corporation (Martin Marietta Corporation)
• Inventors: Bejtlich, Richard, Impson, Jeremy, Markham, Thomas, Evans, Scott Charles, Steinbrecher, Eric
• Granted Patent: US 8,245,301 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A network activity visualization system can include a minimum description length (MDL) based network intrusion detection system having an MDL grammar database adapted to store a plurality of MDL grammars, and a pattern matching module adapted to match a received network activity data set against the MDL grammars by calculating a distance of the network activity data set from each MDL grammar. The system can also include an intelligent icon module coupled to the MDL-based intrusion detection system and adapted to receive the MDL grammars and distances of a network data set from each respective MDL grammar, and adapted to generate intelligent icons based on the MDL grammars and distances. The system can further include a display system adapted to display the intelligent icons so as to provide a visual indication of network security.

Claims

1. A network monitoring and visualization system comprising:

a computer coupled to a network and adapted to receive data from the network, the computer including a computer readable medium having stored thereon software instructions for programming the computer to monitor the network and to provide a graphical visualization of monitored network activity, the software instructions, when executed by the computer, cause the computer to perform operations including;

retrieving a plurality of minimum description length (MDL) models, each MDL model representing a different network activity behavior and each MDL model including a grammar having a plurality of motifs;

receiving a network activity data sample corresponding to network activity;

applying the grammar of each MDL model to the data sample to determine a measure of similarity between the data sample and the MDL model corresponding to the grammar being applied;

characterizing the data sample based on the measure of similarity, including mapping a normalized difference value for each motif of a grammar to a generate a plurality of statistical features;

generating a plurality of intelligent icons, each corresponding to one of the MDL models and each including a plurality of graphical representations corresponding to one of the statistical features representing the normalized difference value of a respective one of the motifs for that MDL model; and

simultaneously displaying the intelligent icons on a display device coupled to the computer.

2. The system of claim 1, wherein the operations further include arranging the graphical representations based on a relative importance of a corresponding motif within the MDL model associated with that motif.

3. The system of claim 1, wherein the characterizing includes calculating a proximity between the data sample and the one or more MDL models.

4. The system of claim 1, wherein the network activity is classified as normal activity or threat activity based on the characterization of the data sample.

5. The system of claim 1, wherein the network activity is classified as a zero day attack when the data sample is determined to have a distance from each of the MDL models that is above a predetermined threshold.

6. The system of claim 1, wherein the MDL models include a group of normal network activity models and a group of attack network activity models, both groups being displayed simultaneously.

7. The system of claim 6, wherein the statistical features indicate whether the network activity data is more likely correlated with the group of normal network activity MDL models or with the group of attack network activity MDL models.

8. The system of claim 1, wherein the statistical features indicate the proximity of the network activity relative to one or more of the MDL models.

9. The system of claim 1, wherein the statistical features indicate that the network activity data represents a new network behavior when the statistical features exceed a threshold distance from the MDL models.

10. A network activity visualization system comprising:

means for detecting network intrusions using an intrusion detection system having a mathematical model database adapted to store a plurality of mathematical models, and a pattern matching module adapted to match a received network activity data set against each mathematical model by calculating a distance of the network activity data set from a respective one of the mathematical models;

means for generating intelligent icons based on the mathematical models and corresponding calculated distances; and

means for displaying the intelligent icons so as to provide a visual indication of network security.

11. The system of claim 10, wherein when the distance between the network activity data set and each of the mathematical models exceeds a predetermined threshold, the network activity data is identified as a new behavior and a mathematical modeling process is performed on the network activity data to generate a new mathematical.

12. The system of claim 11, wherein the new model is classified as a normal mathematical model or an attack mathematical model.

13. The system of claim 12, wherein the new model is added to the mathematical model database.

14. A computer-implemented method of intrusion detection visualization comprising:

retrieving a plurality of minimum description length (MDL) models, each model representing a different network activity behavior;

receiving network activity data corresponding to network activity;

characterizing the network activity data using a computer programmed to perform intrusion detection visualization and the MDL models, the characterizing including generating, with the computer, a plurality of statistical features each representing a relationship between the network activity data and a respective one of the MDL models;

associating, with the computer, each of a plurality of graphical representations with a corresponding one of the MDL models;

altering, with the computer, the appearance of each graphical representation based on the statistical feature of the corresponding MDL model; and

displaying one or more of the graphical representations on a display device coupled to the computer, the graphical representations providing a visual indication of the corresponding statistical feature.

15. The method of claim 14, further comprising arranging the graphical representations on the display device based on similarity of the statistical features of the graphical representations.

16. The method of claim 14, wherein the characterizing includes calculating, with the computer, a proximity between the compressed network activity data and the one or more MDL models.

17. The method of claim 14, wherein the network activity is classified as normal activity or threat activity based on the characterization.

18. The method of claim 14, wherein the network activity is classified as a zero day attack when the compressed network activity data is determined to have a distance from each of the MDL models that is above a predetermined threshold.

19. The method of claim 14, wherein the MDL models include a group of normal network activity models and a group of attack network activity models.

20. The method of claim 14, wherein the statistical feature indicates whether the network activity data is more likely correlated with the group of normal network activity MDL models or with the group of attack network activity MDL models.