SYSTEM AND METHOD FOR CORRELATING HISTORICAL ATTACKS WITH DIVERSE INDICATORS TO GENERATE INDICATOR PROFILES FOR DETECTING AND PREDICTING FUTURE NETWORK ATTACKS

• US 20140082730A1
• Filed: 09/17/2013
• Published: 03/20/2014
• Est. Priority Date: 09/18/2012
• Status: Active Grant

• Current Assignee: KDDI Corporation, Perspecta Labs Inc. (Perspecta, Inc.)
• Original Assignee: KDDI Corporation, TT Government Solutions, Inc. (Perspecta, Inc.)
• Inventors: CHADHA, Ritu, GHOSH, Abhrajit, POYLISHER, Alexander, SAWAYA, Yukiko, YAMADA, Akira, KUBOTA, Ayumu, VASHIST, Akshay
• Granted Patent: US 9,386,030 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

An apparatus and method predict and detect network attacks by using a diverse set of indicators to measure aspects of the traffic and by encoding traffic characteristics using these indicators of potential attacks or anomalous behavior. The set of indicators is analyzed by supervised learning to automatically learn a decision rule which examines the temporal patterns in the coded values of the set of indicators to accurately detect and predict network attacks. The rules automatically evolve in response to new attacks as the system updates its rules periodically by analyzing new data and feedback signals about attacks associated with that data. To assist human operators, the system also provides human interpretable explanations of detection and prediction rules by pointing to indicators whose values contribute to a decision that there is an existing network attack or an imminent network attack. When such indictors are detected, an operator can take remediation actions.

Claims

1. A method for detecting and predicting network attacks comprising:

acquiring attack alerts and indicator values representative of network traffic;

converting the alerts and indicator values into vectors;

using the vectors to generate training data representative of the alerts and the indicator values; and

implementing a learning algorithm to process the training data to generate decision rules used to detect or predict network attacks.

2. The method of claim 1, further comprising:

processing network traffic to generate indicator values;

converting the indicator values to vectors; and

using the decision rules to process the vectors to determine whether a network attach is occurring.

3. The method of claim 2, wherein the indicator values have time stamps representative of their time of occurrence, further comprising using a sliding window to collect indicators for processing during the window to determine if an alert should be issued.

4. The method of claim 1, wherein the indicator values are representative of indicators that include at least one selected from the group consisting of volume of traffic, rate of spoofing, rate of occurrence of unique source addresses, rate of occurrence of unique geographical locations of the source of traffic, ratio of SYN to non-SYN traffic and rate of occurrence of malicious source addresses.

5. The method of claim 1, further comprising using a flow agent to acquire network data.

6. The method of claim 5, further comprising storing the network data acquired by the flow agent.

7. The method of claim 5, further comprising routing the data to a collector for storing the network data for further processing.

8. The method of claim 7, further comprising routing stored network data to a real time flow filter for further processing of the network data to produce the indicator values.

9. The method of claim 1, further comprising routing network data to a real time flow filter for processing of the network data to produce the indicator values.

10. A system for detecting and predicting network attacks comprising:

a data processor; and

a memory accessible by the processor, the memory containing instructions readable by the processor to perform the steps of;

acquiring attack alerts and indicator values representative of network traffic;

converting the alerts and indicator values into vectors;

using the vectors to generate training data representative of the alerts and the indicator values; and

implementing a learning algorithm to process the training data to generate decision rules used to detect or predict network attacks.

11. The system of claim 10, further comprising instructions in the memory for:

processing network traffic to generate indicator values;

converting the indicator values to vectors; and

using the decision rules to process the vectors to determine whether a network attach is occurring.

12. The system of claim 11, wherein the indicator values have time stamps representative of their time of occurrence, further comprising instructions in the memory for generating and using a sliding window to collect indicators for processing during the window to determine if an alert should be issued.

13. The system of claim 10, wherein the indicator values are representative of indicators that include at least one selected from the group consisting of volume of traffic, rate of spoofing, rate of occurrence of unique source addresses, rate of occurrence of unique geographical locations of the source of traffic, ratio of SYN to non-SYN traffic and rate of occurrence of malicious source addresses.

14. The system of claim 10, further comprising a flow agent to acquire network data.

15. The system of claim 14, further comprising a memory portion for storing the network data acquired by the flow agent.

16. The system of claim 14, further comprising a collector for storing the network data for further processing.

17. The system of claim 16, further comprising a real time flow filter for further processing of the network data to produce the indicator values.

18. The system of claim 10, further comprising a real time flow filter for processing of the network data to produce the indicator values.

19. A system for detecting and predicting network attacks comprising:

first apparatus for acquiring attack alerts and indicator values representative of network traffic;

second apparatus for converting the alerts and indicator values into vectors;

third apparatus for using the vectors to generate training data representative of the alerts and the indicator values; and

fourth apparatus for implementing a learning algorithm to process the training data to generate decision rules used to detect or predict network attacks.

20. A computer readable non-transitory storage medium storing instructions of a computer program which when executed by a computer system results in performance of steps of a method for detecting and predicting network attacks, comprising:

acquiring attack alerts and indicator values representative of network traffic;

converting the alerts and indicator values into vectors;

using the vectors to generate training data representative of the alerts and the indicator values; and

implementing a learning algorithm to process the training data to generate decision rules used to detect or predict network attacks.