Methods, Systems, and Computer Program Products for Detecting Communication Anomalies in a Network Based on Overlap Between Sets of Users Communicating with Entities in the Network

• US 20140250221A1
• Filed: 03/04/2013
• Published: 09/04/2014
• Est. Priority Date: 03/04/2013
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Wang, Wei, Coskun, Baris, Mathur, Suhas, Boggs, Nathaniel
• Granted Patent: US 9,203,856 B2
• Time in Patent Office: Days
• US Class Current: 709/224
• CPC Class Codes: H04L 41/14 Network analysis or design
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware

Abstract

Anomalies are detected in a network by detecting communication between a plurality of entities and a set of users in the network, determining an overlap between subsets of the set of users that the entities comprising the plurality of entities communicated with, respectively, and determining whether the communication between the plurality of entities and the set of users is anomalous based on the overlap.

Claims

1. A method of detecting communication anomalies in a network, comprising:

detecting communication between a plurality of entities and a set of users in the network;

determining an overlap between subsets of the set of users that the entities comprising the plurality of entities communicated with, respectively; and

determining whether the communication between the plurality of entities and the set of users is anomalous based on the overlap.

2. The method of claim 1, further comprising:

monitoring communication associated with the plurality of entities during a training period.

3. The method of claim 2, wherein the plurality of entities comprises domain names, IP addresses, phone numbers, and short codes;

and

wherein the method further comprises;

removing the domain names that communicated during the training period from the plurality of entities.

4. The method of claim 3, wherein determining the overlap comprises:

determining a similarity metric between pairs of the entities comprising the plurality of entities based on the overlap of the subsets of the set of users for each of the pairs, respectively.

5. The method of claim 4, further comprising:

identifying a cluster of the entities comprising the plurality of entities based on the overlap and the similarity metric.

6. The method of claim 5, wherein identifying the cluster of the entities comprises:

excluding the overlap of the subsets of the set of users for each of the pairs of the entities comprising the plurality of entities when the similarity metric for the respective pair is less than a similarity threshold;

excluding the overlap of the subsets of the set of users for each of the pairs of the entities comprising the plurality of entities when the overlap is less than a user threshold; and

determining a modularity of a graph in which nodes are defined by the plurality of entities and edges between the nodes are defined by the overlap of the subsets of the set of users for each of the pairs of the entities comprising the plurality of entities.

7. The method of claim 5, wherein determining whether the communication between the plurality of entities and the set of users is anomalous comprises:

determining that the communication associated with the cluster of the entities is not anomalous when a number of the entities comprising the cluster is less than about three.

8. The method of claim 5, wherein determining whether the communication between the plurality of entities and the set of users is anomalous comprises:

determining whether the communication associated with the cluster of the entities is anomalous based on reputations of the entities comprising the cluster.

9. The method of claim 5, wherein determining whether the communication between the plurality of entities and the set of users is anomalous comprises:

determining whether the communication associated with the cluster of the entities is anomalous based on operating system types of devices the set of users use to communicate with the entities comprising the cluster.

10. The method of claim 5, wherein determining whether the communication between the plurality of entities and the set of users is anomalous comprises:

determining whether the communication associated with the cluster of the entities is anomalous based on Internet protocol addresses the domain names in the cluster resolve to.

11. The method of claim 5, wherein determining whether the communication between the plurality of entities and the set of users is anomalous comprises:

determining whether the communication associated with the cluster of the entities is anomalous based on the cluster of entities comprising prepaid phone numbers.

12. The method of claim 5, wherein determining whether the communication between the plurality of entities and the set of users is anomalous comprises:

determining whether the communication associated with the cluster of the entities is anomalous based on a number of different countries contacted by the phone numbers in the cluster.

13. The method of claim 5, wherein determining whether the communication between the plurality of entities and the set of users is anomalous comprises:

determining whether the communication associated with the cluster of the entities is anomalous based on communication sequences between the set of users and the entities comprising the cluster.

14. The method of claim 5, wherein determining whether the communication between the plurality of entities and the set of users is anomalous comprises:

determining whether the communication associated with the cluster of the entities is anomalous based on changes in the plurality of entities comprising the cluster of the entities.

15. A system for detecting communication anomalies in a network, comprising:

processor; and

a memory that is coupled to the processor and comprises computer readable program code embodied in the memory that when executed by the processor causes the processor to perform operations comprising;

detecting communication between a plurality of entities and a set of users in the network;

determining an overlap between subsets of the set of users that the entities comprising the plurality of entities communicated with, respectively; and

determining whether the communication between the plurality of entities and the set of users is anomalous based on the overlap.

16. The system of claim 15, wherein the operations further comprise:

monitoring communication associated with the plurality of entities during a training period.

17. The system of claim 16, wherein the plurality of entities comprises domain names, IP addresses, phone numbers, and short codes;

and

wherein the operations further comprise;

removing the domain names that communicated during the training period from the plurality of entities;

wherein determining the overlap comprises determining a similarity metric between pairs of the entities comprising the plurality of entities based on the overlap of the subsets of the set of users for each of the pairs, respectively; and

identifying a cluster of the entities comprising the plurality of entities based on the overlap and the similarity metric.

18. A computer program product for detecting communication anomalies in a network, comprising:

a tangible computer readable medium comprising computer readable program code embodied in the medium that when executed by a processor causes the processor to perform operations comprising;

detecting communication between a plurality of entities and a set of users in the network;

determining an overlap between subsets of the set of users that the entities comprising the plurality of entities communicated with, respectively; and

determining whether the communication between the plurality of entities and the set of users is anomalous based on the overlap.

19. The computer program product of claim 18, wherein the operations further comprise:

monitoring communication associated with the plurality of entities during a training period.

20. The computer program product of claim 19, wherein the plurality of entities comprises domain names, IP addresses, phone numbers, and short codes;

and

wherein the operations further comprise;

removing the domain names that communicated during the training period from the plurality of entities;

wherein determining the overlap comprises determining a similarity metric between pairs of the entities comprising the plurality of entities based on the overlap of the subsets of the set of users for each of the pairs, respectively; and

identifying a cluster of the entities comprising the plurality of entities based on the overlap and the similarity metric.