Method for the detection and visualization of anomalous behaviors in a computer network

• US 7,930,752 B2
• Filed: 11/17/2006
• Issued: 04/19/2011
• Est. Priority Date: 11/18/2005
• Status: Active Grant

• Current Assignee: Nexthink SA
• Original Assignee: Nexthink SA
• Inventors: Aguilar, Pedro Bados, Hertzog, Patrick
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): GUIRGUIS, MICHAEL M
• Application Number:
  US11/561,076
• Publication Number:
  US 20070118909A1
• Time in Patent Office: 1,614 Days
• Field of Search: 726 11- 15, 726/23, 726/25, 709/224
• US Class Current: 726/25
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

A method for the detection of anomalous behaviors in a computer network, comprising the steps of:

• • collecting data relating to connections in a plurality of nodes in a network,
  • sending the data from said nodes to an ADS platform,
  • computing from said data at least one value representative of the anomaly level of the connections of each said node and/or of applications initiating said connections and/or of users,
  • computing a multidimensional chart for visualizing the behavior of a plurality of nodes, applications and/or users in said network, wherein said value representative of the anomaly level is used as a dimension in said chart.

Claims

1. A method for the detection of anomalous behaviors in a computer network, comprising the steps of:

collecting data over a defined period of time relating to a set of connections comprising a plurality of connections initiated by components in the network including connections that occurred over said defined period of time, said components selected from any one or more of a group including users, nodes and applications, said data including data identifying components, applications and destination ports,

sending said data to an anomaly detection system (ADS) platform,

computing from said data a multidimensional chart displaying said components, applications, and destination ports in the form of icons along separate and essentially parallel axes, where the related components, applications and destination ports are interlinked between adjacent axes with lines to visualize the set of connections.

2. The method of claim 1, wherein the numbers of connections initiated by each component or group of components over time are computed and represented on said chart.

3. The method of claim 2 wherein the lines have thicknesses proportional to the number of connections following the same path.

4. The method of claim 1 wherein said components, applications, and destination ports are each represented by icons that can be grouped with others of the same type on the same axis, respectively ungrouped.

5. The method of claim 1 wherein anomaly levels of connections are computed and represented on the chart.

6. The method of claim 5 wherein said anomaly levels of the connections are represented by colors or hues of said icons and/or lines, dependent on the anomaly.

7. The method of claim 1 wherein the chart further includes destination nodes in the form of icons along a further separate and essentially parallel axis interlinked with lines to destination ports to visualize the connections.