Systems and methods for automatic profiling of network event sequences

• US 8,200,797 B2
• Filed: 11/16/2007
• Issued: 06/12/2012
• Est. Priority Date: 11/16/2007
• Status: Active Grant

• Current Assignee: NEC Corporation
• Original Assignee: NEC Laboratories America Inc (NEC Corporation)
• Inventors: Meng, Xiaoqiao, Zhang, Hui, Chen, Haifeng, Yoshihira, Kenji, Jiang, Guofei
• Primary Examiner(s): Swearingen, Jeffrey R
• Assistant Examiner(s): ELFERVIG, TAYLOR A
• Application Number:
  US11/941,759
• Publication Number:
  US 20090132865A1
• Time in Patent Office: 1,670 Days
• Field of Search: 709/200, 709/223, 704/256
• US Class Current: 709/223
• CPC Class Codes: H04L 41/0613 based on the type or category of the network elements
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]

Abstract

Systems and methods are disclosed that profile event sequences by creating a mixture model from the event sequences; estimating parameters for the mixture model; and applying the mixture model to profile the event sequences.

Claims

1. A method to profile event sequences, comprising:

creating a mixture model stored on a non-transitory machine readable storage medium that simultaneously characterizes event pattern and time information;

estimating parameters for the mixture model;

applying the mixture model to profile event sequences in computer networks, wherein the mixture model characterizes at least two behaviour aspects including TCP SYN/FIN/RST dataset; and

displaying transition delay and rate parameters by thickness and scattering of corresponding edge(s) wherein the rate parameters and edge(s) are shown in a graph.

2. The method of claim 1, wherein the mixture model comprises multiple first order Markov chains whose transitions have two parameters:

transition probability and transition rate.

3. The method of claim 1, comprising adding constraints to the mixture model by using domain knowledge.

4. The method of claim 1, comprising selecting a number of Markov chains in the mixture model by using domain knowledge.

5. The method of claim 1, comprising estimating parameters using an Expectation Maximization process.

6. The method of claim 1, comprising visualizing the mixture model.

7. The method of claim 6, comprising using dotted line to display a transition and setting the ratio of dash length and dash gap in proportion to a function of average transition delay.

8. The method of claim 7, comprising setting the thickness of each transition in proportion to transition probability.

9. The method of claim 1, comprising detecting network anomalies based on the mixture model.

10. A system to profile event sequences, comprising:

a mixture model stored on non-transitory machine readable storage medium that simultaneously characterizes event pattern and time information;

a parameter estimator coupled to the mixture model; and

a user interface module to apply the mixture model to profile event sequences in computer networks, wherein the mixture model characterizes at least two behaviour aspects including TCP SYN/FIN/RST dataset, wherein the user interface module displays transition delay and rate parameters by thickness and scattering of corresponding edge(s) and wherein the rate parameters and edge(s) are shown in a graph.

11. The system of claim 10, wherein the mixture model comprises multiple first order Markov chains whose transitions have two parameters:

transition probability and transition rate.

12. The system of claim 10, comprising adding constraints to the mixture model by using domain knowledge.

13. The system of claim 10, wherein the mixture model comprises a number of Markov chains selected by using domain knowledge.

14. The system of claim 10, wherein the parameter estimator comprises an Expectation Maximization process.

15. The system of claim 10, comprising a graphical user interface (GUI) to visualize the mixture model.

16. The system of claim 15, wherein the GUI uses dotted line to display transition and sets the ratio of dash length and dash gap in proportion to a function of average transition delay.

17. The system of claim 15, wherein the GUI sets the thickness of each transition line in proportion to transition probability.

18. The system of claim 10, comprising a verifier to detect network anomalies based on the mixture model.