MULTI-AGENT, DISTRIBUTED, PRIVACY-PRESERVING DATA MANAGEMENT AND DATA MINING TECHNIQUES TO DETECT CROSS-DOMAIN NETWORK ATTACKS

• US 20100017870A1
• Filed: 07/18/2008
• Published: 01/21/2010
• Est. Priority Date: 07/18/2008
• Status: Abandoned Application

• Current Assignee: Agnik LLC
• Original Assignee: Agnik LLC
• Inventors: Kargupta, Hillol
• Application Number:
  US12/175,453
• Publication Number:
  US 20100017870A1
• Time in Patent Office: Days
• US Class Current: 726/14
• CPC Class Codes: H04L 2463/141 Denial of service attacks against endpoints in a network
• CPC Class Codes: H04L 2463/144 Detection or countermeasures against botnets
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

The present invention is a method and a system that uses privacy-preserving distributed data stream mining algorithms for mining continuously generated data from different network sensors used to monitor data communication in a computer network. The system is designed to compute global network-threat statistics by combining the output of the network sensors using privacy-preserving distributed data stream mining algorithms.

Claims

1. A multi-agent, privacy-preserving distributed data mining apparatus for combining network-attack patterns detected by multitude of network sensors such as firewalls, virus-scanners, and intrusion detection systems. This apparatus has the following components:

a. PURSUIT Agent;

This module runs at each participating node of the distributed environment. It connects to the local network sensor and collaboratively computes the global patterns using privacy-preserving, distributed data mining algorithms.

b. LIP Agent;

This module interfaces the PURSUIT agent at each participating node with the network monitoring sensor. This offers various plug-in-s for different sensors.

c. CAM Agent;

This module is in charge of coordinating the distributed computation of privacy-preserving data mining algorithms performed by the PURSUIT agents. The CAM agent also provides the collectively computed statistics to the PURSUIT web services.

d. PURSUIT Web Services;

Results of the privacy-preserving analysis of the data monitored by a multitude of PURSUIT agents are presented through a web-service. Users can use any web browser to login to the PURSUIT web account and access the information generated by distributed privacy-preserving network threat data mining algorithms.

2. The apparatus of claim 1, further comprising a privacy management module.

3. The apparatus of claim 1, further comprising a distributed data mining module.

4. The apparatus of claim 1, further comprising a distributed collaboration management module for network threat detection and prevention.

5. The apparatus of claim 1, further comprising a module for distributed privacy policy management module.

6. The apparatus of claim 1, further comprising a module for distributed privacy-preserving collaborative network threat analysis.

7. The apparatus of claim 1, comprising of a module for distributed, multi-party, privacy-preserving port scan detection technique that allows detection of network attacks in multiple networks without sharing the network traffic with each other.

16. The apparatus of claim 1 comprising of all algorithms mentioned in claim 9 to claim 15.

17. The apparatus of claim 1, further comprising a module for web-based graphical user interface for presenting the results of all distributed, privacy-preserving analysis of the network data from different sources mentioned in claim 7 to claim 15.

18. The apparatus of claim 1, connecting different virus scanners, firewalls, intrusion detection, and intrusion prevention systems.

19. The apparatus of claim 1, connecting host-based and network-based intrusion detention and intrusion prevention systems.

20. The apparatus of claim 1, supporting formation of ad-hoc peer-to-peer, hierarchical, and other collaborative coalitions.

8. The scan detection technique of claim 8 compares the attack data using secure, privacy-preserving, multi-party computation-based data mining algorithms.

9. A distributed, multi-party, privacy-preserving technique for detecting common worm attacks in multiple networks without sharing the network traffic with each other.

10. A distributed, multi-party, privacy-preserving technique for identifying geo-spatial location of network attackers against multiple networks over a time period without sharing the network traffic with each other.

11. A distributed, multi-party, privacy-preserving algorithm (DPC1) for performing privacy-preserving clustering from network data in multiple networks without sharing the raw network traffic data with each other.

12. A distributed, multi-party, privacy-preserving algorithm (DPC2) for performing privacy-preserving clustering from network data in multiple networks without sharing the raw network traffic data with each other.

13. A distributed privacy-preserving network threat data segmentation algorithm based on distributed, privacy-preserving clustering algorithms.

14. A distributed, multi-party, privacy-preserving technique for computing a similarity-preserving representation of IP addresses and other network parameters and computing functions from this information collected in multiple networks without sharing the network traffic with each other.

15. A framework of privacy-preserving data mining, called k-zone of privacy that constructs a new representation of the data which do not allow others to perform a one-to-one inverse transformation for breaching the privacy of the data.