Intrusion detection system using self-organizing clusters

• US 7,017,186 B2
• Filed: 07/30/2002
• Issued: 03/21/2006
• Est. Priority Date: 07/30/2002
• Status: Expired due to Term

• Current Assignee: Longhorn HD LLC (Alpha Alpha Intellectual Partners LLC)
• Original Assignee: STEELCLOUD, INC.
• Inventors: Day, Christopher W.
• Primary Examiner(s): Song, Hosuk
• Assistant Examiner(s): KLIMACH, PAULA W
• Application Number:
  US10/208,485
• Publication Number:
  US 20040025044A1
• Time in Patent Office: 1,330 Days
• Field of Search: 713200-202, 709/224, 709/229, 726/22, 726/23
• US Class Current: 726/23
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

An intrusion detection system (IDS). An IDS which has been configured in accordance with the present invention can include a traffic sniffer for extracting network packets from passing network traffic; a traffic parser configured to extract individual data from defined packet fields of the network packets; and, a traffic logger configured to store individual packet fields of the network packets in a database. A vector builder can be configured to generate multi-dimensional vectors from selected features of the stored packet fields. Notably, at least one self-organizing clustering module can be configured to process the multi-dimensional vectors to produce a self-organized map of clusters. Subsequently, an anomaly detector can detect anomalous correlations between individual ones of the clusters in the self-organized map based upon at least one configurable correlation metric. Finally, a classifier can classify detected anomalous correlations as one of an alarm and normal behavior.

Claims

1. A machine readable storage having stored thereon a computer program for detecting network intrusions, said computer program comprising a routine set of instructions which when executed cause the machine to perform the steps of:

monitoring network traffic passing across a network communications path;

extracting network packets from said passing traffic;

storing individual components of said network packets in a database;

constructing multi-dimensional vectors from at least two of said stored individual components and applying at least one multi-variate analysis to said constructed multi-dimensional vectors, said at least one multi-variate analysis producing a corresponding output set;

establishing a correlation between individual output sets based upon a selected metric to identify anomalous behavior; and

,

classifying said anomalous behavior as one of a network fault or a network attack.

2. The machine readable storage of claim 1, wherein said storing step comprises the steps of:

identifying protocol boundaries in each extracted network packet; and

,

storing data from each field separated by said identified protocol boundaries in a separate record in said database.

3. The machine readable storage of claim 2, further comprising the step of storing with each said individual component in said separate record in said database, data associating said individual component with at least one of a corresponding target network device, a corresponding network socket, and a corresponding customer.

4. The machine readable storage of claim 1, wherein said step of applying at least one multi-variate analysis to said constructed multi-dimensional vectors comprises the steps of:

reducing said constructed multi-dimensional vectors; and

,

applying at least one self-organizing clustering methodology to said reduced multi-dimensional vectors, said application of said at least one self-organizing clustering methodology producing a corresponding output set of clusters.

5. The machine readable storage of claim 4, wherein said establishing step comprises the steps of:

loading at least one selectable metric;

correlating individual ones of said clusters in said output set;

determining whether any of said correlations deviate from said loaded at least one selectable metric; and

,

for each one of said correlated clusters in said output set which deviates from said loaded at least one selectable metric, labeling said deviating correlated cluster as exhibiting anomalous behavior.

6. A machine readable storage having stored thereon a computer program for detecting network intrusions, said computer program comprising a routine set of instructions which when executed cause the machine to perform the steps of:

monitoring network traffic passing across a network communications path destined for multiple target devices in multiple independent network domains and extracting network packets from said passing traffic;

identifying protocol boundaries in each extracted network packet and storing data from each field separated by said identified protocol boundaries in a database;

associating said data in said database with at least one of a corresponding target device, a target network domain, a target customer, and a target customer sub-net;

processing said stored data using at least one self-organizing clustering method to establish correlations between fields of different network packets destined for different ones of said multiple independent network domains; and

,

identifying a network attack, a network fault, or a change in network performance based upon said established correlations.