System for identifying illegitimate communications between computers by comparing evolution of data flows
First Claim
1. A real-time method of identifying similar and coordinated communications between a plurality of computers connected by a network, the method comprising:
- monitoring communications between a plurality of pairs of computers over the network to obtain a first flow metric for a first pair of computers and a second flow metric for a second pair of computers, wherein the first flow metric represents at least one property of a first data flow between the first pair of computers and the second flow metric represents at least one property of a second data flow between the second pair of computers;
updating a representation of the evolution of the first data flow between the first pair of computers using the first flow metric or updating a representation of the evolution of the second data flow between the second pair of computers using the second flow metric;
comparing the representation of the evolution of the first data flow and the representation of the evolution of the second data flow to determine the similarity of the first data flow and the second data flow; and
identifying the first pair of computers and the second pair of computers as exhibiting similar and coordinated communication if the first data flow and second data flow are determined to be similar.
1 Assignment
0 Petitions
Accused Products
Abstract
A method and apparatus for identifying similar and coordinated communications between computers connected by a network are described. Communications between a plurality of pairs of computers are monitored to obtain respective flow metrics for a first and second pair of computers. The flow metric represents at least one property of the data flow between the pair of computers. Representations of the evolution of the data flows between the pairs of computers are updated using the flow metrics. The representations of the evolution of the data flows are compared to determine the similarity of the data flows between the pairs of computers. The first pair of computers and the second pair of computers are identified as exhibiting similar and coordinated communication if their data flows are determined to be similar.
16 Citations
20 Claims
-
1. A real-time method of identifying similar and coordinated communications between a plurality of computers connected by a network, the method comprising:
-
monitoring communications between a plurality of pairs of computers over the network to obtain a first flow metric for a first pair of computers and a second flow metric for a second pair of computers, wherein the first flow metric represents at least one property of a first data flow between the first pair of computers and the second flow metric represents at least one property of a second data flow between the second pair of computers; updating a representation of the evolution of the first data flow between the first pair of computers using the first flow metric or updating a representation of the evolution of the second data flow between the second pair of computers using the second flow metric; comparing the representation of the evolution of the first data flow and the representation of the evolution of the second data flow to determine the similarity of the first data flow and the second data flow; and identifying the first pair of computers and the second pair of computers as exhibiting similar and coordinated communication if the first data flow and second data flow are determined to be similar. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16)
-
-
17. A data processing apparatus comprising one or more data processing devices and one or more non-transitory computer readable media, the non-transitory computer readable medium or media storing computer program code executable by the data processing device or devices to carry out a real-time method of identifying similar and coordinated communications between a plurality of computers connected by a network, the method comprising:
-
monitoring communications between a plurality of pairs of computers over the network to obtain a first flow metric for a first pair of computers and a second flow metric for a second pair of computers, wherein the first flow metric represents at least one property of a first data flow between the first pair of computers and the second flow metric represents at least one property of a second data flow between the second pair of computers; updating a representation of the evolution of the first data flow between the first pair of computers using the first flow metric or updating a representation of the evolution of the second data flow between the second pair of computers using the second flow metric; comparing the representation of the evolution of the first data flow and the representation of the evolution of the second data flow to determine the similarity of the first data flow and the second data flow; and identifying the first pair of computers and the second pair of computers as exhibiting similar and coordinated communication if the first data flow and second data flow are determined to be similar. - View Dependent Claims (18, 19)
-
-
20. One or more non-transitory computer readable media storing computer program code executable by one or more data processing devices to carry out a real-time method of identifying similar and coordinated communications between a plurality of computers connected by a network, the method comprising:
-
monitoring communications between a plurality of pairs of computers over the network to obtain a first flow metric for a first pair of computers and a second flow metric for a second pair of computers, wherein the first flow metric represents at least one property of a first data flow between the first pair of computers and the second flow metric represents at least one property of a second data flow between the second pair of computers; updating a representation of the evolution of the first data flow between the first pair of computers using the first flow metric or updating a representation of the evolution of the second data flow between the second pair of computers using the second flow metric; comparing the representation of the evolution of the first data flow and the representation of the evolution of the second data flow to determine the similarity of the first data flow and the second data flow; and identifying the first pair of computers and the second pair of computers as exhibiting similar and coordinated communication if the first data flow and second data flow are determined to be similar.
-
Specification