Event detection/anomaly correlation heuristics
A system for detecting network intrusions and other conditions in a network is described. The system includes a plurality of collector devices that are disposed to collect data and statistical information on packets that are sent between nodes on a network. An aggregator device is disposed to receive data and statistical information from the plurality of collector devices. The aggregator device produces a connection table that maps each node on the network to a record that stores information about traffic to or from the node. The aggregator runs processes that determine network events from aggregating of anomalies into network events.
1. A computer implemented method for detecting conditions in a network, comprising:
finding anomalies, which are low-level differences in network operation relative to some comparison period, by:
producing a moving average of a parameter associated with network packet flows; determining whether a variance in the parameter exceeds a threshold;
traversing a connection table that maps each host to a “host object” that stores information about all traffic to or from that host to determine connection patterns of a particular host in the network, and if the variance exceeds the threshold to indicate an anomaly,
identifying and correlating anomalies from the connection patterns with other found anomalies that exceed the threshold into at least one operationally relevant event indicating a detected event in the network.
2. The method of claim 1 further comprising:
sending event reports to an operator.
3. The method of claim 1 wherein collecting anomalies into events comprises:
traversing a connection tablc to identify and correlate anomalies by determining connection patterns that correlate with a particular event class.
4. The. method of claim 1 further comprising determining event severity.
5. The method of claim 4 wherein the event severity is characterized by at least one of a type, number, and severity of anomalies that led to an identification of the event.
6. The method of claim 1 wherein tracking a variance of a parameter accounts for burstiness in network traffic and tracking a moving average allows the method to adapt to slowly changing network conditions.
7. A computer program product tangibly stored in a computer readable medium for detecting intrusions in a network, the computer program product comprising instructions for causing a processor to:
find anomalies, which are low-level differences in network operation relative to some comparison period;
produce a moving average of a parameter associated with network packet flows;
determine whether a variance in the parameter exceeds a threshold;
traverse a connection table that maps each host to a “host obiect” that stores information about all traffic to or from that host to determine connection patterns of a particular host in the network,
and if the variance exceeds the threshold indicating an anomaly; identify and correlate anomalies from the connection patterns with other found anomalies that exceed the threshold into at least one operationally relevant event that indicates a detected event in the network.
8. The computer program product of claim 7 further comprising instructions to:
send event reports to an operator.
9. The computer program product of claim 8 further comprising instructions to:
determine event severity.
10. The computer program product of claim 9 wherein event severity is characterized by at least one of a type, number, and severity of anomalies that led to an identification of the event.
11. The computer program product of claim 7 wherein instructions to track a moving average, further comprises instructions to:
traverse a connection table that maps each host to a “host object” that stores information about all traffic to or from that host to determine connection patterns of a particular host in the network, and
identify and correlate anomalies from the connection patterns.
12. The computer program product of claim 7 wherein instructions to track a variance tracks a variance of a parameter to account for burstiness in network traffic.
13. A device for detecting conditions in a network, comprising:
circuitry to find anomalies, which are low-level differences in network operation relative to some comparison period;
circuitry to produce a moving average of a parameter associated with network packet flows;
circuitry to determine whether a variance in the parameter exceeds a threshold;
circuitry to traverse a connection table to identify and correlate anomalies by determining connection patterns that correlate with a particular event class;
and if the variance exceeds the threshold indicating an anomaly;
circuitry identify and correlate anomalies from the connection patterns with other found anomalies that exceed the threshold into at least one operationally relevant event indicating a detected event in the network.
14. The device of claim 13 further comprising:
circuitry to send event reports to an operator.
15. The device of claim 13 further comprising circuitry to determine cvent severity.
16. The device of claim 15 wherein the circuitry characterizes the event severity by at least one of a type, number, and severity of anomalies that led to the identification of the event.
17. The device of claim 13 wherein circuitry to track a moving average comprises:
circuitry to traverse a connection table that maps each host to a “host object” that stores information about all traffic to or from that host to determine connection patterns of a particular host in the network, and
circuitry to identify and correlate anomalies from the connection patterns.
18. The device of claim 13 wherein circuitry to track a variance of a parameter accounts for burstiness in network traffic and
circuitry to track a moving average allows the method to adapt to slowly changing network conditions.