Structures and methods for a low and slow network reconnaissance detector
View Patent ↗Packets on a computer network are low pass filtered using a low and slow network reconnaissance detector to generate a spectrum of packets that are anomalous, i.e., are not commonly occurring IP packet traffic on the computer network. The low and slow network reconnaissance detector includes a low-frequency low-amplitude attenuation function module that adjusts an interest level for a particular network event based upon a number of occurrences. The low and slow network reconnaissance detector also includes an update detector output with system compensation function module. The system compensation function is a time dependent function that adjusts the interest level from the low-frequency low-amplitude attenuation function module to compensate for bursts of activity separated by periods of time. To facilitate the use of both modules, a non-uniformly sampled discrete network event time series for the network event is converted into a uniformly sampled network event time series.
1. A method for characterizing events on a network comprising:
converting a non-uniformly sampled discrete network intrusion event time series for a network intrusion event into a uniformly sampled network intrusion event time series, wherein said converting comprises:
specifying a bucket for use in obtaining said uniformly sampled network intrusion event time series;
detecting said network intrusion event; and
counting all occurrences of said network intrusion event in said bucket as a single occurrence for said bucket so that said bucket has a state of one of occurrence and no occurrence; and
determining a frequency characteristic for said network intrusion event based upon said uniformly sampled network intrusion event time series wherein said frequency characteristic is an average frequency of said network intrusion event.
2. The method of claim 1 where said specifying further comprises:
specifying a size for said bucket wherein said size is a time interval.
3. The method of claim 2 further comprising:
selecting said time interval so that an inverse of said time interval is more than twice the maximum frequency of said network intrusion event.
4. The method of claim 1 wherein said average frequency is an average frequency of occurrence.
5. A structure comprising:
a memory;
means for converting a non-uniformly sampled discrete network intrusion event time series for a network intrusion event into a uniformly sampled network intrusion event time series, wherein said means for converting comprises:
specifying a bucket for use in obtaining said uniformly sampled network intrusion event time series;
detecting said network intrusion event; and
counting all occurrences of said network intrusion event in said bucket as a single occurrence for said bucket so that said bucket has a state of one of occurrence and no occurrence; and
means for determining a frequency characteristic for said network intrusion event based upon said uniformly sampled network intrusion event time series wherein said frequency characteristic is an average frequency of said network intrusion event.
6. A computer-program product comprising a computer-readable medium containing computer program code for a method comprising:
converting a non-uniformly sampled discrete network intrusion event time series for a network intrusion event into a uniformly sampled network intrusion event time series, wherein said converting comprises:
specifying a bucket for use in obtaining said uniformly sampled network intrusion event time series;
detecting said network intrusion event; and
counting all occurrences of said network intrusion event in said bucket as a single occurrence for said bucket so that said bucket has a state of one of occurrence and no occurrence; and
determining a frequency characteristic for said network intrusion event based upon said uniformly sampled network intrusion event time series wherein said frequency characteristic is an average frequency of said network intrusion event.
7. A system comprising:
a processor; and
a memory coupled to said processor, and having stored therein instructions for a method for characterizing events on a network wherein upon execution of said instructions using said processor, said method comprises:
converting a non-uniformly sampled discrete network intrusion event time series for a network intrusion event into a uniformly sampled network intrusion event time series, wherein said converting comprises:
specifying a bucket for use in obtaining said uniformly sampled network intrusion event time series;
detecting said network intrusion event; and
counting all occurrences of said network intrusion event in said bucket as a single occurrence for said bucket so that said bucket has a state of one of occurrence and no occurrence; and
determining a frequency characteristic for said network intrusion event based upon said uniformly sampled network intrusion event time series wherein said frequency characteristic is an average frequency of said network intrusion event.
8. A structure comprising:
a memory;
a time dependent low-frequency low-amplitude network event reconnaissance detector, wherein said time dependent low-frequency low-amplitude network event reconnaissance detector detects low-frequency low-amplitude network intrusion events on a computer network, said time dependent low-frequency low-amplitude network event reconnaissance detector including:
a low-frequency low-amplitude attenuation function module including a low-frequency low-amplitude attenuation function,
wherein said low-frequency low-amplitude attention function (i) receives occurrences of said network intrusion event as an input signal, and (ii) generates an output signal, wherein multiple occurrences of said network intrusion event within a unit of time are considered as a single occurrence; and
an update detector output with system compensation function module, coupled to said low-frequency low-amplitude attenuation function module, including a system compensation function,
wherein said system compensation function (i) receives said output signal of said low-amplitude attenuation function module, and (ii) generates an anomalous packet indicator output signal that is a time-dependent signal; and
said system compensation function compensates for bursts of activity of said network instruction event separated by periods of time.
9. A method comprising:
processing computer network intrusion events using an attenuation function to generate an indicator of a number of occurrences of a network intrusion event having a particular characteristic, wherein said processing further comprises:
setting said indicator to an initial value on a first occurrence of said network intrusion event;
decreasing said indicator, by said attenuation function, in response to each subsequent occurrence of said network intrusion event following said first occurrence of said network intrusion event; and
identifying said network intrusion event as a low-amplitude low-frequency network event when said indicator has a specified relationship with a threshold at a given point in time.
10. The method of claim 9 wherein said number of occurrences of said network intrusion event is determined by counting all occurrences of said network intrusion event in a time interval as a single occurrence for said time interval.
11. The method of claim 9 wherein said number of occurrences of said network intrusion event is an actual number from an initial time.
12. A computer-program product comprising a computer-readable medium containing computer program code for a method comprising:
processing computer network intrusion events using an attenuation function to generate an indicator of a number of occurrences of a network intrusion event having a particular characteristic, wherein said processing further comprises:
setting said indicator to an initial value on a first occurrence of said network intrusion event;
decreasing said indicator, by said attenuation function, in response to each subsequent occurrence of said network intrusion event following said first occurrence of said network intrusion event; and
identifying said network intrusion event as a low-amplitude low-frequency network event when said indicator has a specified relationship with a threshold at a given point in time.
13. A structure comprising:
a memory;
means for processing computer network intrusion events using an attenuation function to generate an indicator of a number of occurrences of a network intrusion event having a particular characteristic, wherein said means for processing further comprises:
setting said indicator to an initial value on a first occurrence of said network intrusion event;
decreasing said indicator, by said attenuation function, in response to each subsequent occurrence of said network intrusion event following said first occurrence of said network intrusion event; and
means for identifying said network intrusion event as a low-amplitude low-frequency network event when said indicator has a specified relationship with a threshold at a given point in time.
14. A system comprising:
a processor; and
a memory coupled to said processor, and having stored therein instructions for a method for characterizing events on a network wherein upon execution of said instructions using said processor, said method comprises:
processing computer network intrusion events using an attenuation function to generate an indicator of a number of occurrences of a network intrusion event having a particular characteristic, wherein said processing further comprises:
setting said indicator to an initial value on a first occurrence of said network intrusion event;
decreasing said indicator, by said attenuation function, in response to each subsequent occurrence of said network intrusion event following said first occurrence of said network intrusion event; and
identifying said network intrusion event as a low-amplitude low-frequency network intrusion event when said indicator has a specified relationship with a threshold at a given point in time.
15. A method comprising:
processing computer network intrusion events using an attenuation function to generate an indicator of a number of occurrences wherein an occurrence is when one or more network intrusion events having a particular characteristic occur in a time interval, wherein said processing further comprises:
setting said indicator to an initial value on a first occurrence of said network intrusion event;
decreasing said indicator, by said attenuation function, in response to each subsequent occurrence of said network intrusion event following said first occurrence of said network intrusion event;
processing said indicator using a system compensation function to generate a time-dependent indicator wherein said system compensation function compensates for bursts of occurrences of said network instruction event separated by periods of time; and
identifying said network intrusion event as a low-amplitude low-frequency network event when said time-dependent indicator has a specified relationship with a threshold at a given point in time.
16. A computer-program product comprising a computer-readable medium containing computer program code for a method comprising:
processing computer network intrusion events using an attenuation function to generate an indicator of a number of occurrences wherein an occurrence is when one or more network intrusion events having a particular characteristic occur in a time interval, wherein said processing further comprises:
setting said indicator to an initial value on a first occurrence of said network intrusion event;
decreasing said indicator, by said attenuation function, in response to each subsequent occurrence of said network intrusion event following said first occurrence of said network intrusion event;
processing said indicator using a system compensation function to generate a time-dependent indicator wherein said system compensation function compensates for bursts of occurrences of said network instruction event separated by periods of time; and
identifying said network intrusion event as a low-amplitude low-frequency network event when said time-dependent indicator has a specified relationship with a threshold at a given point in time.
17. A structure comprising:
a memory;
means for processing computer network intrusion events using an attenuation function to generate an indicator of a number of occurrences wherein an occurrence is when one or more network intrusion events having a particular characteristic occur in a time interval, wherein said means for processing further comprises:
setting said indicator to an initial value on a first occurrence of said network intrusion event;
decreasing said indicator, by said attenuation function, in response to each subsequent occurrence of said network intrusion event following said first occurrence of said network intrusion event;
means for processing said indicator using a system compensation function to generate a time-dependent indicator wherein said system compensation function compensates for bursts of occurrences of said network instruction event separated by periods of time; and
means for identifying said network intrusion event as a low-amplitude low-frequency network event when said time-dependent indicator has a specified relationship with a threshold at a given point in time.
18. A system comprising:
a processor; and
a memory coupled to said processor, and having stored therein instructions for a method for characterizing events on a network wherein upon execution of said instructions using said processor, said method comprises:
processing computer network intrusion events using an attenuation function to generate an indicator of a number of occurrences wherein an occurrence is when one or more network intrusion events having a particular characteristic occur in a time interval, wherein said processing further comprises:
setting said indicator to an initial value on a first occurrence of said network intrusion event; and
decreasing said indicator, by said attenuation function, in response to each subsequent occurrence
of said network intrusion event following said first
occurrence of said network intrusion event;
processing said indicator using a system compensation function to generate a time-dependent indicator wherein said system compensation function compensates for bursts of occurrences of said network instruction event separated by periods of time; and
identifying said network intrusion event as a low-amplitude low-frequency network event when said time-dependent indicator has a specified relationship with a threshold at a given point in time.