System, method, and computer program for detecting and measuring changes in network behavior of communication networks utilizing real-time clustering algorithms

1. A computer program product embodied on a non-transitory computer readable medium, comprising:

computer code for receiving network traffic associated with at least one communication network;

computer code for characterizing and classifying the network traffic based on similarities in the network traffic utilizing one or more real-time clustering algorithms including:

creating clusters for each feature in the network traffic with each feature being clustered independently from each other feature, wherein results of creating the clusters for each feature in the network traffic are represented in a matrix with each row vector in the matrix representing a cluster definition and containing a norm for each time unit, and wherein the matrix includes as many rows as clusters found in the network traffic, and

applying a normalizing function to the matrix to generate a real number; and

computer code for detecting and measuring changes in network behavior of the at least one communication network utilizing information associated with the classified network traffic.

2. The computer program product of claim 1 , wherein the computer program product is operable such that a combination of time units are selected to generate a plurality of periods and associated information that are stored in a time window matrix.

3. The computer program product of claim 2 , wherein the computer program product is operable such that a similarity score is calculated between each feature from a current time period and a previous time period.

4. The computer program product of claim 3 , wherein the computer program product is operable such that the similarity score is used to profile the network traffic in real time and to determine how different current network traffic is compared to an expected behavior of the network traffic.

5. The computer program product of claim 3 , wherein the computer program product is operable such that the similarity score is used to detect dangerous network traffic in early stages.

6. The computer program product of claim 1 , wherein the computer program product is operable such that characterizing and classifying the network traffic based on similarities in the network traffic utilizing the one or more real-time clustering algorithms includes modeling the network traffic of the at least one communications network in numerical matrices.

7. The computer program product of claim 1 , wherein the computer program product is operable such that characterizing and classifying the network traffic based on similarities in the network traffic utilizing the one or more real-time clustering algorithms includes encapsulating the network traffic in windows of time and expressing the network traffic in at least one algebraic expression.

8. The computer program product of claim 1 , wherein the computer program product is operable such that characterizing and classifying the network traffic based on similarities in the network traffic utilizing the one or more real-time clustering algorithms includes calculating a similarity between past behavior of the at least one communication network and present behavior of the at least one communication network in real time.

9. The computer program product of claim 1 , wherein the computer program product is operable such that characterizing and classifying the network traffic based on similarities in the network traffic utilizing the one or more real-time clustering algorithms includes calculating a delta representing a distance between an expected behavior of the at least one communication network and an observed behavior of the at least one communication network.

10. The computer program product of claim 1 , wherein the computer program product is operable such that characterizing and classifying the network traffic based on similarities in the network traffic utilizing the one or more real-time clustering algorithms includes calculating a degree of similarity of current network traffic and previously identified network traffic types.

11. The computer program product of claim 1 , wherein the computer program product is operable such that characterizing and classifying the network traffic based on similarities in the network traffic utilizing the one or more real-time clustering algorithms includes executing a plurality of clustering processes in parallel, one clustering process per feature of the network traffic, to provide a level of dependency among variables included in the network traffic.

12. The computer program product of claim 1 , further comprising computer code for generating a grade of accuracy of the classification of the network traffic.

13. The computer program product of claim 1 , wherein the computer program product is operable such that detecting and measuring changes in the network behavior of the at least one communication network utilizing the classified network traffic includes detecting concept drift situations and distinguishing novelty from anomaly.

14. A method, comprising:

receiving network traffic associated with at least one communication network;

characterizing and classifying the network traffic based on similarities in the network traffic utilizing one or more real-time clustering algorithms, including:

creating clusters for each feature in the network traffic with each feature being clustered independently from each other feature, wherein results of creating the clusters for each feature in the network traffic are represented in a matrix with each row vector in the matrix representing a cluster definition and containing a norm for each time unit, and wherein the matrix includes as many rows as clusters found in the network traffic, and

applying a normalizing function to the matrix to generate a real number; and

detecting and measuring changes in network behavior of the at least one communication network utilizing information associated with the classified network traffic.

15. A system, comprising:

a memory system; and

one or more processing cores coupled to the memory system and that are each configured to:

receive network traffic associated with at least one communication network;

characterize and classify the network traffic based on similarities in the network traffic utilizing one or more real-time clustering algorithms, including:

creating clusters for each feature in the network traffic with each feature being clustered independently from each other feature, wherein results of creating the clusters for each feature in the network traffic are represented in a matrix with each row vector in the matrix representing a cluster definition and containing a norm for each time unit, and wherein the matrix includes as many rows as clusters found in the network traffic, and

applying a normalizing function to the matrix to generate a real number; and

detect and measure changes in network behavior of the at least one communication network utilizing information associated with the classified network traffic.