Granted Patent B1

US 10,230,744 · App. 15/192,034 · Granted Mar 12, 2019

Abstract

Claims (34)

1. A method comprising:

obtaining a set of differences between timestamps of adjacent events for a given network session;

assigning, using at least one processing device, each difference in said set to a cluster using a clustering technique based on a distance between the difference and a mean time difference for each cluster, wherein the assigning each difference to said cluster further comprises the step of creating a new cluster if the difference is more than a predefined distance from each existing cluster;

providing a plurality of clusters of network session communications comprising periodic behavior generated by said clustering technique, wherein each of said differences in each of said clusters correspond to events exhibiting periodic behavior with a period substantially equal to the mean time difference of the assigned cluster; and

identifying potentially suspicious communications associated with a computer security attack by processing said plurality of clusters.

2. The method of claim 1 , wherein the distance comprises a Euclidean distance.

3. The method of claim 1 , wherein the mean time difference for a given cluster comprises an arithmetic mean of the differences assigned to the given cluster.

4. The method of claim 1 , wherein the differences are obtained and processed in real-time.

5. The method of claim 1 , wherein the predefined distance from each existing cluster is measured using a z-score.

6. The method of claim 1 , further comprising the step of measuring a periodicity of a given cluster based on a variance of the differences assigned to the given cluster.

7. The method of claim 6 , wherein a smaller variance of the given cluster indicates a higher periodicity of the given cluster and wherein a larger variance of the given cluster indicates a lower periodicity of the given cluster.

8. A system, comprising:

a memory; and

at least one processing device, coupled to the memory, operative to:

obtaining a set of differences between timestamps of adjacent events for a given network session;

assigning, using the at least one processing device, each difference in said set to a cluster using a clustering technique based on a distance between the difference and a mean time difference for each cluster, wherein the assigning each difference to said cluster further comprises the step of creating a new cluster if the difference is more than a predefined distance from each existing cluster;

providing a plurality of clusters of network session communications comprising periodic behavior generated by said clustering technique, wherein each of said differences in each of said clusters correspond to events exhibiting periodic behavior with a period substantially equal to the mean time difference of the assigned cluster; and

identifying potentially suspicious communications associated with a computer security attack by processing said plurality of clusters.

9. The system of claim 8 , wherein the mean time difference for a given cluster comprises an arithmetic mean of the differences assigned to the given cluster.

10. The system of claim 8 , wherein the differences are obtained and processed in real-time.

11. The system of claim 8 , further comprising the step of measuring a periodicity of a given cluster based on a variance of the differences assigned to the given cluster.

12. The system of claim 11 , wherein a smaller variance of the given cluster indicates a higher periodicity of the given cluster and wherein a larger variance of the given cluster indicates a lower periodicity of the given cluster.

13. The system of claim 8 , wherein the distance comprises a Euclidean distance.

14. The system of claim 8 , wherein the predefined distance from each existing cluster is measured using a z-score.

15. A computer program product, comprising a non-transitory machine-readable storage medium having encoded therein executable code of one or more software programs, wherein the one or more software programs when executed by at least one processing device perform the following steps:

obtaining a set of differences between timestamps of adjacent events for a given network session;

assigning, using the at least one processing device, each difference in said set to a cluster using a clustering technique based on a distance between the difference and a mean time difference for each cluster, wherein the assigning each difference to said cluster further comprises the step of creating a new cluster if the difference is more than a predefined distance from each existing cluster;

providing a plurality of clusters of network session communications comprising periodic behavior generated by said clustering technique, wherein each of said differences in each of said clusters correspond to events exhibiting periodic behavior with a period substantially equal to the mean time difference of the assigned cluster; and

identifying potentially suspicious communications associated with a computer security attack by processing said plurality of clusters.

16. The computer program product of claim 15 , wherein the differences are obtained and processed in real-time.

17. The computer program product of claim 15 , further comprising the step of measuring a periodicity of a given cluster based on a variance of the differences assigned to the given cluster.

18. The computer program product of claim 17 , wherein a smaller variance of the given cluster indicates a higher periodicity of the given cluster and wherein a larger variance of the given cluster indicates a lower periodicity of the given cluster.

19. The computer program product of claim 15 , wherein the mean time difference for a given cluster comprises an arithmetic mean of the differences assigned to the given cluster.

20. The computer program product of claim 15 , wherein the predefined distance from each existing cluster is measured using a z-score.

Assignments (19)