Real-time detection of abnormal network connections in streaming data

1. A computer-implemented method for real-time detecting of abnormal network connections, the method comprising:

collecting network connection events from at least one agent connected to a network;

recording, via a topology graph, normal states of network connections among hosts in the network; and

recording, via a port graph, relationships established between host and destination ports of all network connections;

wherein, for each connection event, if no edge exists, compute a connection probability for a new edge.

2. The method of claim 1 , wherein, if the connection probability is greater than a predetermined threshold, update the topology graph and the port graph.

3. The method of claim 1 , wherein, if the connection probability is less than a predetermined threshold, return an indication for an abnormal connection.

4. The method of claim 1 , wherein the connection probability is based on whether the host or destination nodes:

always have new edges in previous periods;

have several edges already; and

have connected to a similar node before.

5. A system for real-time detecting of abnormal network connections, the system comprising:

a memory; and

a processor in communication with the memory, wherein the processor is configured to:

collect network connection events from at least one agent connected to a network;

record, via a topology graph, normal states of network connections among hosts in the network; and

record, via a port graph, relationships established between host and destination ports of all network connections;

wherein, for each connection event, if no edge exists, compute a connection probability for a new edge.

6. The system of claim 5 , wherein, if the connection probability is greater than a predetermined threshold, update the topology graph and the port graph.

7. The system of claim 5 , wherein, if the connection probability is less than a predetermined threshold, return an indication for an abnormal connection.

8. The system of claim 5 , wherein the connection probability is based on whether the host or destination nodes:

always have new edges in previous periods;

have several edges already; and

have connected to a similar node before.

9. The system of claim 5 , wherein, for each connection event, check whether the topology graph includes source and destination host nodes.

10. The system of claim 9 , wherein, for each connection event, check whether edges exist between pairs of host nodes.

11. The system of claim 10 , wherein outdated nodes and edges are removed.

12. A non-transitory computer-readable storage medium comprising a computer-readable program for real-time detecting of abnormal network connections, wherein the computer-readable program when executed on a computer causes the computer to perform the steps of:

collecting network connection events from at least one agent connected to a network;

recording, via a topology graph, normal states of network connections among hosts in the network; and

recording, via a port graph, relationships established between host and destination ports of all network connections;

wherein, for each connection event, if no edge exists, compute a connection probability for a new edge.

13. The non-transitory computer-readable storage medium of claim 12 , wherein, if the connection probability is greater than a predetermined threshold, update the topology graph and the port graph.

14. The non-transitory computer-readable storage medium of claim 12 , wherein, if the connection probability is less than a predetermined threshold, return an indication for an abnormal connection.

15. The method of claim 1 , wherein, for each connection event, check whether the topology graph includes source and destination host nodes.

16. The method of claim 15 , wherein, for each connection event, check whether edges exist between pairs of host nodes.

17. The method of claim 16 , wherein outdated nodes and edges are removed.