Granted Patent B1

US 10,645,100 · App. 15/819,341 · Granted May 5, 2020

Abstract

Claims (77)

1. A computer-implemented method, comprising:

processing a time sequence containing event data, the processing performed by a network security system executing on a computer, the time sequence associated with a unique pair of a source network address and a destination network address, the destination network address in a computer network monitored by the network security system, the processing resulting in a Fourier Transform-ready binned temporal sequence;

wherein the processing further comprises:

determining a number of events occurring at each time mark of the time sequence and generating an initial temporal sequence containing time marks of the time sequence, each time mark having a corresponding number of events;

applying, by the network security system, a binning function to the initial temporal sequence, the binning function setting a plurality of time windows at a configurable time interval, counting a number of events in each time window, and producing a binned temporal sequence; and

applying a time warping window to the binned temporal sequence which results in the Fourier Transform-ready binned temporal sequence having an aggregation of time warping windows;

transforming, in the computer, the Fourier Transform-ready binned temporal sequence from a time domain to a frequency domain to capture periodicity in the time sequence in a spectral vector, the transforming performed by the network security system and including applying a Discrete Fast Fourier Transform function to the Fourier Transform-ready binned temporal sequence, the transforming resulting in the spectral vector, further spectral aggregation resulting in the spectral vector having a first machine-digestible vector size; and

denoising and decorrelating the spectral vector, in the computer, to generate a denoised and decorrelated spectral vector, the denoising and decorrelating performed by a deep learning module of the network security system, the denoised and decorrelated spectral vector having a second machine-digestible vector size representing a temporal behavior fingerprint of an attacker associated with the source network address with respect to the destination network address over a period of time in the time sequence.

2. The method according to claim 1 , wherein the transforming further comprises:

applying, in the computer, a Discrete Fast Fourier Transform function to the Fourier Transform-ready binned temporal sequence which results in spectral components representing a collection of peaks in the time sequence at frequencies that appear at inverse of peak intervals; and

aggregating sets of spectral components, in the computer, by:

generating a sum of the sets of spectral components; and

taking a square root of the sum to produce the spectral vector.

3. The method according to claim 1 , wherein the deep learning module of the network security system implements a layer-wise back-propagation algorithm for training stacked autoencoders, layer-by-layer, with parameters for an activation function, a learning rate, learning costs, an exponential decay factor, and a minimum learning rate.

4. The method according to claim 3 , wherein the activation function is a non-linear function, wherein the learning costs relates to a mean squared reconstruction error, and wherein the stacked autoencoders are trained to generate the denoised and decorrelated spectral vector with a minimum of the mean squared reconstruction error.

5. The method according to claim 1 , wherein the first machine-digestible vector size is 1024 floating point numbers and wherein the second machine-digestible vector size is 10 floating point numbers.

6. The method according to claim 1 , further comprising:

clustering, in the computer, attacker temporal behavior fingerprints into groups of attacks;

tuning, in the computer, the groups of attacks so that similar attacks are grouped together; and

determining, in the computer, degrees of network vulnerabilities with respect to the groups of attacks.

7. The method according to claim 6 , further comprising:

tagging, in the computer, each group of attacks as positive or negative;

downgrading, in the computer, positive attacks as whitelisted;

determining, in the computer, resolution options for resolving the network vulnerabilities with respect to negative attacks; and

generating, in the computer, recommendations based at least on the resolution options.

8. A network security system, comprising:

a processor;

a non-transitory computer-readable medium; and

stored instructions translatable by the processor to perform:

processing a time sequence containing event data, the time sequence associated with a unique pair of a source network address and a destination network address, the destination network address in a computer network monitored by the network security system, the processing resulting in a Fourier Transform-ready binned temporal sequence;

wherein the processing further comprises:

determining a number of events occurring at each time mark of the time sequence and generating an initial temporal sequence containing time marks of the time sequence, each time mark having a corresponding number of events;

applying, by the network security system, a binning function to the initial temporal sequence, the binning function setting a plurality of time windows at a configurable time interval, counting a number of events in each time window, and producing a binned temporal sequence; and

applying a time warping window to the binned temporal sequence which results in the Fourier Transform-ready binned temporal sequence having an aggregation of time warping windows;

transforming the Fourier Transform-ready binned temporal sequence from a time domain to a frequency domain to capture periodicity in the time sequence in a spectral vector, the transforming including applying a Discrete Fast Fourier Transform function to the Fourier Transform-ready binned temporal sequence, the transforming resulting in the spectral vector having a first machine-digestible vector size; and

denoising and decorrelating the spectral vector to generate a denoised and decorrelated spectral vector, the denoising and decorrelating performed by a deep learning module of the network security system, the denoised and decorrelated spectral vector having a second machine-digestible vector size representing a temporal behavior fingerprint of an attacker associated with the source network address with respect to the destination network address over a period of time in the time sequence.

9. The network security system of claim 8 , wherein the transforming further comprises:

applying a Discrete Fast Fourier Transform function to the Fourier Transform-ready binned temporal sequence which results in spectral components representing a subset collection of peaks in the time sequence at frequencies that appear at inverse of peak intervals; and

aggregating sets of spectral components by:

generating a sum of the sets of spectral components; and

taking a square root of the sum to produce the spectral vector.

10. The network security system of claim 8 , wherein the deep learning module of the network security system implements a layer-wise back-propagation algorithm for training stacked autoencoders, layer-by-layer, with parameters for an activation function, a learning rate, learning costs, an exponential decay factor, and a minimum learning rate.

11. The network security system of claim 10 , wherein the activation function is a non-linear function, wherein the learning costs relates to a mean squared reconstruction error, and wherein the stacked autoencoders are trained to generate the denoised and decorrelated spectral vector with a minimum of the mean squared reconstruction error.

12. The network security system of claim 8 , wherein the first machine-digestible vector size is 1024 floating point numbers and wherein the second machine-digestible vector size is 10 floating point numbers.

13. The network security system of claim 8 , wherein the instructions are further translatable by the processor to perform:

clustering attacker temporal behavior fingerprints into groups of attacks;

tuning the groups of attacks so that similar attacks are grouped together; and

determining degrees of network vulnerabilities with respect to the groups of attacks.

14. The network security system of claim 13 , wherein the instructions are further translatable by the processor to perform:

tagging each group of attacks as positive or negative;

downgrading positive attacks as whitelisted;

determining resolution options for resolving the network vulnerabilities with respect to negative attacks; and

generating recommendations based at least on the resolution options.

15. A computer program product comprising a non-transitory computer-readable medium storing instructions translatable by a processor of a network security system to perform:

processing a time sequence containing event data, the time sequence associated with a unique pair of a source network address and a destination network address, the destination network address in a computer network monitored by the network security system, the processing resulting in a Fourier Transform-ready binned temporal sequence;

wherein the processing further comprises:

determining a number of events occurring at each time mark of the time sequence and generating an initial temporal sequence containing time marks of the time sequence, each time mark having a corresponding number of events;

applying, by the network security system, a binning function to the initial temporal sequence, the binning function setting a plurality of time windows at a configurable time interval, counting a number of events in each time window, and producing a binned temporal sequence; and

applying a time warping window to the binned temporal sequence which results in the Fourier Transform-ready binned temporal sequence having an aggregation of time warping windows;

transforming the Fourier Transform-ready binned temporal sequence from a time domain to a frequency domain to capture periodicity in the time sequence in a spectral vector, the transforming including applying a Discrete Fast Fourier Transform function to the Fourier Transform-ready binned temporal sequence, the transforming resulting in the spectral vector having a first machine-digestible vector size; and

denoising and decorrelating the spectral vector to generate a denoised and decorrelated spectral vector, the denoising and decorrelating performed by a deep learning module of the network security system, the denoised and decorrelated spectral vector having a second machine-digestible vector size representing a temporal behavior fingerprint of an attacker associated with the source network address with respect to the destination network address over a period of time in the time sequence.

16. The computer program product of claim 15 , wherein the transforming further comprises:

applying a Discrete Fast Fourier Transform function to the Fourier Transform-ready binned temporal sequence which results in spectral components representing a subset collection of peaks in the time sequence at frequencies that appear at inverse of peak intervals; and

aggregating sets of spectral components by:

generating a sum of the sets of spectral components; and

taking a square root of the sum to produce the spectral vector.

17. The computer program product of claim 15 , wherein the deep learning module of the network security system implements a layer-wise back-propagation algorithm for training stacked autoencoders, layer-by-layer, with parameters for an activation function, a learning rate, learning costs, an exponential decay factor, and a minimum learning rate.

18. The computer program product of claim 17 , wherein the activation function is a non-linear function, wherein the learning costs relates to a mean squared reconstruction error, and wherein the stacked autoencoders are trained to generate the denoised and decorrelated spectral vector with a minimum of the mean squared reconstruction error.

19. The computer program product of claim 15 , wherein the instructions are further translatable by the processor to perform:

clustering attacker temporal behavior fingerprints into groups of attacks;

tuning the groups of attacks so that similar attacks are grouped together; and

determining degrees of network vulnerabilities with respect to the groups of attacks.

20. The computer program product of claim 19 , wherein the instructions are further translatable by the processor to perform:

tagging each group of attacks as positive or negative;

downgrading positive attacks as whitelisted;

determining resolution options for resolving the network vulnerabilities with respect to negative attacks; and

generating recommendations based at least on the resolution options.

Assignments (12)