Methods, systems, and media for detecting anomalous network activity
Methods, systems, and media for detecting anomalous network activity are provided. In some embodiments, a method for detecting anomalous network activity is provided, the method comprising: receiving information indicating network activity, wherein the information includes IP addresses corresponding to devices participating in the network activity; generating a graph representing the network activity, wherein each node of the graph indicates an IP address of a device; generating a representation of the graph, wherein the representation of the graph reduces a dimensionality of information indicated in the graph; identifying a plurality of clusters of network activity based on the representation of the graph; determining that at least one cluster corresponds to anomalous network activity; and in response to determining that the at least one cluster corresponds to anomalous network activity, causing a network connection of at least one device included in the at least one cluster to be blocked.
1. A method for detecting anomalous network activity, comprising:
receiving information indicating network activity on a network, wherein the information includes a plurality of IP addresses corresponding to a plurality of devices participating in the network activity and information relating to packets transmitted between devices included in the plurality of devices participating in the network activity;
generating, by a hardware processor, a weighted directed graph representing the network activity, wherein the weighted directed graph has a plurality of nodes and has an edge between two of the plurality of nodes, wherein each node of the graph indicates an IP address of a device participating in the network activity, and wherein the edge has at least three weights represented as a vector, wherein the weights include a number of connections between the two of the plurality of nodes, an average number of bytes per packet sent between the two of the plurality of nodes, and a number of ports scanned;
generating a representation of the graph representing the network activity, wherein the representation of the graph representing the network activity reduces a dimensionality of information indicated in the graph representing the network activity;
identifying a plurality of clusters of network activity based on the representation of the graph representing the network activity;
determining that at least one cluster of the plurality of clusters corresponds to anomalous network activity; and
in response to determining that the at least one cluster of the plurality of clusters corresponds to anomalous network activity, causing a network connection of at least one device included in the at least one cluster to be blocked.
2. The method of claim 1 , wherein the graph representing the network activity is generated using a subset of the plurality of IP addresses, wherein the subset of the plurality of IP addresses corresponds to a group of IP addresses having the most network connections and wherein the subset of the plurality of IP addresses contains fewer than all of the plurality of IP addresses.
3. The method of claim 1 , wherein identifying the plurality of clusters of network activity is based on a machine learning classifier.
4. The method of claim 1 , wherein identifying the plurality of clusters of network activity is based on a neural network.
5. The method of claim 1 , wherein generating the representation of the graph representing the network activity comprises applying a t-Stochastic Neighbor Embedding (t-SNE) technique to the graph representing the network activity.
6. A system for detecting anomalous network activity, the system comprising:
a memory; and
a hardware processor coupled to the memory that is configured to:
receive information indicating network activity on a network, wherein the information includes a plurality of IP addresses corresponding to a plurality of devices participating in the network activity and information relating to packets transmitted between devices included in the plurality of devices participating in the network activity;
generate a weighted directed graph representing the network activity, wherein the weighted directed graph has a plurality of nodes and has an edge between two of the plurality of nodes, wherein each node of the graph indicates an IP address of a device participating in the network activity, and wherein the edge has at least three weights represented as a vector, wherein the weights include a number of connections between the two of the plurality of nodes, an average number of bytes per packet sent between the two of the plurality of nodes, and a number of ports scanned;
generate a representation of the graph representing the network activity, wherein the representation of the graph representing the network activity reduces a dimensionality of information indicated in the graph representing the network activity;
identify a plurality of clusters of network activity based on the representation of the graph representing the network activity;
determine that at least one cluster of the plurality of clusters corresponds to anomalous network activity; and
in response to determining that the at least one cluster of the plurality of clusters corresponds to anomalous network activity, cause a network connection of at least one device included in the at least one cluster to be blocked.
7. The system of claim 6 , wherein the graph representing the network activity is generated using a subset of the plurality of IP addresses, wherein the subset of the plurality of IP addresses corresponds to a group of IP addresses having the most network connections and wherein the subset of the plurality of IP addresses contains fewer than all of the plurality of IP addresses.
8. The system of claim 6 , wherein identifying the plurality of clusters of network activity is based on a machine learning classifier.
9. The system of claim 6 , wherein identifying the plurality of clusters of network activity is based on a neural network.
10. The system of claim 6 , wherein generating the representation of the graph representing the network activity comprises applying a t-Stochastic Neighbor Embedding (t-SNE) technique to the graph representing the network activity.
11. A non-transitory computer-readable medium containing computer-executable instructions that, when executed by a processor, cause the processor to perform a method for detecting anomalous network activity, the method comprising:
receiving information indicating network activity on a network, wherein the information includes a plurality of IP addresses corresponding to a plurality of devices participating in the network activity and information relating to packets transmitted between devices included in the plurality of devices participating in the network activity;
generating a weighted directed graph representing the network activity, wherein the weighted directed graph has a plurality of nodes and has an edge between two of the plurality of nodes, wherein each node of the graph indicates an IP address of a device participating in the network activity, and wherein the edge has at least three weights represented as a vector, wherein the weights include a number of connections between the two of the plurality of nodes, an average number of bytes per packet sent between the two of the plurality of nodes, and a number of ports scanned;
generating a representation of the graph representing the network activity, wherein the representation of the graph representing the network activity reduces a dimensionality of information indicated in the graph representing the network activity;
identifying a plurality of clusters of network activity based on the representation of the graph representing the network activity;
determining that at least one cluster of the plurality of clusters corresponds to anomalous network activity; and
in response to determining that the at least one cluster of the plurality of clusters corresponds to anomalous network activity, causing a network connection of at least one device included in the at least one cluster to be blocked.
12. The non-transitory computer-readable medium of claim 11 , wherein the graph representing the network activity is generated using a subset of the plurality of IP addresses, wherein the subset of the plurality of IP addresses corresponds to a group of IP addresses having the most network connections and wherein the subset of the plurality of IP addresses contains fewer than all of the plurality of IP addresses.
13. The non-transitory computer-readable medium of claim 11 , wherein identifying the plurality of clusters of network activity is based on a machine learning classifier.
14. The non-transitory computer-readable medium of claim 11 , wherein identifying the plurality of clusters of network activity is based on a neural network.
15. The non-transitory computer-readable medium of claim 11 , wherein generating the representation of the graph representing the network activity comprises applying a t-Stochastic Neighbor Embedding (t-SNE) technique to the graph representing the network activity.