Systems and methods for detecting anomalous behaviors based on temporal profile

1. A method for monitoring a network, comprising:

collecting, by a control system comprising a processor and memory, a set of network data communicated by a plurality of network nodes over a network during a time duration;

segmenting, by the control system, the time duration into a plurality of monitoring time periods;

grouping, by the control system and based on a plurality of timestamps of the set of network data, the set of network data into respective subsets of the plurality of monitoring time periods;

identifying, by the control system, one or more seasonalities from the set of network data based on an occurrence rate associated with each of the subsets of the plurality of monitoring time periods;

generating, by the control system, a temporal profile based on the one or more identified seasonalities;

detecting, by the control system and based on the temporal profile, an anomalous behavior performed by one of the plurality of network nodes; and

identifying, by the control system and based on the temporal profile, a root cause for the anomalous behavior.

2. The method of claim 1 , further comprising:

switching, by the control system, from a data collection mode to an anomaly detection mode in response to the generation of the temporal profile.

3. The method of claim 1 , wherein the set of network data includes at least one of: a plurality of raw data packets over the network, respective source IP addresses of the plurality of raw data packets, respective destination IP addresses of the plurality of raw data packets, respective source TCP ports of the plurality of raw data packets, respective destination TCP ports of the plurality of raw data packets, respective source UDP ports of the plurality of raw data packets, respective destination UDP ports of the plurality of raw data packets, and respective data sizes of the plurality of raw data packets.

4. The method of claim 1 , wherein identifying a root cause for the anomalous behavior further comprises:

determining, by the control system, a network flow associated with the anomalous behavior using highest magnitude interaction analysis; and

identifying, by the control system, the network nodes associated with the network flow.

5. The method of claim 1 , wherein detecting an anomalous behavior performed by one of the plurality of network nodes further comprises:

collecting, by the control system, a second set of network data communicated by the plurality of network nodes over the network during a second time duration;

identifying, by the control system, one or more detection mode seasonalities from the second set of network data;

comparing, by the control system, the detection mode seasonalities with the temporal profile to calculate a confidence margin; and

detecting, by the control system, an anomalous behavior based on the calculated confidence margin exceeding a predetermined threshold.

6. The method of claim 1 , further comprising:

identifying, by the control system, from the set of network data, a network communication between two network nodes, wherein at least one of the network nodes is on a list of known malicious network nodes;

identifying, by the control system, one or more malicious seasonalities of the identified network communication; and

generating, by the control system, a malicious temporal profile based on the one or more identified malicious seasonalities;

comparing, by the control system, the one or more seasonalities to the malicious temporal profile to determine a malicious network communication with an unknown network node; and

adding, by the control system, the unknown network node to the list of known malicious network nodes.

7. The method of claim 1 , further comprising:

identifying, by the control system, from the set of network data, a network communication between two network nodes, wherein at least one of the network nodes is on a list of known trusted network nodes;

identifying, by the control system, one or more trusted seasonalities of the identified network communication;

generating, by the control system, a trusted temporal profile based on the one or more identified trusted seasonalities;

comparing, by the control system, the one or more seasonalities to the trusted temporal profile to determine a trusted network communication with an unknown network node; and

adding, by the control system, the unknown network node to the list of known trusted network nodes.

8. A computing device comprising:

a memory; and

one or more processors operatively coupled to the memory, the one or more processors being to:

collect a set of network data communicated by a plurality of network nodes over a network during a time duration;

segment, by the control system, the time duration into a plurality of monitoring time periods;

group, by the control system and based on a plurality of timestamps of the set of network data, the set of network data into respective subsets of the plurality of monitoring time periods;

identify one or more seasonalities from the set of network data based on an occurrence rate associated with each of the subsets of the plurality of monitoring time periods;

generate a temporal profile based on the one or more identified seasonalities;

detect, based on the temporal profile, an anomalous behavior performed by one of the plurality of network nodes; and

identify, based on the temporal profile, a root cause for the anomalous behavior.

9. The computing device of claim 8 , wherein the one or more processors are further to switch from a data collection mode to an anomaly detection mode in response to the generation of the temporal profile.

10. The computing device of claim 8 , wherein the set of network data includes at least one of: a plurality of raw data packets over the network, respective source IP addresses of the plurality of raw data packets, respective destination IP addresses of the plurality of raw data packets, respective source TCP ports of the plurality of raw data packets, respective destination TCP ports of the plurality of raw data packets, respective source UDP ports of the plurality of raw data packets, respective destination UDP ports of the plurality of raw data packets, and respective data sizes of the plurality of raw data packets.

11. The computing device of claim 8 , wherein the one or more processors are further to:

determine a network flow associated with the anomalous behavior using highest magnitude interaction analysis; and

identify the network nodes associated with the network flow.

12. The computing device of claim 8 , wherein the one or more processors are further to:

collect a second set of network data communicated by the plurality of network nodes over the network during a second time duration;

identify one or more detection mode seasonalities from the second set of network data;

compare the detection mode seasonalities with the temporal profile to calculate a confidence margin; and

detect an anomalous behavior based on the calculated confidence margin exceeding a predetermined threshold.

13. The computing device of claim 8 , wherein the one or more processors are further to:

identify, from the set of network data, a network communication between two network nodes, wherein at least one of the network nodes is on a list of known malicious network nodes;

identify one or more malicious seasonalities of the identified network communication; and

generate a malicious temporal profile based on the one or more identified malicious seasonalities;

compare the one or more seasonalities to the malicious temporal profile to determine a malicious network communication with an unknown network node; and

add the unknown network node to the list of known malicious network nodes.

14. The computing device of claim 8 , wherein the one or more processors are further to:

identify, from the set of network data, a network communication between two network nodes, wherein at least one of the network nodes is on a list of known trusted network nodes;

identify one or more trusted seasonalities of the identified network communication;

generate a trusted temporal profile based on the one or more identified trusted seasonalities;

compare the one or more seasonalities to the trusted temporal profile to determine a trusted network communication with an unknown network node; and

add the unknown network node to the list of known trusted network nodes.

15. A non-transitory computer readable medium storing program instructions for causing one or more processors to:

collect a set of network data communicated by a plurality of network nodes over a network during a time duration;

segment, by the control system, the time duration into a plurality of monitoring time periods;

group, by the control system and based on a plurality of timestamps of the set of network data, the set of network data into respective subsets of the plurality of monitoring time periods;

identify one or more seasonalities from the set of network data based on an occurrence rate associated with each of the subsets of the plurality of monitoring time periods;

generate a temporal profile based on the one or more identified seasonalities;

detect, based on the temporal profile, an anomalous behavior performed by one of the plurality of network nodes; and

identify, based on the temporal profile, a root cause for the anomalous behavior.

16. The non-transitory computer readable medium of claim 15 , wherein the program instructions further cause the one or more processors to:

collect a second set of network data communicated by the plurality of network nodes over the network during a second time duration;

identify one or more detection mode seasonalities from the second set of network data;

compare the detection mode seasonalities with the temporal profile to calculate a confidence margin; and

detect an anomalous behavior based on the calculated confidence margin exceeding a predetermined threshold.

17. The non-transitory computer readable medium of claim 15 , wherein the program instructions further cause the one or more processors to:

identify, from the set of network data, a network communication between two network nodes, wherein at least one of the network nodes is on a list of known malicious network nodes;

identify one or more malicious seasonalities of the identified network communication;

generate a malicious temporal profile based on the one or more identified malicious seasonalities;

compare the one or more seasonalities to the malicious temporal profile to determine a malicious network communication with an unknown network node; and

add the unknown network node to the list of known malicious network nodes.

18. The non-transitory computer readable medium of claim 15 , wherein the program instructions further cause the one or more processors to:

identify, from the set of network data, a network communication between two network nodes, wherein at least one of the network nodes is on a list of known trusted network nodes;

identify one or more trusted seasonalities of the identified network communication;

generate a trusted temporal profile based on the one or more identified trusted seasonalities;

compare the one or more seasonalities to the trusted temporal profile to determine a trusted network communication with an unknown network node; and

add the unknown network node to the list of known trusted network nodes.

19. The non-transitory computer readable medium of claim 15 , wherein the one or more processors are further to switch from a data collection mode to an anomaly detection mode in response to the generation of the temporal profile.

20. The non-transitory computer readable medium of claim 15 , wherein the program instructions further cause the one or more processors to:

determine a network flow associated with the anomalous behavior using highest magnitude interaction analysis; and

identify the network nodes associated with the network flow.