Methods and apparatus for monitoring network events for intrusion detection
A first dataset that includes an indication of a plurality of network events associated with a time-period is received. For each time sub-period from a plurality of time sub-periods that together span the time-period and to generate a second dataset, a value for each network event from the plurality of network events that occur within that time sub-period is summed. A discrete Fourier transform is performed based on the second dataset to generate a third dataset that includes an indication of a plurality of frequency ranges and a plurality of magnitude values for the plurality of frequency ranges. Each frequency from the plurality of frequencies ranges is associated with a magnitude value from the plurality of magnitude values. A set of candidate frequencies from the plurality of frequencies determined to potentially cause periodic behavior is identified based on the plurality of frequency ranges and the plurality of magnitude values.
1. A method, comprising:
converting, via a processor, a plurality of sets of events associated with a first device into a time series, each set of events from the plurality of sets of events associated with the first device and a second device from a plurality of second devices that is different for remaining sets of events from the plurality of sets of events and does not include the first device;
performing, via the processor, a discrete Fourier transform based on the time series to generate an output, wherein performing the discrete Fourier transform includes:
normalizing the time series to generate a normalized time series;
calculating, using the normalized time series, a linear regression fit that includes indication of a slope and an intercept;
subtracting the slope and the intercept from the normalized time series to generate a modified normalized time series;
applying a hamming window to the normalized time series to generate an input; and
generating the output based on inputting the input to the discrete Fourier transform;
identifying, via the processor and based on the output, an attribute associated with an event from a set of events from the plurality of sets of events that is predicted to cause a periodic behavior; and
sending, via the processor, a signal to cause an output including representation of the attribute.
2. The method of claim 1 , wherein the output is associated with a plurality of frequencies, the method further comprising:
selecting a set of candidate frequencies from the plurality of frequencies that are potentially exhibiting periodic behavior; and
determining, to generate a set of correlation values, a correlation value between each set of events from the plurality of sets of events and each candidate frequency from the set of candidate frequencies,
the attribute further identified based on the set of correlation values.
3. The method of claim 1 , wherein each set of events from the plurality of sets of events is associated with at least one of a destination location for the second device associated with that set of network events or a network protocol for the second device associated with that set of network events.
4. The method of claim 1 , wherein each event for each set of events from the plurality of sets of events is associated with a start time, an end time, a value indicating significance of that event, and a plurality of attributes.
5. The method of claim 1 , wherein:
each event for each set of events from the plurality of sets of events is associated with a start time, an end time, a value indicating significance of that event, and a plurality of attributes,
the converting the plurality of sets of events into the time series is based on the value for each event from each set of events from the plurality of sets of events, the start time for each event from each set of events from the plurality of sets of events, and the end time for each event form each set of events from the plurality of sets of events.
6. The method of claim 1 , wherein the plurality of sets of events is a plurality of sets of network events, each set of network events from the plurality of sets of network events is associated with an internet protocol (IP) address for the second device associated with that set of network events.
7. The method of claim 1 , wherein the plurality of sets of events is a plurality of sets of network events, and each network event for each set of network events from the plurality of sets of network events is associated with a value that represents an amount of data transferred between the first device and the second device associated with that set of network events.
8. The method of claim 1 , wherein:
the plurality of sets of events is a plurality of sets of network events,
the plurality of sets of network events are from a time period,
the time series is associated with a plurality of time sub-periods that together span the time period, and
converting the plurality of sets of network events into the time series includes, for each time sub-period from the plurality of time sub-periods, determining a summation value that is to be associated with that time sub-period based on a summation of all values associated with network events from the plurality of sets of network events that occur within that time sub-period.
9. The method of claim 1 , wherein the output is associated with a plurality of frequencies, the method further comprising:
applying a blurring filter to the output to generate a blurred output, the blurred output associated with the plurality of frequencies and a plurality of blurred magnitude values, each frequency from the plurality of frequencies associated with a blurred magnitude value from the plurality of magnitude values;
identifying a set of blurred magnitude values from the plurality of blurred magnitudes values that are associated with a set of frequencies from the plurality of frequencies;
performing at least one significance test based on the set of blurred magnitude values to identify a subset of frequencies from the set of frequencies; and
removing at least one harmonic frequency from the subset of frequencies to generate a set of candidate frequencies,
the identifying the attribute further based on the set of candidate frequencies.
10. The method of claim 9 , wherein:
each blurred magnitude value from the set of blurred magnitude values is larger than a first blurred magnitude value included in the plurality of blurred magnitude values and a second blurred magnitude value included in the plurality of blurred magnitude values,
the frequency associated with each blurred magnitude value from the set of blurred magnitude values is more similar to the frequency associated with the first blurred magnitude value and the frequency associated with the second blurred magnitude value than remaining frequencies from the plurality of frequencies associated with remaining blurred magnitude values from the set of blurred magnitude values.
11. The method of claim 1 , wherein:
identifying the attribute includes using a greedy technique to find the attribute.
12. An apparatus, comprising:
a processor; and
a memory operatively coupled to the processor, the processor configured to:
receive a first dataset that includes an indication of a plurality of network events, each network event from the plurality of network events associated with a value indicating significance of that network event;
generate a second dataset based on the value indicating significance for each network event from the plurality of network events;
perform a discrete Fourier transform based on the second dataset to generate a third dataset that includes an indication of a plurality of frequency ranges; and
determine, based on a comparison between the plurality of frequency ranges and the first dataset, a set of attributes associated with a network event from the plurality of network events determined to cause a periodic behavior,
wherein the set of attributes is a first set of attributes determined at a first time, and the processor is further configured to:
fail to determine a second set of attributes determined to cause the periodic behavior at a second time prior to the first time, the second set of attributes including more attributes than the first set of attributes.
13. The apparatus of claim 12 , wherein each network event from the plurality of network events associated with a start time, an end time, and a plurality of attributes that includes the set of attributes, the plurality of network events including network events that occurred between a source device and a plurality of different destination devices.
14. The apparatus of claim 12 , wherein the processor is configured to generate the second dataset based on the first dataset by:
summing, for each time sub-period from a plurality of time sub-periods that together span a time period associated with the plurality of network events and to generate the second dataset, the value associated with each network event from the plurality of network events that occur within that time sub-period.
15. The apparatus of claim 12 , wherein performing the discrete Fourier transform based on the second dataset includes:
normalizing the second dataset to generate a normalized second dataset; and
performing the discrete Fourier transform using the normalized second dataset to generate the third dataset.
16. A method, comprising:
converting, via a processor, a plurality of sets of events associated with a first device into a time series, each set of events from the plurality of sets of events associated with the first device and a second device from a plurality of second devices that is different for remaining sets of events from the plurality of sets of events and does not include the first device;
normalizing, via the processor, the time series to generate a normalized time series;
performing, via the processor, a discrete Fourier transform based on providing the normalized time series as input to the discrete Fourier transform to generate an output;
identifying, via the processor and based on the output, an attribute associated with an event from a set of events from the plurality of sets of events that is predicted to cause a periodic behavior;
and sending, via the processor, a signal to cause an output including representation of the attribute.
17. The method of claim 16 , wherein the output is associated with a plurality of frequencies, the method further comprising:
applying a blurring filter to the output to generate a blurred output, the blurred output associated with the plurality of frequencies and a plurality of blurred magnitude values, each frequency from the plurality of frequencies associated with a blurred magnitude value from the plurality of magnitude values;
identifying a set of blurred magnitude values from the plurality of blurred magnitudes values that are associated with a set of frequencies from the plurality of frequencies;
performing at least one significance test based on the set of blurred magnitude values to identify a subset of frequencies from the set of frequencies; and
removing at least one harmonic frequency from the subset of frequencies to generate a set of candidate frequencies,
the identifying the attribute further based on the set of candidate frequencies.
18. The method of claim 17 , wherein:
each blurred magnitude value from the set of blurred magnitude values is larger than a first blurred magnitude value included in the plurality of blurred magnitude values and a second blurred magnitude value included in the plurality of blurred magnitude values,
the frequency associated with each blurred magnitude value from the set of blurred magnitude values is more similar to the frequency associated with the first blurred magnitude value and the frequency associated with the second blurred magnitude value than remaining frequencies from the plurality of frequencies associated with remaining blurred magnitude values from the set of blurred magnitude values.
19. The method of claim 16 , wherein in response to normalizing, via the processor, the time series to generate a normalized time series, the method further comprises:
calculating, using the normalized time series, a linear regression fit that includes indication of a slope and an intercept;
subtracting the slope and the intercept from the normalized time series to generate a modified normalized time series; and
applying a hamming window to the normalized time series to generate the input.
20. The method of claim 16 , wherein each set of events from the plurality of sets of events is associated with at least one of a destination location for the second device associated with that set of network events or a network protocol for the second device associated with that set of network events.