Heterogeneous sensors for network defense

1. A process for defending a network of computers against attack, comprising:

inspecting network traffic for malicious data using a signature-based sensor; and

simultaneously inspecting said network traffic for malicious data using a machine-learning based sensor;

wherein said machine-learning based sensor has been trained to detect attacks on blind spots of said signature-based sensor by a process comprising;

modifying patterns of attack on said signature-based sensor to compile blind spot malicious samples that avoid intrusion detection by said signature-based sensor;

tagging said blind spot malicious samples as tagged malicious samples;

acquiring samples of normal network traffic patterns;

sanitizing a normal portion of said samples of normal network traffic patterns to obtain normal samples;

tagging said normal samples as tagged normal samples; and

tagging a portion of said samples of normal network traffic that are not said normal portion as untagged samples,

presenting a machine-learning training dataset comprising said tagged malicious samples, said tagged normal samples, and said untagged samples, to said machine-learning based sensor to create models of normal network traffic and to detect samples that fail to conform to said models of normal network traffic as malicious data;

iteratively testing accuracy of said machine-learning based sensor using said models of normal network traffic to reduce false positives of said machine-learning based sensor and to achieve iteratively tested models of normal network traffic;

whereby said machine-learning sensor recognizes malicious data as data that fails to conform to said iteratively tested models of normal traffic, with a reduced rate of false positives; and

whereby said signature-based sensor recognizes as malicious data any network traffic that matches signatures provided to said signature-based sensor.

2. A process according to claim 1 , further comprising:

acquiring archived malicious samples from archives of attacks on live networks; and

tagging said archived malicious samples as malicious and including said archived malicious samples in said machine-learning dataset.

3. A process according to claim 1 , wherein said modifying step is performed by applying evasion techniques to attacks that are detected by said signature-based sensor until said signature-based sensor fails to detect said attacks.

4. A process according to claim 3 , wherein said evasion techniques are selected from the group consisting of obfuscation, fragmentation and encryption.

5. A process according to claim 1 , wherein said iteratively testing step is performed by using statistical techniques selected from the group consisting of design of experiments, multi-factor interaction analysis, and analysis of variance.

6. A process according to claim 1 , wherein said acquiring step is performed at a location in said network where said sensors will be deployed.

7. A system, comprising:

a network of computers;

a signature-based sensor and a machine-learning based sensor deployed in said network to simultaneously inspect network traffic for malicious data;

wherein said machine-learning based sensor recognizes as malicious data any network traffic that fails to conform to models of normal network traffic that have been iteratively tested to reduce false positives; and

wherein said signature-based sensor recognizes as malicious data any network traffic that matches signatures provided to said signature-based sensor;

wherein said machine-learning based sensor has been trained by a process, comprising:

modifying patterns of attack on said signature-based sensor to compile blind spot malicious samples that avoid intrusion detection by said signature-based sensor;

tagging said blind spot malicious samples as tagged malicious samples;

acquiring samples of normal network traffic patterns;

sanitizing a normal portion of said samples of normal network traffic patterns to obtain normal samples;

tagging said normal samples as tagged normal samples;

tagging a portion of said samples of normal network traffic that are not said normal portion as untagged samples,

presenting a machine-learning training dataset comprising said tagged malicious samples, said tagged normal samples, and said untagged samples, to said machine-learning based sensor to create models of normal network traffic and to detect samples that fail to conform to said models of normal network traffic as malicious data; and

iteratively testing accuracy of said machine-learning based sensor using said models of normal network traffic to reduce false positives of said machine-learning based sensor and to achieve iteratively tested models of normal network traffic.

8. A system according to claim 7 , wherein said machine-learning based sensor has been trained by a process further comprising:

acquiring archived malicious samples from archives of attacks on live networks; and

tagging said archived malicious samples as malicious and including said archived malicious samples in said machine-learning dataset.

9. A process for defending a network of computers having normal network traffic against attack, comprising:

training a machine-learning based sensor to detect attacks on blind spots of a signature-based sensor by a process comprising;

modifying patterns of attack on said signature-based sensor to compile blind spot malicious samples that avoid intrusion detection by said signature-based sensor;

tagging said blind spot malicious samples as tagged malicious samples;

acquiring samples of normal network traffic patterns;

sanitizing a normal portion of said samples of normal network traffic patterns to obtain normal samples;

tagging said normal samples as tagged normal samples; and

tagging a portion of said samples of normal network traffic that are not said normal portion as untagged samples,

presenting a machine-learning training dataset comprising said tagged malicious samples, said tagged normal samples, and said untagged samples, to said machine-learning based sensor to create models of normal network traffic and to detect samples that fail to conform to said models of normal network traffic as malicious data;

iteratively testing accuracy of said machine-learning based sensor using said models of normal network traffic to reduce false positives of said machine-learning based sensor and to achieve iteratively tested models of normal network traffic;

whereby said machine-learning sensor recognizes malicious data as data that fails to conform to said iteratively tested models of normal traffic, with a reduced rate of false positives; and

whereby said signature-based sensor recognizes as malicious data any network traffic that matches signatures provided to said signature-based sensor;

inspecting network traffic for malicious data using said signature-based sensor; and

simultaneously inspecting said network traffic for malicious data using said machine-learning based sensor.

10. A process according to claim 9 , further comprising:

acquiring archived malicious samples from archives of attacks on live networks; and

tagging said archived malicious samples as malicious and including said archived malicious samples in said machine-learning dataset.