Cluster-based determination of signatures for detection of anomalous data traffic

1. A system for cluster-based determination of signatures for detection of anomalous data traffic, the system comprising:

a network module configured to capture data packets routed to a destination; and

at least one processor in communication with the network module, the at least one processor is configured to:

group the data packets in clusters;

upon the grouping, detect an anomaly in the data packets; and

in response to the detection:

determine, based on the clusters, for each of the clusters, one or more signatures associated with the data packets, the determining the one or more signatures including:

determining outliers for the clusters; and

based on the outliers, extracting signatures associated with the anomalous data traffic, the one or more signatures including at least the signatures associated with the anomalous data traffic;

generate, based on at least the signatures associated with the anomalous data traffic, one or more rules for blocking the data packets associated with the anomalous data traffic; and

provide the one or more rules to a policy enforcement point associated with the destination.

2. The system of claim 1 , wherein the grouping of the data packets in clusters includes:

transforming the data packets into a set of multidimensional vectors according to a pre-determined mapping; and

clustering the set of multidimensional vectors.

3. The system of claim 2 , wherein the clustering includes using a K-means algorithm, wherein a number of clusters is optimized using a silhouette analysis.

4. The system of claim 1 , wherein the processor is further configured to assign importance weights to each of the one or more signatures based on historical signature data to generate one or more weighted signatures, wherein the generation of the one or more rules is based on the one or more weighted signatures.

5. The system of claim 1 , wherein the at least one processor is configured to:

determine inliers for the one or more clusters; and

generate the one or more rules based on the inliers.

6. The system of claim 1 , wherein the at least one processor is configured to:

determine a highest density cluster in the set of the clusters; and

determine, based on the highest density cluster, an anomalous signature;

generate, based on the anomalous signature, a rule for blocking the data packets; and

provide the rule for blocking the data packets to the policy enforcement point.

7. The system of claim 1 , wherein the at least one processor is configured to:

receive further data packets of the traffic flow; and

test the one or more rules against the further data packets to estimate reliabilities of the one or more rules.

8. The system of claim 1 , wherein the at least one processor is configured to optimize parameters of the one or more rules to increase the reliabilities of the one or more rules.

9. The system of claim 8 , wherein the at least one processor is configured to optimize the parameters of the one or more rules based on one or more constraints.

10. The system of claim 8 , wherein the at least one processor is configured to optimize the parameters of the one or more rules using a genetic algorithm.

11. A method for cluster-based determination of signatures for detection of anomalous data traffic, the method comprising:

capturing, by a network module, data packets routed to a destination;

grouping, by at least one processor in communication with the network module, the data packets into clusters;

upon the grouping, detecting, by the least one processor, an anomaly in the data packets; and

in response to the detection:

determining, by the least one processor and based on the clusters, for each of the clusters, one or more signatures associated with the data packets, the determining the one or more signatures including:

determining outliers for the clusters; and

based on the outliers, extracting signatures associated with the anomalous data traffic, the one or more signatures including at least the signatures associated with the anomalous data traffic;

generating, by the least one processor and based on at least the signatures associated with the anomalous data traffic, one or more rules for blocking data packets associated with the anomalous data; and

providing, by the least one processor, the one or more rules to a policy enforcement point associated with the destination.

12. The method of claim 11 , wherein the grouping the data packets in clusters includes:

transforming the data packets into a set of multidimensional vectors according to a pre-determined mapping; and

clustering the set of multidimensional vectors.

13. The method of claim 12 , wherein the clustering is based on a K-means algorithm, wherein a number of clusters is optimized using a silhouette analysis.

14. The method of claim 11 , further comprising assigning importance weights to each of the one or more signatures based on historical signature data to generate one or more weighted signatures, wherein the generation of the one or more rules is based on the one or more weighted signatures.

15. The method of claim 13 , further comprising:

determining, by the at least one processor, inliers for the one or more clusters; and

generating, by the at least one processor, the one or more rules based on the inliers.

16. The method of claim 11 , further comprising:

determining, by the at least one processor, a highest density cluster within the clusters; and

determining, by the at least one processor and based on the highest density cluster, an anomalous signature;

generating, by the at least one processor and based on the anomalous signature, a rule for blocking the data packets; and

providing, by the at least one processor, the rule for blocking the data packets by the policy enforcement point.

17. The method of claim 11 , further comprising:

receiving, by the at least one processor, further data packets of the traffic flow; and

testing, by the at least one processor, the one or more rules against the further data packets to estimate reliabilities of the one or more rules.

18. The method of claim 17 , further comprising:

optimizing, by the at least one processor, parameters of the one or more rules to increase the reliabilities of the one or more rules.

19. The method of claim 17 , wherein the parameters of the one or more rules are optimized based on one or more constraints.

20. A non-transitory computer-readable medium having embodied thereon a program, the program providing instructions for a method for cluster-based determination of signatures for detection of anomalous data traffic, the method comprising:

capturing, by a network module, data packets routed to a destination;

grouping, by at least one processor in communication with the network module, the data packets in clusters;

upon the grouping, detecting, by the least one processor, an anomaly in the data packets; and

in response to the detection:

determining, by the least one processor and based on the clusters, for each of the clusters, one or more signatures associated with the data packets, the determining the one or more signatures including:

determining outliers for the clusters; and

based on the outliers, extracting signatures associated with the anomalous data traffic, the one or more signatures including at least the signatures associated with the anomalous data traffic;

generating, by the least one processor and based on at least the signatures associated with the anomalous data traffic, one or more rules for blocking data packets associated with the anomalous data traffic; and

providing, by the least one processor, the one or more rules to a policy enforcement point associated with the destination.