Systems and methods of network security anomaly detection

1. A network security anomaly detection system, comprising:

a network of interconnected devices, at least a plurality of the devices generating device status information; and

a processor in communication with the network and receiving the device status information, the processor operating a variational autoencoder that

receives the device status information;

optimizes the received device status information; and

determines or enables a user to determine whether the device status information qualifies as an anomaly that requires a response,

wherein the processor compares the optimized device status information to at least one of non-anomalous device status data or anomalous device status data in a latent space of the variational autoencoder,

wherein the processor optimizes the device status information by generating a plurality of probabilistic models of the device status information and determining which of the plurality of probabilistic models is optimal, and

wherein the processor determines which of the plurality of probabilistic models is optimal by applying a game theoretic optimization to the plurality of probabilistic models and selecting which of the plurality of probabilistic models to use to generate an n-D point scatter plot in latent space.

2. A network security anomaly detection system according to claim 1 , wherein the further the optimized device status information is from the non-anomalous device status data in the latent space, the greater a likelihood the device status information represents an anomaly.

3. A network security anomaly detection system according to claim 2 , wherein the latent space comprises a 3-D point scatter plot that includes hidden vector values.

4. A network security anomaly detection system according to claim 1 , wherein the plurality of probabilistic models includes at least two of Adam, SGDM, or RMSProp.

5. A network security anomaly detection system according to claim 2 , further comprising:

a display; and

a user interface, the user interface enabling a user to select a data sample from the device status information and to see where the data sample is located in the latent space n-D point scatter plot.

6. A network security anomaly detection system according to claim 1 , the processor further comprising an image gradient sobel edge detector that preprocesses the device status information prior to optimizing the device status information.

7. A network security anomaly detection system according to claim 6 , wherein the image gradient sobel edge detector is configured to return a floating-point edge metric.

8. A method of detecting network security anomalies in a network of interconnected devices, the method comprising the steps of:

generating device status information for at least a plurality of the devices in the network;

receiving the device status information at a processor in communication with the network;

operating a variational autoencoder on the processor that is configured for

receiving the device status information;

optimizing the received device status information; and

determining or enabling a user to determine whether the device status information qualifies as an anomaly that requires a response; and

comparing, via the processor, the optimized device status information to at least one of non-anomalous device status data or anomalous device status data in a latent space of the variational autoencoder,

wherein the optimizing step further comprises steps of:

generating, via the processor, a plurality of probabilistic models of the device status information; and

determining, via the processor, which of the plurality of probabilistic models is optimal,

wherein the step of determining which of the plurality of probabilistic models is optimal further comprises steps of:

applying a game theoretic optimization to the plurality of probabilistic models; and

selecting which of the plurality of probabilistic models to use to generate an n-D point scatter plot in latent space.

9. A method of detecting network security anomalies according to claim 8 , wherein the further the optimized device status information is from the non-anomalous device status data in the latent space, the greater a likelihood the device status information represents an anomaly.

10. A method of detecting network security anomalies according to claim 9 , wherein the latent space includes a 3-D point scatter plot that includes hidden vector values.

11. A method of detecting network security anomalies according to claim 8 , wherein the optimizing step is performed for at least one subset of the device status information.

12. A method of detecting network security anomalies according to claim 8 , further comprising a step of preprocessing the device status information prior to optimizing the device status information via an image gradient sobel edge detector.

13. A method of detecting network security anomalies according to claim 12 , further comprising a step of returning a floating-point edge metric via the image gradient sobel edge detector.

14. A method of detecting network security anomalies according to claim 8 , further comprising steps of:

implementing a 3-D p-value statistical test to measure anomaly detection accuracy; and

representing the results of the 3-D p-value statistical test with Receiver Operating Characteristic (ROC) curves.

15. A method of detecting network security anomalies according to claim 14 , the implementing step further comprising the steps of:

selecting a 3-D view of latent space clusters that shows the most separation of test hypotheses; and

calculating the probability of the most likely non-anomalous device status data to which received device status information might belong to latent space distribution.

16. A non-transitory computer-readable storage medium, comprising one or more programs for executing a model of detecting network security anomalies in a network of interconnected devices by use of a variational autoencoder, wherein the model is configured to, via a processor:

receive device status information from at least a plurality of the devices in the network;

optimize the received device status information by use of the variational autoencoder;

determine or enable a user to determine whether the device status information qualifies as an anomaly that requires a response;

compare the optimized device status information to at least one of non-anomalous device status data or anomalous device status data in a latent space of the variational autoencoder;

optimize the device status information by generating a plurality of probabilistic models of the device status information and determines which of the plurality of probabilistic models is optimal; and

determine which of the plurality of probabilistic models is optimal by applying a game theoretic optimization to the plurality of probabilistic models and selecting which of the plurality of probabilistic models to use to generate an n-D point scatter plot in latent space.

17. A non-transitory computer-readable storage medium according to claim 16 , wherein the further the optimized device status information is from the non-anomalous device status data in the latent space, the greater a likelihood the device status information represents an anomaly.

18. A non-transitory computer-readable storage medium according to claim 17 , wherein the latent space includes a 3-D point scatter plot that includes hidden vector values.

19. A non-transitory computer-readable storage medium according to claim 16 , wherein the model is further configured to preprocess the device status information prior to optimizing the device status information via an image gradient sobel edge detector.

20. A non-transitory computer-readable storage medium according to claim 19 , wherein the model is further configured to return a floating-point edge metric via the image gradient sobel edge detector.

21. A non-transitory computer-readable storage medium according to claim 16 , wherein the model is further configured to:

implement a 3-D p-value statistical test to measure anomaly detection accuracy; and

represent the results of the 3-D p-value statistical test with Receiver Operating Characteristic (ROC) curves.

22. A non-transitory computer-readable storage medium according to claim 21 , wherein the model is further configured to:

select a 3-D view of latent space clusters that shows the most separation of test hypotheses; and

calculate the probability of the most likely non-anomalous device status data to which received device status information might belong to latent space distribution.

23. A network security anomaly detection system, comprising:

a network of interconnected devices, at least a plurality of the devices generating device status information; and

a processor in communication with the network and receiving the device status information, the processor operating a variational autoencoder that

receives the device status information;

optimizes the received device status information; and

determines or enables a user to determine whether the device status information qualifies as an anomaly that requires a response,

the processor further comprising an image gradient sobel edge detector that preprocesses the device status information prior to optimizing the device status information,

wherein the image gradient sobel edge detector is configured to return a floating-point edge metric.

24. A method of detecting network security anomalies in a network of interconnected devices, the method comprising steps of:

generating device status information for at least a plurality of the devices in the network;

receiving the device status information at a processor in communication with the network;

operating a variational autoencoder on the processor that is configured for

receiving the device status information;

optimizing the received device status information; and

determining or enabling a user to determine whether the device status information qualifies as an anomaly that requires a response;

preprocessing the device status information prior to optimizing the device status information via an image gradient sobel edge detector; and

returning a floating-point edge metric via the image gradient sobel edge detector.

25. A non-transitory computer-readable storage medium, comprising one or more programs for executing a model of detecting network security anomalies in a network of interconnected devices by use of a variational autoencoder, wherein the model is configured to:

receive device status information from at least a plurality of the devices in the network;

optimize the received device status information by use of the variational autoencoder;

determine or enable a user to determine whether the device status information qualifies as an anomaly that requires a response;

preprocess the device status information prior to optimizing the device status information via an image gradient sobel edge detector; and

return a floating-point edge metric via the image gradient sobel edge detector.