Anomaly detection using collaborative filtering
View Patent ↗Described are techniques for network anomaly detection. The techniques include generating, from network traffic, a plurality of network interactions, where respective network interactions comprise a communication source and a communication destination. The techniques further include generating, for the respective network interactions, a recommendation score using a trained Collaborative Filtering (CF) model. The techniques further include calculating, for the respective network interactions, an outlier score based on the recommendation score. The techniques further include generating a notification identifying an anomaly in the network traffic based on at least one outlier score satisfying a threshold.
1 . A method comprising:
generating, from network traffic, a plurality of network interactions, wherein respective network interactions comprise a communication source, a communication destination, and a metric associated with the communication source and the communication destination;
generating, for the respective network interactions, a recommendation score using a trained Collaborative Filtering (CF) model;
calculating, for the respective network interactions, an outlier score, wherein the outlier score comprises a normalized difference that is determined by taking an absolute value of a difference between the recommendation score and the metric and dividing by a maximal rating;
generating a notification identifying an anomaly in the network traffic based on at least one outlier score satisfying a threshold; and
automatically performing a cybersecurity mitigation action on one or more network components based on the anomaly.
2 . The method of claim 1 , wherein the metric comprises an amount of data exchanged between the communication source and the communication destination.
3 . The method of claim 1 , wherein the metric comprises a recency of data exchanged between the communication source and the communication destination.
4 . The method of claim 1 , wherein the metric comprises a frequency of interaction between the communication source and the communication destination.
5 . The method of claim 1 , wherein a relatively stronger recommendation score generates a relatively less anomalous outlier score, and wherein a relatively weaker recommendation score generates a relatively more anomalous outlier score.
6 . The method of claim 1 , wherein the communication source comprises an Internet Protocol (IP) address.
7 . The method of claim 1 , wherein the communication source comprises a Media Access Control (MAC) address.
8 . The method of claim 1 , wherein the communication source comprises a host name.
9 . The method of claim 1 , wherein the communication source comprises a username.
10 . The method of claim 1 , wherein the communication source comprises a dynamic Internet Protocol (IP) range.
11 . The method of claim 1 , wherein the communication source comprises a network name.
12 . The method of claim 1 , wherein the communication source comprises a container identifier.
13 . The method of claim 1 , wherein the communication source comprises, for respective network interactions, at least one Internet Protocol (IP) address, at least one Media Access Control (MAC) address, at least one host name, at least one username, at least one dynamic Internet Protocol (IP) range, at least one network name, and at least one container identifier.
14 . The method of claim 1 , wherein the communication destination is an application identifier.
15 . The method of claim 1 , wherein the method is performed by a server implementing network anomaly detection code, and wherein the method further comprises:
metering usage of the network anomaly detection code; and
generating an invoice based on metering the usage of the network anomaly detection code.
16 . The method of claim 1 , wherein the communication destination is a destination port.
17 . The method of claim 1 , wherein the cybersecurity mitigation action comprises adjusting a bandwidth Quality of Service characteristic of the one or more network components.
18 . A system comprising:
one or more computer readable storage media storing program instructions; and
one or more processors which, in response to executing the program instructions, are configured to perform a method comprising:
generating, from network traffic, a plurality of network interactions, wherein respective network interactions comprise a communication source, a communication destination, and a metric associated with the communication source and the communication destination;
generating, for the respective network interactions, a recommendation score using a trained Collaborative Filtering (CF) model;
calculating, for the respective network interactions, an outlier score, wherein the outlier score comprises a normalized difference that is determined by taking an absolute value of a difference between the recommendation score and the metric and dividing by a maximal rating;
generating a notification identifying an anomaly in the network traffic based on at least one outlier score satisfying a threshold; and
automatically performing a cybersecurity mitigation action on one or more network components based on the anomaly.
19 . A computer program product comprising one or more computer readable storage media, and program instructions collectively stored on the one or more computer readable storage media, the program instructions comprising instructions configured to cause one or more processors to perform a method comprising:
generating, from network traffic, a plurality of network interactions, wherein respective network interactions comprise a communication source, a communication destination, and a metric associated with the communication source and the communication destination;
generating, for the respective network interactions, a recommendation score using a trained Collaborative Filtering (CF) model;
calculating, for the respective network interactions, an outlier score, wherein the outlier score comprises a normalized difference that is determined by taking an absolute value of a difference between the recommendation score and the metric and dividing by a maximal rating;
generating a notification identifying an anomaly in the network traffic based on at least one outlier score satisfying a threshold; and
automatically performing a cybersecurity mitigation action on one or more network components based on the anomaly.