Apparatus method and medium for detecting payload anomaly using n-gram distribution of normal data
US7639714B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Nov 12, 2004 |
| Grant date | Dec 29, 2009 |
| Priority date | — |
| Expiry date | May 18, 2026 |
Classification
- Technology area (CPC H)Electricity
- CPC primaryH04L63/145
- WIPO fieldDigital communication
- WIPO sectorElectrical engineering
Abstract
A method, apparatus and medium are provided for detecting anomalous payloads transmitted through a network. The system receives payloads within the network and determines a length for data contained in each payload. A statistical distribution is generated for data contained in each payload received within the network, and compared to a selected model distribution representative of normal payloads transmitted through the network. The model payload can be selected such that it has a predetermined length range that encompasses the length for data contained in the received payload. Anomalous payloads are then identified based on differences detected between the statistical distribution of received payloads and the model distribution. The system can also provide for automatic training and incremental updating of models.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.