Modeling and outlier detection in threat management system data
US8528088B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | May 26, 2011 |
| Grant date | Sep 3, 2013 |
| Priority date | — |
| Expiry date | Sep 4, 2031 |
Classification
- Technology area (CPC H)Electricity
- CPC primaryH04L63/1416
- WIPO fieldDigital communication
- WIPO sectorElectrical engineering
Abstract
Methods, systems, and computer-readable media for identifying potential threats on a network based on anomalous behavior in communication between endpoints are provided. Traffic data for a network is accumulated over some period of time. The traffic data is grouped by one or more keys, such as source IP address, and sets of metric values are calculated for the keys. A mixture distribution, such as a negative binomial mixture distribution, is fitted to each set of metric values, and outlying metric values are determined based on the mixture distribution(s). A list of outliers is then generated comprising key values having outlying metric values in one or more of the sets of metric values.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.