Machine learning based botnet detection using real-time extracted traffic features
US8682812B1 · kind B1 · utility
Assignee
Inventor
Key dates
| Filing date | Dec 23, 2010 |
| Grant date | Mar 25, 2014 |
| Priority date | — |
| Expiry date | Nov 20, 2031 |
Classification
- Technology area (CPC H)Electricity
- CPC primaryH04L2463/144
- WIPO fieldDigital communication
- WIPO sectorElectrical engineering
Abstract
A method for identifying a botnet in a network, including analyzing historical network data using a pre-determined heuristic to determine values of a feature in the historical network data, obtaining a ground truth data set having labels assigned to data units in the historical network data identifying known malicious nodes in the network, analyzing the historical network data and the ground truth data set using a machine learning algorithm to generate a model representing the labels as a function of the values of the feature, analyzing real-time network data using the pre-determined heuristic to determine a value of the feature for a data unit in the real-time network data, assigning a label to the data unit by applying the model to the value of the feature, and categorizing the data unit as associated with the botnet based on the label.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.