Intrusion detection using MDL clustering

US9106689B2 · kind B2 · utility

Assignee

• Lockheed Martin Corporation · US

Inventors

• Eric Steinbrecher · Windsor, US
• Jeremy Impson · Vestal, US
• Bruce Gordon Barnett · Troy, US
• Scott Charles Evans · Burnt Hills, US
• Bernhard Scholz · Ballston Lake, US
• Weizhong Yan · Clifton Park, US
• Thomas Stephen Markham · Schenectady, US
• Stephen J. Dill · Frederick, US

Key dates

• Filing date: May 6, 2011
• Grant date: Aug 11, 2015
• Expiry date: Jun 11, 2032

Classification

• Technology area (CPC H): Electricity
• CPC primary: H04L63/1408
• WIPO field: Digital communication
• WIPO sector: Electrical engineering

Abstract

An intrusion detection method, system and computer-readable media are disclosed. The system can include a processor programmed to perform computer network intrusion detection. The intrusion detection can include an identification module and a detection module. The identification module can be adapted to perform semi-supervised machine learning to identify key components of a network attack and develop MDL models representing those attack components. The detection module can cluster the MDL models and use the clustered MDL models to classify network activity and detect polymorphic or zero-day attacks.