Systems and methods for rule-based anomaly detection on IP network flow
US9258217B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Sep 28, 2009 |
| Grant date | Feb 9, 2016 |
| Priority date | — |
| Expiry date | Jun 15, 2031 |
Classification
- Technology area (CPC H)Electricity
- CPC primaryH04L63/30
- WIPO fieldDigital communication
- WIPO sectorElectrical engineering
Abstract
A system to detect anomalies in internet protocol (IP) flows uses a set of machine-learning (ML) rules that can be applied in real time at the IP flow level. A communication network has a large number of routers that can be equipped with flow monitoring capability. A flow collector collects flow data from the routers throughout the communication network and provides them to a flow classifier. At the same time, a limited number of locations in the network monitor data packets and generate alerts based on packet data properties. The packet alerts and the flow data are provided to a machine learning system that detects correlations between the packet-based alerts and the flow data to thereby generate a series of flow-level alerts. These rules are provided to the flow time classifier. Over time, the new packet alerts and flow data are used to provide updated rules generated by the machine learning system.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.