Patent ID: 11882138
Assignee: INTERNATIONAL BUSINESS MACHINES CORPORATION
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 0:
1. A method to identify threats on a TCP/IP-based network, comprising:
obtaining a set of reference patterns associated with one or more defined Indicators of Compromise (IoCs), wherein a reference pattern is an encoding of a packet capture and includes a set of interval-bound traffic measurements for each pairing of one or more addressable network interfaces in the packet capture, together with any other detectable session data that is at least one of: traffic volume, directional data, and non-encrypted traffic metadata associated with a transport connection;
receiving, as a data stream, network traffic data associated with a traffic pattern;
encoding the received network traffic to generate a network spectral;
as the data stream is received, real-time pattern matching the network spectral against a set of reference patterns that include the reference pattern; and
responsive to identifying a match between the network spectral and at least one of the set of reference patterns, taking a given remediation or mitigation action.