Patent ID: 8856324
Filing Date: 2014-10-07
Classification: G06N,H04L

Abstract:
1. A computer-implemented method for detecting a computing device that is compromised by an undetected attack, the method comprising: obtaining, by one or more processors, a plurality of network packets from a network, wherein the obtained plurality of network packets comprises network packets categorized as Transmission Control Protocol (TCP) packets and Internet Protocol (IP) packets, wherein the obtained plurality of network packets include: creating, by the one or more processors, a plurality of combined packets from at least a subset of the plurality of TCP packets and IP packets, wherein: creating, by the one or more processors, a first sequence by converting bitwise content of at least a portion of the first combined packet into a first plurality of integers, wherein the first sequence includes the first plurality of integers; creating, by the one or more processors, a second sequence by converting bitwise content of at least a portion of the second combined packet into a second plurality of integers, wherein the second sequence includes the second plurality of integers; determining, by the one or more processors, a similarity metric between the first sequence and the second sequence based on a distance function; creating, by the one or more processors, a third sequence based on the similarity metric, wherein the third sequence comprises a third plurality of integers common to the first sequence and the second sequence, in the first order; creating, by the one or more processors, a fourth sequence, wherein the fourth sequence is a meta-expression that: storing the meta-expression, wherein the stored meta-expression is used to detect that the computing device is compromised by the undetected attack.