Patent ID: 8762298
Filing Date: 2014-06-24
Classification: G06F,G06N,H04L

Abstract:
1. A method for identifying a botnet in a network, comprising: obtaining historical network data in the network, the historical network data comprising a first plurality of data units; analyzing, by a central processing unit (CPU) of a computer and using a pre-determined heuristic, the historical network data to determine a plurality of values of a connectivity graph based feature for the first plurality of data units, wherein a first value of the connectivity graph based feature for a first data unit of the first plurality of data units is determined based on and representing connectivity characteristics of at least a portion of the historical network data associated with the first data unit; obtaining a ground truth data set associated with the historical network data, the ground truth data set comprising a plurality of labels with each label assigned to a corresponding data unit of the first plurality of data units, said each label comprising one of a first label categorizing said corresponding data unit as associated with the botnet and a second label categorizing said corresponding data unit as not associated with the botnet; analyzing, by the CPU and using a machine learning algorithm, the historical network data and the ground truth data set to generate a model comprising statistical predictions of the plurality of labels as a function of the plurality of values of the connectivity graph based feature with respect to the first plurality of data units; obtaining real-time network data in the network, the real-time network data comprising a second plurality of data units; analyzing, by the CPU and using the pre-determined heuristic, the real-time network data to determine a second value of the connectivity graph based feature for a second data unit of the second plurality of data units, wherein the second value is determined based on and representing connectivity characteristics of at least a portion of the real-time network data associated with the second data unit; assigning a third label to the second data unit by applying the model to the second value of the connectivity graph based feature; and categorizing the second data unit as associated with the botnet based on the third label, wherein the first plurality of data units comprise a plurality of IP (Internet Protocol) addresses, wherein analyzing the historical network data using the pre-determined heuristic comprises: wherein the connectivity graph based feature represents connectivity characteristics associated with the nodes and comprises the anti-trust rank.