Patent ID: 8626678
Filing Date: 2014-01-07
Classification: G06K,H04L

Abstract:
1. An anomaly detection method for link-state routing protocols, a link-state routing protocol providing for link-state update messages to be exchanged between nodes in a packet-based network, wherein each link-state update message includes link-state advertisement message(s) each having a respective header with a number of fields, the method comprising: extracting and forming respective training feature vectors with values in at least some of the fields of the headers of at least some of the link-state advertisement messages exchanged in the network during a training period; computing a hypersurface encompassing the training feature vectors, wherein the hypersurface comprises a center and a radius defining an anomaly detection threshold; monitoring link-state advertisement messages exchanged in the network; extracting and forming respective detection feature vectors with the values in at least some of the fields of the headers of at least some of the monitored link-state advertisement messages; detecting an anomaly related to routing by comparing positions of the detection feature vectors to the hypersurface and feeding the detection feature vectors to a one-class support vector machine and; training the one-class support vector machine during the training period based on the training feature vectors, wherein the training period is substantially free-of-attacks and free-of-failures, wherein the one-class support vector machine is based on a kernel function with a variance which is set substantially equal to an average Euclidean distance between the training feature vectors, and wherein the kernel function is a radial basis function, wherein the one-class support vector machine operates by mapping the training feature vectors into a high-dimensional feature space used to model the hypersurface, and wherein the one-class support vector machine includes support vectors defined by training feature vectors closest to the hypersurface; wherein training the one-class support vector machine includes computing a reference template including the support vectors, the variance of the kernel function, and the center and radius of the one-class support vector machines, and representing a free-of-attacks and free-of-failures routing behaviour of the network; and wherein detecting an anomaly related to routing includes: wherein detecting an anomaly related to routing based on the reference template and the detection feature vectors comprises: