System and method for network intrusion detection using a neural network implemented by a local computing system

A method includes intercepting requests. The requests are analyzed to identify authenticated requests. Remaining requests are identified as suspicious requests. The suspicious requests are grouped into request groups based on respective geolocation information. A first rate of requests is determined for a first request group. In response to determining that the first rate of requests is less than or equal to a request rate threshold, parameters of a first suspicious request of the first request group are analyzed to determining values of the parameters. In response to determining that the values of the parameters are not within respective acceptable parameter value ranges, the first suspicious request is analyzed using a neural network to identify if the first suspicious request is legitimate or malicious. In response to identifying that the first suspicious request is malicious, a first notification indicating that the first suspicious request is identified as malicious is send.

TECHNICAL FIELD

The present disclosure relates generally to network security, and more specifically to a system and method for network intrusion detection using a neural network implemented by a local computing system.

BACKGROUND

Cloud computing is rapidly adopted because of its ability to reduce a cost of information technology infrastructure and increase flexibility and scalability of computer processing. Despite many benefits of cloud computing, issues related to security, data protection and data privacy still exist when large scale network traffic is processed by a cloud computing system.

SUMMARY

The system described in the present disclosure provides several practical applications and technical advantages that overcome the current technical problems with the network security.

In general, a system for network intrusion detection using a neural network implemented by a local computing system includes a network intrusion detection system communicatively coupled to a service provider system via a network. The network intrusion detection system is a local computing system or a stand-alone computing system. The service provider server may include a data storage system, a web server, a cloud computing system that hosts micro applications, or any other computing system that is configured to provide desired service to users. The network intrusion detection system is configured to intercept various incoming requests directed to the service provider system for a desired duration and analyzes the requests to determine if the requests are legitimate or malicious. The incoming requests may be received from one or more authenticated users/respective user devices or one or more malicious users/respective user devices. The network intrusion detection system is configured to identify authenticated requests that originate from one or more authenticated users and forwards them to the service provider system for further processing. The network intrusion detection system identifies remaining requests as suspicious requests. The network intrusion detection system is configured to analyze geolocation information and a request rate of the suspicious requests to identify malicious requests. The network intrusion detection system is further configured to implement a neural network module that is configured to analyze parameter values of each remaining suspicious request and identify each suspicious request as legitimate or malicious. The network intrusion detection system is further configured to forward legitimate requests to the service provider system and prevent malicious requests from reaching the service provider system. The network intrusion detection system is further configured to send notifications to a network administrator when malicious requests are identified.

In general, a system network intrusion detection using a neural network implemented by a cloud computing system includes a network intrusion detection system communicatively coupled to a service provider system via a network. The network intrusion detection system is a could computing system that includes a plurality of nodes. Each node is configured to implement a neural network module and store a block list that includes a list of parameter values that are associated with parameters of malicious requests. The service provider server may include a data storage system, a web server, a cloud computing system that hosts micro applications, or any other computing system that is configured to provide desired service to users. A node of the network intrusion detection system is configured to intercept various incoming requests directed to the service provider system from a respective geographical region for a desired duration and analyzes the requests to determine if the requests are legitimate or malicious. The incoming requests may be received from one or more authenticated users/respective user devices or one or more malicious users/respective user devices. The node is configured to identify authenticated requests that originate from one or more authenticated users and forwards them to the service provider system for further processing. The node identifies remaining requests as suspicious requests. The node is configured to analyze geolocation information and a request rate of the suspicious requests to identify malicious requests. The node is further configured to implement the neural network module that is configured to analyze parameter values of each remaining suspicious request and identify each suspicious request as legitimate or malicious. The node is further configured add parameter values of suspicious requests that have been identified as malicious to the block list and synchronize the block list across other nodes of the intrusion detection system. The node is further configured to forward legitimate requests to the service provider system and prevent malicious requests from reaching the service provider system and send notifications to a network administrator when malicious requests are identified.

The present disclosure provides various advantages. By providing notifications to a network administrator, a network intrusion detection system allows for early detection of network intrusions such as, for example, distributed denial-of-service (DDOS) attacks. By preventing malicious requests from reaching a service provider system, the network intrusion detection system prevents network intrusions. This in turn improves network security of the service provider system. Furthermore, in embodiments when the network intrusion detection system is a cloud computing system, even if one or more nodes of the network intrusion detection system are down, intercepted requests may be redirected to operating nodes, which reduces or eliminated downtime of the network intrusion detection system. Accordingly, the following disclosure is particularly integrated into a practical application of improving network security of a computing system such as, for example, a service provider system.

In one embodiment, a system includes a memory and a processor communicatively coupled to the memory. The memory is configured to store a request rate threshold and acceptable parameter value ranges for parameters of a legitimate request. The legitimate request includes a request that originates from an authenticated user. The processor is configured to implement a neural network module. The processor is configured to intercept a plurality of requests directed to a service provider system for a first duration and analyze the plurality of requests to identify authenticated requests from the plurality of requests. Each request includes a request for a service from the service provider system. The authenticated requests originate from one or more authenticated users. The processor is further configured to identify remaining requests as suspicious requests, analyze each suspicious request to determine respective geolocation information of a respective location from which each suspicious request originates, and group the suspicious requests into a plurality of request groups based on the determined geolocation information. A first request group is associated with a first geolocation information and includes a first plurality of suspicious requests associated with the first geolocation information. A second request group is associated with a second geolocation information and includes a second plurality of suspicious requests associated with the second geolocation information. The second geolocation information is different from the first geolocation information. The processor is further configured to determine a first rate of requests for the first request group and determine a second rate of requests for the second request group. In response to determining that the first rate of requests for the first request group is less than or equal to the request rate threshold, the processor is further configured to analyze parameters of a first suspicious request of the first request group to determine values of the parameters of the first suspicious request. In response to determining that the values of the parameters of the first suspicious request is not within respective acceptable parameter value ranges, the processor is further configured to analyze the first suspicious request using the neural network module to identify if the first suspicious request is legitimate or malicious. In response to identifying that the first suspicious request is malicious, the processor is further configured to send a first notification that the first suspicious request is identified as malicious.

In another embodiment, a system includes a plurality of nodes. A first node includes a memory and a processor communicatively coupled to the memory. The memory is configured to store a request rate threshold and a block list. The block list includes a list of malicious parameter values associated with parameters of malicious requests. A malicious request includes a request that originates from a malicious user. The processor is configured to implement a neural network module. The processor is further configured to intercept a plurality of requests directed to a service provider system from a respective geographical region for a first duration and analyze the plurality of requests to identify authenticated requests from the plurality of requests. Each request includes a request for a service from the service provider system. The authenticated requests originate from one or more authenticated users. The processor is further configured to identify remaining requests as suspicious requests, analyze each suspicious request to determine respective geolocation information of a respective location from which each suspicious request originates, and group the suspicious requests into a plurality of request groups based on the determined geolocation information. A first request group is associated with a first geolocation information and includes a first plurality of suspicious requests associated with the first geolocation information. A second request group is associated with a second geolocation information and includes a second plurality of suspicious requests associated with the second geolocation information. The second geolocation information is different from the first geolocation information. The processor is further configured to determine a first rate of requests for the first request group and determine a second rate of requests for the second request group. In response to determining that the first rate of requests for the first request group is less than or equal to the request rate threshold, the processor is further configured to analyze parameters of a first suspicious request of the first request group to determine values of the parameters of the first suspicious request. In response to determining that the value of the parameters of the first suspicious request do not match with respective malicious parameter values, the processor is further configured to analyze the first suspicious request using the neural network module to identify if the first suspicious request is legitimate or malicious. In response to identifying that the first suspicious request is malicious, the processor is further configured to send a first notification that the first suspicious request is identified as malicious, add the values of the parameters of the first suspicious request to the block list, and synchronize the block list with other nodes of the plurality of nodes.

DETAILED DESCRIPTION

As described above, previous technologies fail to provide efficient and reliable solutions for the network security. Embodiments of the present disclosure and its advantages may be understood by referring toFIGS.1,2A,2B,3,4A, and4B.FIGS.1,2A, and2Bare used to describe a system and method for network intrusion detection using a neural network implemented by a local computing system.FIGS.3,4A, and4Bare used to describe a system and method for network intrusion detection using a neural network implemented by a cloud computing system.

System for Network Intrusion Detection Using a Neural Network Implemented by a Local Computing System

System Overview

FIG.1illustrates an embodiment of a system100that is generally configured for network intrusion detection using a neural network implemented by a local computing system. In certain embodiments, the system100comprises a network intrusion detection system118that is operably coupled to one or more user devices106of one or more users104and a service provider system154via a network102. Network102enables the communication between the components of the system100. The service provider system154is configured to received one or more requests from users and provide respective services to the users based on the requests. The service provider system154may comprise a data storage system, a web hosting system, a cloud computing system hosting micro application, or any other computing system configured to provide desired services to users. In the illustrated embodiment, the network intrusion detection system118is a local computing system or a stand-alone computing system that is configured to implement a neural network module122. In other embodiments, the system100may not have all the components listed and/or may have other elements instead of, or in addition to, those listed above. For example, the network intrusion detection system118may be integrated into the service provider system154.

In general, network intrusion detection system118intercepts a plurality of requests (e.g., requests108and/or114) directed to service provider system154for a desired duration132, analyzes the requests (e.g., requests108and/or114) to identify authenticated requests134from the requests (e.g., requests108and/or114), and forwards authenticated requests134to service provider system154for further processing.

Network intrusion detection system118identifies remaining ones of requests (e.g., requests108and/or114) as suspicious requests136and analyzes each of suspicious requests136to determine respective geolocation information140. Each of suspicious requests136comprises parameters110and respective parameters values138.

Network intrusion detection system118groups suspicious requests136into request groups142based on the determined geolocation information140, determines a request rate144for each of request groups142, and determines if a request rate144of a request group (e.g., respective one of request groups142) is greater than a request rate threshold146.

In response to determining that request rate144of the request group (e.g., respective one of request groups142) is greater than request rate threshold146, network intrusion detection system118identifies the request group (e.g., respective one of request groups142) as malicious and sends a notification152that the request group (e.g., respective one of request groups142) is identified as malicious.

In response to determining that request rate144of the request group (e.g., respective one of request groups142) is less than or equal to request rate threshold146, network intrusion detection system118analyzes parameters110of a suspicious request (e.g., respective one of suspicious requests136) of the request group (e.g., respective one of request groups142) to determine parameter values138of parameters110of the suspicious request (e.g., respective one of suspicious requests136).

Network intrusion detection system118determines if the suspicious request (e.g., respective one of suspicious requests136) is a legitimate request150. In response to determining that the suspicious request (e.g., respective one of suspicious requests136) is legitimate request150, network intrusion detection system118updates acceptable parameter value ranges148based on parameter values138of parameters110of the suspicious request (e.g., respective one of suspicious requests136).

In response to determining that the suspicious request (e.g., respective one of suspicious requests136) is not a legitimate request150, network intrusion detection system118sends a notification152that the suspicious request (e.g., respective one of suspicious requests136) is identified as malicious.

In response to determining that parameter values138of parameters110of the suspicious request (e.g., respective one of suspicious requests136) are within respective acceptable parameter value ranges148, network intrusion detection system118identifies the suspicious request (e.g., respective one of suspicious requests136) as a legitimate request150and forwards legitimate request150to service provider system154for further processing.

Network intrusion detection system118performs the above-described operations for all suspicious requests (e.g., suspicious requests136) of all request groups (e.g., request groups142). Network intrusion detection system118determines if a request174to end the network intrusion detection process is received. Network intrusion detection system118performs the above-described operations until the request174to end the network intrusion detection process is received.

By providing notifications152to a network administrator, network intrusion detection system118allows for early detection of network intrusions such as, for example, distributed denial-of-service (DDOS) attacks. By preventing malicious requests from reaching service provider system154, the network intrusion detection system118prevents network intrusions. This in turn improves network security of the service provider system154.

System Components

Network

Network102may be any suitable type of wireless and/or wired network. Network102may or may not be connected to the Internet or public network. Network102may include all or a portion of an Intranet, a peer-to-peer network, a switched telephone network, a local area network (LAN), a wide area network (WAN), a metropolitan area network (MAN), a personal area network (PAN), a wireless PAN (WPAN), an overlay network, a software-defined network (SDN), a virtual private network (VPN), a mobile telephone network (e.g., cellular networks, such as 4G or 5G), a plain old telephone (POT) network, a wireless data network (e.g., WiFi, WiGig, WiMax, etc.), a long-term evolution (LTE) network, a universal mobile telecommunications system (UMTS) network, a peer-to-peer (P2P) network, a Bluetooth network, a near field communication (NFC) network, and/or any other suitable network. Network102may be configured to support any suitable type of communication protocol as would be appreciated by one of ordinary skill in the art.

User Device

The user device106is generally any device that is configured to process data and interact with the user104. Examples of the user device106include, but are not limited to, a personal computer, a desktop computer, a workstation, a server, a laptop, a tablet computer, a mobile phone (such as a smartphone), a virtual reality headset, etc. The user device106may include a user interface, such as a display, a microphone, keypad, or other appropriate terminal equipment usable by the user104. The user device106may include a hardware processor, memory, and/or circuitry (not explicitly shown) configured to perform any of the functions or actions of the user device106described herein. For example, software applications designed using software code may be stored in the memory and executed by the processor to perform the functions of the user device106. The user device106is configured to communicate with other components of the system100via the network102.

In operation, user device106of user104sends requests108to service provider system154that are intercepted by network intrusion detection system118. In certain embodiments when user104is an authenticated user, requests108are identified as authenticated requests134. Network intrusion detection system118forwards authenticated requests134to service provider system154for further processing. In other embodiments when user104is a malicious user, requests108are identified as malicious. Network intrusion detection system118does not forward requests108that are identified as malicious to service provider system154.

Network Intrusion Detection System

The network intrusion detection system118is generally any device that is configured to process data and communicate with other components of the system100via the network102. The network intrusion detection system118may comprise a processor120in signal communication with a memory126and a network interface124.

Processor120comprises one or more processors operably coupled to the memory126. Processor120is any electronic circuitry, including, but not limited to, state machines, one or more central processing unit (CPU) chips, logic units, cores (e.g., a multi-core processor), field-programmable gate array (FPGAs), application-specific integrated circuits (ASICs), or digital signal processors (DSPs). Processor120may be a programmable logic device, a microcontroller, a microprocessor, or any suitable combination of the preceding. The one or more processors are configured to process data and may be implemented in hardware or software. For example, processor120may be 8-bit, 16-bit, 32-bit, 64-bit, or of any other suitable architecture. The one or more processors are configured to implement various software instructions to perform the operations described herein. For example, the one or more processors are configured to execute software instructions128and perform one or more functions described herein. In certain embodiments, processor120is further configured to execute one or more neural network algorithms130and implement a neural network module122.

Network interface124is configured to enable wired and/or wireless communications (e.g., via network102). Network interface124is configured to communicate data between the network intrusion detection system118and other components of the system100. For example, network interface124may comprise a WIFI interface, a local area network (LAN) interface, a wide area network (WAN) interface, a modem, a switch, or a router. Processor120is configured to send and receive data using network interface124. Network interface124may be configured to use any suitable type of communication protocol as would be appreciated by one of ordinary skill in the art.

Memory126comprises a non-transitory computer-readable medium such as one or more disks, tape drives, or solid-state drives, and may be used as an over-flow data storage device, to store programs when such programs are selected for execution, and to store instructions and data that are read during program execution. Memory126may be volatile or non-volatile and may comprise a read-only memory (ROM), random-access memory (RAM), ternary content-addressable memory (TCAM), dynamic random-access memory (DRAM), and static random-access memory (SRAM). Memory126may be implemented using one or more disks, tape drives, solid-state drives, and/or the like. Memory126may store any of the information described inFIGS.1,2A, and2Balong with any other data, instructions, logic, rules, or code operable to implement the function(s) described herein. Memory126is operable to store software instructions128, one or more neural network algorithms130, and/or any other data and instructions. Software instructions128may comprise any suitable set of software instructions, logic, rules, or code operable to be executed by processor120. One or more neural network algorithms130may comprise a Hoeffding tree algorithm, a Hoeffding adaptive tree algorithm, an extremely fast decision tree algorithm, a Kohonen network algorithm, or other suitable algorithms. One or more neural network algorithms130when executed by processor120, cause processor120to implement neural network module122.

In operation, processor120of network intrusion detection system118receives a plurality of known legitimate requests166and a plurality of known malicious requests170. Known legitimate requests166comprise requests that originate from legitimate users, such as authenticated users, for example. Known malicious requests170comprise requests that originate from malicious users. Each of known legitimate requests166comprises parameters110and respective parameter values168. Each of known malicious requests170comprises parameters110and respective parameter values172. In certain embodiments, known legitimate requests166and known malicious requests170are network packets, such as TCP/IP packets. In such embodiments, parameters110are TCP/IP packet parameters.

Processor120of network intrusion detection system118trains neural network module122by using known legitimate requests166and known malicious requests170as a training set. In certain embodiments, the training process comprises executing one or more neural network algorithms130. In certain embodiments, the training process may also determine respective acceptable parameter value ranges148based on parameter values168of parameters110of known legitimate requests166.

Processor120of network intrusion detection system118intercepts a plurality of requests (e.g., requests108and/or114) directed to service provider system154for a desired duration132. Each request comprises a request for a service from the service provider system154. In certain embodiments, requests108and114are network packets, such as TCP/IP packets. In such embodiments, parameters110are TCP/IP packet parameters.

Processor120of network intrusion detection system118analyzes the requests (e.g., requests108and/or114) to identify authenticated requests134from the requests (e.g., requests108and/or114). In certain embodiments when user104is an authenticated user of service provider system154, authenticated requests134comprise requests108originated from user device106of user104. In other embodiments when user104is a malicious user, authenticated requests134may comprise one or more of requests114. Processor120of network intrusion detection system118forwards authenticated requests134to service provider system154for further processing.

Processor120of network intrusion detection system118identifies remaining ones of requests (e.g., requests108and/or114) as suspicious requests136. Each of suspicious requests136comprises parameters110and respective parameters values138. Processor120of network intrusion detection system118analyzes each of suspicious requests136to determine respective geolocation information140. Each geolocation information140comprises an information for a location from which a respective one of suspicious requests136originates. For example, geolocation information140may comprise an IP address, or other information that identifies the location.

Processor120of network intrusion detection system118groups suspicious requests136into request groups142based on the determined geolocation information140. Each of request groups142is associated with a respective geolocation information and comprises a subset of suspicious requests136associated with the respective geolocation information. For example, the subset of suspicious requests136are requests that either originate from a same IP address or originate from different IP addresses that are geographically proximate to each other.

Processor120of network intrusion detection system118determines a request rate144for each of request groups142. Processor120of network intrusion detection system118determines if a request rate144of a request group (e.g., respective one of request groups142) is greater than a request rate threshold146.

In response to determining that request rate144of the request group (e.g., respective one of request groups142) is greater than request rate threshold146, processor120of network intrusion detection system118identifies the request group (e.g., respective one of request groups142) as malicious and sends a notification152that the request group (e.g., respective one of request groups142) is identified as malicious. In certain embodiments, processor120of network intrusion detection system118sends the notification152to a device of a network administrator.

In response to determining that request rate144of the request group (e.g., respective one of request groups142) is less than or equal to request rate threshold146, processor120of network intrusion detection system118analyzes parameters110of a suspicious request (e.g., respective one of suspicious requests136) of the request group (e.g., respective one of request groups142) to determine parameter values138of parameters110of the suspicious request (e.g., respective one of suspicious requests136).

Processor120of network intrusion detection system118determines if the suspicious request (e.g., respective one of suspicious requests136) is a legitimate request150. In response to determining that the suspicious request (e.g., respective one of suspicious requests136) is legitimate request150, processor120of network intrusion detection system118updates acceptable parameter value ranges148based on parameter values138of parameters110of the suspicious request (e.g., respective one of suspicious requests136).

In response to determining that the suspicious request (e.g., respective one of suspicious requests136) is not a legitimate request150, processor120of network intrusion detection system118sends a notification152that the suspicious request (e.g., respective one of suspicious requests136) is identified as malicious. In certain embodiments, processor120of network intrusion detection system118sends the notification152to a device of a network administrator.

In response to determining that parameter values138of parameters110of the suspicious request (e.g., respective one of suspicious requests136) are within respective acceptable parameter value ranges148, processor120of network intrusion detection system118identifies the suspicious request (e.g., respective one of suspicious requests136) as a legitimate request150and forwards legitimate request150to service provider system154.

Processor120of network intrusion detection system118performs the above-described operations for all suspicious requests (e.g., suspicious requests136) of all request groups (e.g., request groups142). Processor120of network intrusion detection system118determines if a request174to end the network intrusion detection process is received. In certain embodiments, the request174to end the network intrusion detection process may be received from a device of a network administrator. Processor120of network intrusion detection system118performs the above-described operations until the request174to end the network intrusion detection process is received.

Service Provider System

The service provider system154is generally any device that is configured to process data and communicate with other components of system100via network102. In the illustrated embodiment, service provider system154comprises a data storage system. In other embodiments, service provider system154may comprise a web hosting system, a cloud computing system hosting micro application, or any other computing system configured to provide desired services to users. Service provider system154may comprise a processor156in signal communication with a memory160and a network interface158.

Processor156comprises one or more processors operably coupled to memory160. Processor156is any electronic circuitry, including, but not limited to, state machines, one or more central processing unit (CPU) chips, logic units, cores (e.g., a multi-core processor), field-programmable gate array (FPGAs), application-specific integrated circuits (ASICs), or digital signal processors (DSPs). Processor156may be a programmable logic device, a microcontroller, a microprocessor, or any suitable combination of the preceding. The one or more processors are configured to process data and may be implemented in hardware or software. For example, processor156may be 8-bit, 16-bit, 32-bit, 64-bit, or of any other suitable architecture. The one or more processors are configured to implement various software instructions to perform the operations described herein. For example, the one or more processors are configured to execute software instructions162and perform one or more functions described herein.

Network interface158is configured to enable wired and/or wireless communications (e.g., via network102). Network interface158is configured to communicate data between service provider system154and other components of system100. For example, network interface158may comprise a WIFI interface, a local area network (LAN) interface, a wide area network (WAN) interface, a modem, a switch, or a router. Processor156is configured to send and receive data using network interface158. Network interface158may be configured to use any suitable type of communication protocol as would be appreciated by one of ordinary skill in the art.

Memory160comprises a non-transitory computer-readable medium such as one or more disks, tape drives, or solid-state drives, and may be used as an over-flow data storage device, to store programs when such programs are selected for execution, and to store instructions and data that are read during program execution. Memory160may be volatile or non-volatile and may comprise a read-only memory (ROM), random-access memory (RAM), ternary content-addressable memory (TCAM), dynamic random-access memory (DRAM), and static random-access memory (SRAM). Memory160may be implemented using one or more disks, tape drives, solid-state drives, and/or the like. Memory160may store any of the information described inFIGS.1,2A, and2Balong with any other data, instructions, logic, rules, or code operable to implement the function(s) described herein. Memory160is operable to store software instructions162and/or any other data and instructions. Software instructions162may comprise any suitable set of software instructions, logic, rules, or code operable to be executed by processor120. Memory160may be further operable to store a database164that comprises various data items used by service provider system154to provide desired services to users.

In operation, processor156of service provider system154receives authenticated requests134and legitimate requests150from network intrusion detection system118. Network intrusion detection system118prevents suspicious requests136that have been identified as malicious from reaching service provider system154.

Example Method for Network Intrusion Detection Using a Neural Network Implemented by a Local Computing System

FIGS.2A and2Billustrate an example flowchart of a method200for network intrusion detection using a neural network implemented by a local computing system. Modifications, additions, or omissions may be made to method200. Method200may include more, fewer, or other operations. For example, operations may be performed in parallel or in any suitable order. For example, one or more operations of method200may be implemented, at least in part, in the form of software instructions (e.g., instructions128,162, and/or one or more neural network algorithms130ofFIG.1), stored on non-transitory, tangible, computer-readable medium (e.g., memories126and/or160ofFIG.1) that when executed by one or more processors (e.g., processors120and/or156ofFIG.1) may cause the one or more processors to perform operations202-246.

Method200starts with operation202, where processor120of network intrusion detection system118receives a plurality of known legitimate requests166and a plurality of known malicious requests170. Known legitimate requests166comprise requests that originate from legitimate users, such as authenticated users, for example. Known malicious requests170comprise requests that originate from malicious users. Each of known legitimate requests166comprises parameters110and respective parameter values168. Each of known malicious requests170comprises parameters110and respective parameter values172. In certain embodiments, known legitimate requests166and known malicious requests170are network packets, such as TCP/IP packets. In such embodiments, parameters110are TCP/IP packet parameters.

At operation204, processor120of network intrusion detection system118trains neural network module122by using known legitimate requests166and known malicious requests170as a training set. In certain embodiments, the training process comprises executing one or more neural network algorithms130. One or more neural network algorithms130may comprise a Hoeffding tree algorithm, a Hoeffding adaptive tree algorithm, an extremely fast decision tree algorithm, a Kohonen network algorithm, or other suitable algorithms. In certain embodiments, the training process may also determine respective acceptable parameter value ranges148based on parameter values168of parameters110of known legitimate requests166.

At operation206, processor120of network intrusion detection system118intercepts a plurality of requests (e.g., requests108and/or114ofFIG.1) directed to service provider system154for a desired duration132. Each request comprises a request for a service from the service provider system154. In certain embodiments, requests108and114are network packets, such as TCP/IP packets. In such embodiments, parameters110are TCP/IP packet parameters.

At operation208, processor120of network intrusion detection system118analyzes the requests (e.g., requests108and/or114ofFIG.1) to identify authenticated requests134from the requests (e.g., requests108and/or114ofFIG.1). In certain embodiments when user104is an authenticated user of service provider system154, authenticated requests134comprise requests108originated from user device106of user104. In other embodiments when user104is a malicious user, authenticated requests134may comprise one or more of requests114.

At operation212, processor120of network intrusion detection system118identifies remaining ones of requests (e.g., requests108and/or114ofFIG.1) as suspicious requests136. Each of suspicious requests136comprises parameters110and respective parameters values138.

At operation214, processor120of network intrusion detection system118analyzes each of suspicious requests136to determine respective geolocation information140. Each geolocation information140comprises an information for a location from which a respective one of suspicious requests136originates. For example, geolocation information140may comprise an IP address, or other information that identifies the location.

At operation216, processor120of network intrusion detection system118groups suspicious requests136into request groups142based on the determined geolocation information140. Each of request groups142is associated with a respective geolocation information and comprises a subset of suspicious requests136associated with the respective geolocation information. For example, the subset of suspicious requests136are requests that either originate from a same IP address or originate from different IP addresses that are geographically proximate to each other.

At operation218, processor120of network intrusion detection system118determines a request rate144for each of request groups142.

At operation220, processor120of network intrusion detection system118determines if a request rate144of a request group (e.g., respective one of request groups142ofFIG.1) is greater than a request rate threshold146.

In response to determining at operation220that request rate144of the request group (e.g., respective one of request groups142ofFIG.1) is greater than request rate threshold146, method200continues to operation222. At operation222, processor120of network intrusion detection system118identifies the request group (e.g., respective one of request groups142ofFIG.1) as malicious.

At operation224, processor120of network intrusion detection system118sends a notification152that the request group (e.g., respective one of request groups142ofFIG.1) is identified as malicious. In certain embodiments, processor120of network intrusion detection system118sends the notification152to a device of a network administrator. After performing operation224, method200continues to operation244.

In response to determining at operation220that request rate144of the request group (e.g., respective one of request groups142ofFIG.1) is less than or equal to request rate threshold146, method200continues to operation226. At operation226, processor120of network intrusion detection system118analyzes parameters110of a suspicious request (e.g., respective one of suspicious requests136ofFIG.1) of the request group (e.g., respective one of request groups142ofFIG.1) to determine parameter values138of parameters110of the suspicious request (e.g., respective one of suspicious requests136ofFIG.1).

In response to determining at operation228that parameter values138of parameters110of the suspicious request (e.g., respective one of suspicious requests136ofFIG.1) are not within respective acceptable parameter value ranges148, method200continues to operation230. At operation230, processor120of network intrusion detection system118analyzes the suspicious request (e.g., respective one of suspicious requests136ofFIG.1) using neural network module122to identify if the suspicious request (e.g., respective one of suspicious requests136ofFIG.1) is legitimate or malicious.

At operation232, processor120of network intrusion detection system118determines if the suspicious request (e.g., respective one of suspicious requests136ofFIG.1) is a legitimate request150.

In response to determining at operation232that the suspicious request (e.g., respective one of suspicious requests136ofFIG.1) is legitimate request150, method200continues to operation234. At operation234, processor120of network intrusion detection system118updates acceptable parameter value ranges148based on parameter values138of parameters110of the suspicious request (e.g., respective one of suspicious requests136ofFIG.1). After performing operation234, method200continues to operation238.

In response to determining at operation232that the suspicious request (e.g., respective one of suspicious requests136ofFIG.1) is not a legitimate request150, method200continues to operation236. At operation236, processor120of network intrusion detection system118sends a notification152that the suspicious request (e.g., respective one of suspicious requests136ofFIG.1) is identified as malicious. In certain embodiments, processor120of network intrusion detection system118sends the notification152to a device of a network administrator. After performing operation236, method200continues to operation242.

In response to determining at operation228that parameter values138of parameters110of the suspicious request (e.g., respective one of suspicious requests136ofFIG.1) are within respective acceptable parameter value ranges148or after performing operation234, method200continues to operation238. At operation238, processor120of network intrusion detection system118identifies the suspicious request (e.g., respective one of suspicious requests136ofFIG.1) as a legitimate request150.

After performing operations236or240, method200continues to operation242. At operation242, processor120of network intrusion detection system118determines if all suspicious requests (e.g., respective ones of suspicious requests136ofFIG.1) of the request group (e.g., respective one of request groups142ofFIG.1) are analyzed.

In response to determining at operation242that all suspicious requests (e.g., respective ones of suspicious requests136ofFIG.1) of the request group (e.g., respective one of request groups142ofFIG.1) are not analyzed, method200continues to operation226. In certain embodiments, operations226through242are performed one or more times until all suspicious requests (e.g., respective ones of suspicious requests136ofFIG.1) of the request group (e.g., respective one of request groups142ofFIG.1) are analyzed.

In response to determining at operation242that all suspicious requests (e.g., respective ones of suspicious requests136ofFIG.1) of the request group (e.g., respective one of request groups142ofFIG.1) are analyzed or after performing operation224, method200continues to operation244. At operation244, processor120of network intrusion detection system118determines if all request groups (e.g., request groups142ofFIG.1) are analyzed.

In response to determining at operation244that all request groups (e.g., request groups142ofFIG.1) are not analyzed, method200continues to operation220. In certain embodiments, operations220through244are performed one or more times until all request groups (e.g., request groups142ofFIG.1) are analyzed.

In response to determining at operation244that all request groups (e.g., request groups142ofFIG.1) are analyzed, method200continues to operation246. At operation246, processor120of network intrusion detection system118determines if a request174to end the network intrusion detection process is received. In certain embodiments, the request174to end the network intrusion detection process may be received from a device of a network administrator.

In response to determining at operation246that the request174to end the network intrusion detection process is not received, method200continues to operation206. In certain embodiments, operations206through246are performed one or more times until the request174to end the network intrusion detection process is received. In response to determining at operation246that the request174to end the network intrusion detection process is received, method200ends.

System for Network Intrusion Detection Using a Neural Network Implemented by a Cloud Computing System

System Overview

FIG.3illustrates an embodiment of a system300that is generally configured for network intrusion detection using a neural network implemented by a cloud computing system. In certain embodiments, the system300comprises a network intrusion detection system302that is operably coupled to one or more user devices106of one or more users104and a service provider system154via a network102. Network102enables the communication between the components of the system300. The service provider system154is configured to receive one or more requests from users and provide respective services based on the requests. The service provider system154may comprise a data storage system, a web hosting system, a cloud computing system hosting micro application, or any other computing system configured to provide desired services to users. In the illustrated embodiment, the network intrusion detection system302is a cloud computing system comprising a plurality of nodes304-1through304-m, where each of the nodes304-1through304-mis configured to implement a neural network module308. In certain embodiments, each of the nodes304-1through304-mis configured to intercept a plurality of requests directed to service provider system154from a respective geographical region. Furthermore, even if one or more nodes of network intrusion detection system302are down, the requests may be redirected to operating nodes of network intrusion detection system302. In other embodiments, system300may not have all the components listed and/or may have other elements instead of, or in addition to, those listed above.

In general, a node (e.g., node304-1) of network intrusion detection system302intercepts a plurality of requests (e.g., requests108and/or114) directed to service provider system154from a respective geographical region for a desired duration322, analyzes the requests (e.g., requests108and/or114) to identify authenticated requests324from the requests (e.g., requests108and/or114), and forwards authenticated requests324to service provider system154for further processing.

The node (e.g., node304-1) of network intrusion detection system302identifies remaining ones of requests (e.g., requests108and/or114) as suspicious requests326. Each of suspicious requests326comprises parameters110and respective parameters values328. The node (e.g., node304-1) of network intrusion detection system302analyzes each of suspicious requests326to determine respective geolocation information330and groups suspicious requests326into request groups332based on the determined geolocation information330.

The node (e.g., node304-1) of network intrusion detection system302determines a request rate334for each of request groups332and determines if a request rate334of a request group (e.g., respective one of request groups332) is greater than a request rate threshold336. In response to determining that request rate334of the request group (e.g., respective one of request groups332) is greater than request rate threshold336, the node (e.g., node304-1) of network intrusion detection system302identifies the request group (e.g., respective one of request groups332) as malicious and sends a notification152that the request group (e.g., respective one of request groups332) is identified as malicious.

In response to determining that request rate334of the request group (e.g., respective one of request groups332) is less than or equal to request rate threshold336, the node (e.g., node304-1) of network intrusion detection system302analyzes parameters110of a suspicious request (e.g., respective one of suspicious requests326) of the request group (e.g., respective one of request groups332) to determine parameter values328of parameters110of the suspicious request (e.g., respective one of suspicious requests326) and determines if at least one of parameter values328of parameters110of the suspicious request (e.g., respective one of suspicious requests326) matches with a respective malicious parameter value (e.g., respective one of malicious parameter values) from a block list (e.g., block list316-1) that is stored in the node (e.g., node304-1) of network intrusion detection system302.

In response to determining that parameter values328of parameters110of the suspicious request (e.g., respective one of suspicious requests326) do not match with respective malicious parameter values (e.g., malicious parameter values318-1), the node (e.g., node304-1) of network intrusion detection system302analyzes the suspicious request (e.g., respective one of suspicious requests326) using neural network module308to identify if the suspicious request (e.g., respective one of suspicious requests326) is legitimate or malicious.

The node (e.g., node304-1) of network intrusion detection system302determines if the suspicious request (e.g., respective one of suspicious requests326) is malicious. In response to determining that the suspicious request (e.g., respective one of suspicious requests326) is not malicious, the node (e.g., node) of network intrusion detection system302identifies the suspicious request (e.g., respective one of suspicious requests326ofFIG.3) as a legitimate request338and forwards legitimate request338to service provider system154for further processing.

In response to determining that at least one of parameter values328of parameters110of the suspicious request (e.g., respective one of suspicious requests326) matches with a respective malicious parameter value (e.g., respective one of malicious parameter values318-1), the node (e.g., node304-1) of network intrusion detection system302identifies the suspicious request (e.g., respective one of suspicious requests326) as malicious and sends a notification152that the suspicious request (e.g., respective one of suspicious requests326) is identified as malicious.

The node (e.g., node304-1) of network intrusion detection system302synchronizes that block list (e.g., block list316-1) with block lists (e.g., rest of block lists316-1through316-m) of other nodes (e.g., rest of nodes304-1through304-m) of network intrusion detection system302. The node (e.g., node304-1) of network intrusion detection system302determines if a request174to end the network intrusion detection process is received and performs the above-described operations until the request174to end the network intrusion detection process is received.

By providing notifications152to a network administrator, network intrusion detection system302allows for early detection of network intrusions such as, for example, distributed denial-of-service (DDOS) attacks. By preventing malicious requests from reaching service provider system154, the network intrusion detection system302prevents network intrusions. This in turn improves network security of the service provider system154. Furthermore, even if one or more nodes of the network intrusion detection system302are down, intercepted requests may be redirected to operating nodes, which reduces or eliminated downtime of the network intrusion detection system302.

Network

Network102has been described in detail with reference toFIG.1and the description is not repeated herein.

User Device

The user device106has been described in detail with reference toFIG.1and the description is not repeated herein. In operation, user device106of user104sends requests108to service provider system154that are intercepted by network intrusion detection system302. In certain embodiments when user104is an authenticated user, requests108are identified as authenticated requests324. Network intrusion detection system302forwards authenticated requests324to service provider system154for further processing. In other embodiments when user104is a malicious user, requests108are identified as malicious. Network intrusion detection system302does not forward requests108that are identified as malicious to service provider system154.

Network Intrusion Detection System

The network intrusion detection system302is generally any device that is configured to process data and communicate with other components of the system300via the network102. In the illustrated embodiment, the network intrusion detection system302is a cloud computing system comprising a plurality of nodes304-1through304-m. Each of the nodes304-1through304-mis configured to implement a neural network module308. Each of the nodes304-1through304-mis generally any device that is configured to process data and communicate with other components of the system300via the network102. Each of the nodes304-1through304-mcomprises a respective one of processors306-1through306-min signal communication with a respective one of memories312-1through312-mand a respective one of network interfaces310-1through310-m.

Each of processors306-1through306-mmay comprise one or more processors operably coupled to a respective one of memories312-1through312-m. Each of processors306-1through306-mis any electronic circuitry, including, but not limited to, state machines, one or more central processing unit (CPU) chips, logic units, cores (e.g., a multi-core processor), field-programmable gate array (FPGAs), application-specific integrated circuits (ASICs), or digital signal processors (DSPs). Each of processors306-1through306-mmay be a programmable logic device, a microcontroller, a microprocessor, or any suitable combination of the preceding. The one or more processors are configured to process data and may be implemented in hardware or software. For example, each of processors306-1through306-mmay be 8-bit, 16-bit, 32-bit, 64-bit, or of any other suitable architecture. Each of processors306-1through306-mis configured to implement various software instructions. For example, each of processors306-1through306-mis configured to execute a respective one of software instructions314-1through314-mand one or more neural network algorithms320that are stored in a respective one of memories312-1through312-min order to perform the operations described herein.

Each of network interfaces310-1through310-mis configured to enable wired and/or wireless communications (e.g., via network102). Each of network interfaces310-1through310-mis configured to communicate data between a respective one of nodes304-1through304-mand other components of the system300. For example, each of network interfaces310-1through310-mmay comprise a WIFI interface, a local area network (LAN) interface, a wide area network (WAN) interface, a modem, a switch, or a router. Each of network interfaces310-1through310-mmay be configured to use any suitable type of communication protocol as would be appreciated by one of ordinary skill in the art.

Each of memories312-1through312-mcomprises a non-transitory computer-readable medium such as one or more disks, tape drives, or solid-state drives, and may be used as an over-flow data storage device, to store programs when such programs are selected for execution, and to store instructions and data that are read during program execution. Each of memories312-1through312-mmay be volatile or non-volatile and may comprise a read-only memory (ROM), random-access memory (RAM), ternary content-addressable memory (TCAM), dynamic random-access memory (DRAM), and static random-access memory (SRAM). Each of memories312-1through312-mmay be implemented using one or more disks, tape drives, solid-state drives, and/or the like. Each of memories312-1through312-mmay store any of the information described inFIGS.3,4A, and4Balong with any other data, instructions, logic, rules, or code operable to implement the function(s) described herein. Each of memories312-1through312-mis operable to store a respective one of software instructions314-1through314-m, one or more neural network algorithms320, and/or any other data and instructions. Each of software instructions314-1through314-mmay comprise any suitable set of software instructions, logic, rules, or code operable to be executed by a respective one of processors306-1through306-m. One or more neural network algorithms320may comprise a Hoeffding tree algorithm, a Hoeffding adaptive tree algorithm, an extremely fast decision tree algorithm, a Kohonen network algorithm, or other suitable algorithms. One or more neural network algorithms320when executed by a respective one of processors306-1through306-m, cause the respective one of processors306-1through306-mto implement neural network module308.

In operation, a processor (e.g., processor306-1) of a node (e.g., node304-1) of network intrusion detection system302receives a plurality of known legitimate requests166and a plurality of known malicious requests170. Known legitimate requests166comprise requests that originate from legitimate users, such as authenticated users, for example. Known malicious requests170comprise requests that originate from malicious users. Each of known legitimate requests166comprises parameters110and respective parameter values168. Each of known malicious requests170comprises parameters110and respective parameter values172. In certain embodiments, known legitimate requests166and known malicious requests170are network packets, such as TCP/IP packets. In such embodiments, parameters110are TCP/IP packet parameters.

The processor (e.g., processor306-1) of the node (e.g., node304-1) of network intrusion detection system302trains neural network module308by using known legitimate requests166and known malicious requests170as a training set. In certain embodiments, the training process comprises executing one or more neural network algorithms320. In certain embodiments, the training process may also store parameter values172of parameters110of known malicious requests170as malicious parameter values (e.g., malicious parameter values318-1) in a block list (e.g., block list316-1) that is stored in a memory (e.g., memory312-1) of the node (e.g., node) of network intrusion detection system302.

The processor (e.g., processor306-1) of the node (e.g., node304-1) of network intrusion detection system302intercepts a plurality of requests (e.g., requests108and/or114) directed to service provider system154from a respective geographical region for a desired duration322. Each request comprises a request for a service from the service provider system154. In certain embodiments, requests108and114are network packets, such as TCP/IP packets. In such embodiments, parameters110are TCP/IP packet parameters.

The processor (e.g., processor306-1) of the node (e.g., node304-1) of network intrusion detection system302analyzes the requests (e.g., requests108and/or114) to identify authenticated requests324from the requests (e.g., requests108and/or114). In certain embodiments when user104is an authenticated user of service provider system154, authenticated requests324comprise requests108originated from user device106of user104. In other embodiments when user104is a malicious user, authenticated requests324may comprise one or more of requests114. The processor (e.g., processor306-1) of the node (e.g., node304-1) of network intrusion detection system302forwards authenticated requests324to service provider system154for further processing.

The processor (e.g., processor306-1) of the node (e.g., node304-1) of network intrusion detection system302identifies remaining ones of requests (e.g., requests108and/or114) as suspicious requests326. Each of suspicious requests326comprises parameters110and respective parameters values328.

The processor (e.g., processor306-1) of the node (e.g., node304-1) of network intrusion detection system302analyzes each of suspicious requests326to determine respective geolocation information330. Each geolocation information330comprises an information for a location from which a respective one of suspicious requests326originates. For example, geolocation information330may comprise an IP address, or other information that identifies the location.

The processor (e.g., processor306-1) of the node (e.g., node304-1) of network intrusion detection system302groups suspicious requests326into request groups332based on the determined geolocation information330. Each of request groups332is associated with a respective geolocation information and comprises a subset of suspicious requests326associated with the respective geolocation information. For example, the subset of suspicious requests326are requests that either originate from a same IP address or originate from different IP addresses that are geographically proximate to each other.

The processor (e.g., processor306-1) of the node (e.g., node304-1) of network intrusion detection system302determines a request rate334for each of request groups332and determines if a request rate334of a request group (e.g., respective one of request groups332) is greater than a request rate threshold336.

In response to determining that request rate334of the request group (e.g., respective one of request groups332) is greater than request rate threshold336, the processor (e.g., processor306-1) of the node (e.g., node304-1) of network intrusion detection system302identifies the request group (e.g., respective one of request groups332) as malicious and sends a notification152that the request group (e.g., respective one of request groups332) is identified as malicious. In certain embodiments, the processor (e.g., processor306-1) of the node (e.g., node304-1) of network intrusion detection system302sends the notification152to a device of a network administrator.

In response to determining that request rate334of the request group (e.g., respective one of request groups332) is less than or equal to request rate threshold336, the processor (e.g., processor306-1) of the node (e.g., node304-1) of network intrusion detection system302analyzes parameters110of a suspicious request (e.g., respective one of suspicious requests326) of the request group (e.g., respective one of request groups332) to determine parameter values328of parameters110of the suspicious request (e.g., respective one of suspicious requests326) and determines if at least one of parameter values328of parameters110of the suspicious request (e.g., respective one of suspicious requests326) matches with a respective malicious parameter value (e.g., respective one of malicious parameter values) from a block list (e.g., block list316-1) that is stored in the node (e.g., node304-1) of network intrusion detection system302.

In response to determining that parameter values328of parameters110of the suspicious request (e.g., respective one of suspicious requests326) do not match with respective malicious parameter values (e.g., malicious parameter values318-1), the processor (e.g., processor306-1) of the node (e.g., node304-1) of network intrusion detection system302analyzes the suspicious request (e.g., respective one of suspicious requests326) using neural network module308to identify if the suspicious request (e.g., respective one of suspicious requests326) is legitimate or malicious.

The processor (e.g., processor306-1) of the node (e.g., node304-1) of network intrusion detection system302determines if the suspicious request (e.g., respective one of suspicious requests326) is malicious. In response to determining that the suspicious request (e.g., respective one of suspicious requests326) is not malicious, the processor (e.g., processor306-1) of the node (e.g., node) of network intrusion detection system302identifies the suspicious request (e.g., respective one of suspicious requests326ofFIG.3) as a legitimate request338and forwards legitimate request338to service provider system154.

In response to determining that at least one of parameter values328of parameters110of the suspicious request (e.g., respective one of suspicious requests326) matches with a respective malicious parameter value (e.g., respective one of malicious parameter values318-1), the processor (e.g., processor306-1) of the node (e.g., node304-1) of network intrusion detection system302identifies the suspicious request (e.g., respective one of suspicious requests326) as malicious and sends a notification152that the suspicious request (e.g., respective one of suspicious requests326) is identified as malicious. In certain embodiments, the processor (e.g., processor306-1) of the node (e.g., node304-1) of network intrusion detection system302sends the notification152to a device of a network administrator.

The processor (e.g., processor306-1) of the node (e.g., node304-1) of network intrusion detection system302adds parameter values328of parameters110of the suspicious request (e.g., respective one of suspicious requests326) to the block list (e.g., block list316-1). The processor (e.g., processor306-1) of the node (e.g., node304-1) of network intrusion detection system302performs the above-described operations for all suspicious requests (e.g., suspicious requests326) of all request groups (e.g., request groups332).

The processor (e.g., processor306-1) of the node (e.g., node304-1) of network intrusion detection system302synchronizes that block list (e.g., block list316-1) with block lists (e.g., rest of block lists316-1through316-m) of other nodes (e.g., rest of nodes304-1through304-m) of network intrusion detection system302. The processor (e.g., processor306-1) of the node (e.g., node304-1) of network intrusion detection system302determines if a request174to end the network intrusion detection process is received. In certain embodiments, the request174to end the network intrusion detection process may be received from a device of a network administrator. The processor (e.g., processor306-1) of the node (e.g., node304-1) of network intrusion detection system302performs the above-described operations until the request174to end the network intrusion detection process is received.

Service Provider System

The service provider system154has been described in detail with reference toFIG.1and the description is not repeated herein. In operation, processor156of service provider system154receives authenticated requests324and legitimate requests338from network intrusion detection system302. Network intrusion detection system302prevents suspicious requests326that have been identified as malicious from reaching service provider system154.

Example Method for Network Intrusion Detection Using a Neural Network Implemented by a Cloud Computing System

FIGS.4A and4Billustrate an example flowchart of a method400for network intrusion detection using a neural network implemented by a cloud computing system. Modifications, additions, or omissions may be made to method400. Method400may include more, fewer, or other operations. For example, operations may be performed in parallel or in any suitable order. For example, one or more operations of method400may be implemented, at least in part, in the form of software instructions (e.g., instructions314-1through314-m,162, and/or one or more neural network algorithms320ofFIG.3), stored on non-transitory, tangible, computer-readable medium (e.g., memories312-1through312-mand/or160ofFIG.3) that when executed by one or more processors (e.g., processors306-1through306-mand/or156ofFIG.3) may cause the one or more processors to perform operations402-450.

Method400starts with operation402, where a processor (e.g., processor306-1ofFIG.3) of a node (e.g., node304-1ofFIG.3) of network intrusion detection system302receives a plurality of known legitimate requests166and a plurality of known malicious requests170. Known legitimate requests166comprise requests that originate from legitimate users, such as authenticated users, for example. Known malicious requests170comprise requests that originate from malicious users. Each of known legitimate requests166comprises parameters110and respective parameter values168. Each of known malicious requests170comprises parameters110and respective parameter values172. In certain embodiments, known legitimate requests166and known malicious requests170are network packets, such as TCP/IP packets. In such embodiments, parameters110are TCP/IP packet parameters.

At operation404, the processor (e.g., processor306-1ofFIG.3) of the node (e.g., node304-1ofFIG.3) of network intrusion detection system302trains neural network module308by using known legitimate requests166and known malicious requests170as a training set. In certain embodiments, the training process comprises executing one or more neural network algorithms320. One or more neural network algorithms320may comprise a Hoeffding tree algorithm, a Hoeffding adaptive tree algorithm, an extremely fast decision tree algorithm, a Kohonen network algorithm, or other suitable algorithms. In certain embodiments, the training process may also store parameter values172of parameters110of known malicious requests170as malicious parameter values (e.g., malicious parameter values318-1ofFIG.3) in a block list (e.g., block list316-1ofFIG.3) that is stored in a memory (e.g., memory312-1ofFIG.3) of the node (e.g., node304-1ofFIG.3) of network intrusion detection system302.

At operation406, the processor (e.g., processor306-1ofFIG.3) of the node (e.g., node304-1ofFIG.3) of network intrusion detection system302intercepts a plurality of requests (e.g., requests108and/or114ofFIG.3) directed to service provider system154from a respective geographical region for a desired duration322. Each request comprises a request for a service from the service provider system154. In certain embodiments, requests108and114are network packets, such as TCP/IP packets. In such embodiments, parameters110are TCP/IP packet parameters.

At operation408, the processor (e.g., processor306-1ofFIG.3) of the node (e.g., node304-1ofFIG.3) of network intrusion detection system302analyzes the requests (e.g., requests108and/or114ofFIG.3) to identify authenticated requests324from the requests (e.g., requests108and/or114ofFIG.3). In certain embodiments when user104is an authenticated user of service provider system154, authenticated requests324comprise requests108originated from user device106of user104. In other embodiments when user104is a malicious user, authenticated requests324may comprise one or more of requests114.

At operation410, the processor (e.g., processor306-1ofFIG.3) of the node (e.g., node304-1ofFIG.3) of network intrusion detection system302forwards authenticated requests324to service provider system154for further processing.

At operation412, the processor (e.g., processor306-1ofFIG.3) of the node (e.g., node304-1ofFIG.3) of network intrusion detection system302identifies remaining ones of requests (e.g., requests108and/or114ofFIG.3) as suspicious requests326. Each of suspicious requests326comprises parameters110and respective parameters values328.

At operation414, the processor (e.g., processor306-1ofFIG.3) of the node (e.g., node304-1ofFIG.3) of network intrusion detection system302analyzes each of suspicious requests326to determine respective geolocation information330. Each geolocation information330comprises an information for a location from which a respective one of suspicious requests326originates. For example, geolocation information330may comprise an IP address, or other information that identifies the location.

At operation416, the processor (e.g., processor306-1ofFIG.3) of the node (e.g., node304-1ofFIG.3) of network intrusion detection system302groups suspicious requests326into request groups332based on the determined geolocation information330. Each of request groups332is associated with a respective geolocation information and comprises a subset of suspicious requests326associated with the respective geolocation information. For example, the subset of suspicious requests326are requests that either originate from a same IP address or originate from different IP addresses that are geographically proximate to each other.

At operation418, the processor (e.g., processor306-1ofFIG.3) of the node (e.g., node304-1ofFIG.3) of network intrusion detection system302determines a request rate334for each of request groups332.

At operation420, the processor (e.g., processor306-1ofFIG.3) of the node (e.g., node304-1ofFIG.3) of network intrusion detection system302determines if a request rate334of a request group (e.g., respective one of request groups332ofFIG.3) is greater than a request rate threshold336.

In response to determining at operation420that request rate334of the request group (e.g., respective one of request groups332ofFIG.3) is greater than request rate threshold336, method400continues to operation422. At operation422, the processor (e.g., processor306-1ofFIG.3) of the node (e.g., node304-1ofFIG.3) of network intrusion detection system302identifies the request group (e.g., respective one of request groups332ofFIG.3) as malicious.

At operation424, the processor (e.g., processor306-1ofFIG.3) of the node (e.g., node304-1ofFIG.3) of network intrusion detection system302sends a notification152that the request group (e.g., respective one of request groups332ofFIG.3) is identified as malicious. In certain embodiments, the processor (e.g., processor306-1ofFIG.3) of the node (e.g., node304-1of FIG.3) of network intrusion detection system302sends the notification152to a device of a network administrator. After performing operation424, method400continues to operation446.

In response to determining at operation420that request rate334of the request group (e.g., respective one of request groups332ofFIG.3) is less than or equal to request rate threshold336, method400continues to operation426. At operation426, the processor (e.g., processor306-1ofFIG.3) of the node (e.g., node304-1ofFIG.3) of network intrusion detection system302analyzes parameters110of a suspicious request (e.g., respective one of suspicious requests326ofFIG.3) of the request group (e.g., respective one of request groups332ofFIG.3) to determine parameter values328of parameters110of the suspicious request (e.g., respective one of suspicious requests326ofFIG.3).

At operation428, the processor (e.g., processor306-1ofFIG.3) of the node (e.g., node304-1ofFIG.3) of network intrusion detection system302determines if at least one of parameter values328of parameters110of the suspicious request (e.g., respective one of suspicious requests326ofFIG.3) matches with a respective malicious parameter value (e.g., respective one of malicious parameter values318-1ofFIG.3) from a block list (e.g., block list316-1ofFIG.3) that is stored in the node (e.g., node304-1ofFIG.3) of network intrusion detection system302.

In response to determining at operation428that parameter values328of parameters110of the suspicious request (e.g., respective one of suspicious requests326ofFIG.3) do not match with respective malicious parameter values (e.g., malicious parameter values318-1ofFIG.3), method400continues to operation430. At operation430, the processor (e.g., processor306-1ofFIG.3) of the node (e.g., node304-1ofFIG.3) of network intrusion detection system302analyzes the suspicious request (e.g., respective one of suspicious requests326ofFIG.3) using neural network module308to identify if the suspicious request (e.g., respective one of suspicious requests326ofFIG.3) is legitimate or malicious.

At operation432, the processor (e.g., processor306-1ofFIG.3) of the node (e.g., node304-1ofFIG.3) of network intrusion detection system302determines if the suspicious request (e.g., respective one of suspicious requests326ofFIG.3) is malicious.

In response to determining at operation432that the suspicious request (e.g., respective one of suspicious requests326ofFIG.3) is not malicious, method400continues to operation434. At operation434, the processor (e.g., processor306-1ofFIG.3) of the node (e.g., node304-1ofFIG.3) of network intrusion detection system302identifies the suspicious request (e.g., respective one of suspicious requests326ofFIG.3) as a legitimate request338.

At operation436, the processor (e.g., processor306-1ofFIG.3) of the node (e.g., node304-1ofFIG.3) of network intrusion detection system302forwards legitimate request338to service provider system154. After performing operation436, method400continues to operation444.

In response to determining at operation428that at least one of parameter values328of parameters110of the suspicious request (e.g., respective one of suspicious requests326ofFIG.3) matches with a respective malicious parameter value (e.g., respective one of malicious parameter values318-1ofFIG.3) or in response to determining at operation432that the suspicious request (e.g., respective one of suspicious requests326ofFIG.3) is malicious, method400continues to operation438. At operation438, the processor (e.g., processor306-1ofFIG.3) of the node (e.g., node304-1ofFIG.3) of network intrusion detection system302identifies the suspicious request (e.g., respective one of suspicious requests326ofFIG.3) as malicious.

At operation440, the processor (e.g., processor306-1ofFIG.3) of the node (e.g., node304-1ofFIG.3) of network intrusion detection system302sends a notification152that the suspicious request (e.g., respective one of suspicious requests326ofFIG.3) is identified as malicious. In certain embodiments, the processor (e.g., processor306-1ofFIG.3) of the node (e.g., node304-1ofFIG.3) of network intrusion detection system302sends the notification152to a device of a network administrator.

At operation442, the processor (e.g., processor306-1ofFIG.3) of the node (e.g., node304-1ofFIG.3) of network intrusion detection system302adds parameter values328of parameters110of the suspicious request (e.g., respective one of suspicious requests326ofFIG.3) to the block list (e.g., block list316-1ofFIG.3).

After performing operations436or442, method400continues to operation444. At operation444, the processor (e.g., processor306-1ofFIG.3) of the node (e.g., node304-1ofFIG.3) of network intrusion detection system302determines if all suspicious requests (e.g., respective ones of suspicious requests326ofFIG.3) of the request group (e.g., respective one of request groups332ofFIG.3) are analyzed.

In response to determining at operation444that all suspicious requests (e.g., respective ones of suspicious requests326ofFIG.3) of the request group (e.g., respective one of request groups332ofFIG.3) are not analyzed, method400continues to operation426. In certain embodiments, operations426through444are performed one or more times until all suspicious requests (e.g., respective ones of suspicious requests326ofFIG.3) of the request group (e.g., respective one of request groups332ofFIG.3) are analyzed.

In response to determining at operation444that all suspicious requests (e.g., respective ones of suspicious requests326ofFIG.3) of the request group (e.g., respective one of request groups332ofFIG.3) are analyzed or after performing operation424, method400continues to operation446. At operation446, the processor (e.g., processor306-1ofFIG.3) of the node (e.g., node304-1ofFIG.3) of network intrusion detection system302determines if all request groups (e.g., request groups332ofFIG.3) are analyzed.

In response to determining at operation446that all request groups (e.g., request groups332ofFIG.3) are not analyzed, method400continues to operation420. In certain embodiments, operations420through446are performed one or more times until all request groups (e.g., request groups332ofFIG.3) are analyzed.

In response to determining at operation446that all request groups (e.g., request groups332ofFIG.3) are analyzed, method400continues to operation448. At operation448, the processor (e.g., processor306-1ofFIG.3) of the node (e.g., node304-1ofFIG.3) of network intrusion detection system302synchronizes that block list (e.g., block list316-1ofFIG.3) with block lists (e.g., rest of block lists316-1through316-mofFIG.3) of other nodes (e.g., rest of nodes304-1through304-mofFIG.3) of network intrusion detection system302.

At operation450, the processor (e.g., processor306-1ofFIG.3) of the node (e.g., node304-1ofFIG.3) of network intrusion detection system302determines if a request174to end the network intrusion detection process is received. In certain embodiments, the request174to end the network intrusion detection process may be received from a device of a network administrator.

In response to determining at operation450that the request174to end the network intrusion detection process is not received, method400continues to operation406. In certain embodiments, operations406through450are performed one or more times until the request174to end the network intrusion detection process is received. In response to determining at operation450that the request174to end the network intrusion detection process is received, method400ends.