Methods and apparatus to analyze network traffic for malicious activity

Methods, apparatus, systems and articles of manufacture are disclosed to analyze network traffic for malicious activity. An example apparatus includes a graph generator to, in response to obtaining one or more internet protocol addresses included within input data, generate a graph data structure based on one or more features of the one or more internet protocol addresses in the input data, a file generator to generate a first matrix using the graph data structure, the first matrix to represent nodes in the graph data structure and generate a second matrix using the graph data structure, the second matrix to represent edges in the graph data structure, and a classifier to, using the first matrix and the second matrix, classify at least one of the one or more internet protocol addresses to identify a reputation of the at least one of the one or more internet protocol addresses.

FIELD OF THE DISCLOSURE

This disclosure relates generally to network intrusion detection, and, more particularly, to methods and apparatus to analyze network traffic for malicious activity.

BACKGROUND

Malware (e.g., viruses, worms, trojans, ransomware) is malicious software that is disseminated by attackers to launch a wide range of security attacks, such as stealing user's private information, hijacking devices remotely to deliver massive spam emails, infiltrating a user's online account credentials, etc. The introduction of malware to a computing system may cause serious damages and significant financial loss to computer and/or Internet users.

The figures are not to scale. In general, the same reference numbers will be used throughout the drawing(s) and accompanying written description to refer to the same or like parts. Connection references (e.g., attached, coupled, connected, and joined) are to be construed broadly and may include intermediate members between a collection of elements and relative movement between elements unless otherwise indicated. As such, connection references do not necessarily infer that two elements are directly connected and in fixed relation to each other.

DETAILED DESCRIPTION

Currently, many people (e.g., millions of users) have access to the Internet. When accessing and/or otherwise connecting to the Internet, a user typically utilizes an Internet-enabled device. Such an Internet-enabled device is associated with an IP address (e.g., a network address) provided by an Internet Service Provider (ISP). ISPs typically provide a single public (IP) address for each location (e.g., a media presentation location, a household, an internet café, an office, etc.) receiving Internet services.

Typically, a request may be initiated by varying individuals and/or entities to identify and/or determine the reputation of a user accessing the Internet based on the associated IP address. Such requests to verify the reputation of a user based on an IP address can be utilized to mitigate potential attacks that may be carried out via disreputable (e.g., compromised, untrustworthy, non-reputable, etc.) websites and IP addresses. As used herein, a reputation of an IP address may refer to either a reputable IP address or a disreputable IP address. As used herein, a reputable IP address corresponds to an IP address that is more likely than not associated with non-malicious activity. For example, an IP address of a device associated with a non-malicious user (e.g., a user that normally browses the Internet) may be considered reputable. As used herein, a disreputable IP address corresponds to an IP address that is more likely than not associated with malicious activity. For example, an IP address of a device associated with a malicious user (e.g., a user that is attempting to breach a network firewall) may be considered disreputable. IP addresses are scalable and often dynamic in nature, and, thus it becomes a challenging and computationally intensive task to identify an accurate reputation of an IP address.

Traditional security approaches attempt to protect users from malicious IP addresses by employing blacklisting techniques. Alternatively, entities such as security vendors, ISPs, and law enforcement groups have developed statistical analysis methods that are dedicated to exposing and blocking malicious IPs online. However, such approaches are inefficient when operating at scale and, even more so, cannot properly scale up with the large number of Internet uses and/or reputation verification requests.

Examples disclosed herein include utilizing a graph-based semi-supervised learning model with a graph neural network (GNN) such as, for example, a graph convolutional neural network (GCNN) to determine the reputation of IP address at scale. Examples disclosed herein include generating a graph database and/or any suitable graph data structure based on feature extraction of IP address data. As such, the graph database and/or suitable graph data structure may be used to infer IP reputation in a semi-supervised way. For example, the graph database and/or suitable graph data structure can enable examples disclosed herein to propagate the reputation determination from known reputable or known disreputable nodes to unknown nodes (e.g., unknown IP addresses).

In examples disclosed herein, a graph database and/or suitable graph data structure is generated responsive to obtaining an IP address. Accordingly, the graph database and/or suitable graph data structure may include edges and nodes corresponding to each IP address. As used herein, a node refers to a single IP address. Additionally, as used herein, an edge refers to a relationship between one or more nodes. An edge is used to represent varying categories and/or other properties of an IP address (e.g., a node) that can be grouped together with another IP address. For example, if two IP addresses originate from the same geographic location (e.g., country, etc.), an edge between such two IP addresses may be a geolocation grouping of the two IP addresses. In another example, in the event multiple IP addresses are in the same networking architecture (e.g., within a Class C subnetwork), example edges between corresponding IP addresses may designate such a shared networking architecture. In yet another example, an edge between one or more IP addresses may indicate common Autonomous System Numbers (ASNs).

By generating a graph database of IP addresses in which the edges illustrate relationships between nodes, examples disclosed herein include inferring information related to groups of IP addresses such as, for example, how each group of IP addresses is utilized. For example, if a group of IP addresses is owned by an ISP, and therefore the group of IP addresses have the same ASN that reflects the ISP, then the group of IP addresses may reflect typical behavior of the ISP. If an ISP assigns a group of IP addresses to private residential users, the nodes and edges sharing the same ASN (e.g., an ASN that reflects the group of private residential users) may reflect typical behavior of private residential users. Likewise, if the ISP assigns a group of IP addresses to small businesses, the nodes and edges sharing the same ASN (e.g., an ASN that reflects the group of small businesses) may reflect typical behavior of small businesses.

Examples disclosed herein train a GNN or GCNN using only a small subset of labeled training data (e.g., ten percent of the total input data, five percent of total input data, etc.). Examples disclosed herein enable a system configured to identify the reputation of an IP address to do so with a high accuracy percentage (e.g., 85%) and a low percentage of labeled data (e.g., 5%). In other examples disclosed herein, any suitable percentage accuracy measurement based on any suitable percentage of labeled data may be achieved.

Examples disclosed herein employ a transductive GNN model and/or a transductive GCNN model. As used herein, a transductive GNN model, a transductive GCNN model, or a transductive machine learning environment is trained during an inference operation. Further in such an example using a transductive GNN model, a transductive GCNN model, or a transductive machine learning environment, an example machine learning controller obtains both (1) a set of labeled training data, and (2) a set of unlabeled data when executing the GNN or GCNN model.

As used herein, a transductive machine learning environment refers to a computing environment operable to perform training and inference operations at substantially the same time (e.g., within a same execution schedule) on a single computing device. For example, a machine learning controller in a transductive machine learning environment obtains (1) known input training data and (2) unknown input data from external sources. While a transductive machine learning environment typically uses a single computing device, any suitable number of computing devices may be used (e.g., parallel processors on two personal computers, three virtual machines executing instruction in parallel or in series, etc.).

FIG.1is a block diagram of an example environment100configured to verify the reputation of an IP address. InFIG.1, the environment100includes an example network102, an example machine learning controller106, and an example first connectivity environment108and an example second connectivity environment110. The example first connectivity environment108includes a first example network device112, a second example network device114, and a third example network device116. The example second connectivity environment110includes a first example network device118, a second example network device120, and a third example network device122.

In the example illustrated inFIG.1, the network102is a wireless communications network. In other examples disclosed herein, the network102may be implemented using wired communications (e.g., a local area network (LAN)) and/or any suitable combination of wired and/or wireless communication networks.

In examples disclosed herein, the environment100is a transductive machine learning environment and, thus, the input training data124is transmitted directly to the machine learning controller106through the network102for subsequent processing. In examples disclosed herein, the input training data124includes one or more sets of labeled IP addresses. For example, the input training data124may include four IP addresses labeled as known to be reputable (e.g., non-malicious) and two IP addresses labeled as known to be disreputable (e.g., malicious). Accordingly, in such an example, the machine learning controller106constructs a graph database including six total nodes (e.g., four nodes for the four reputable IP addresses and two nodes for the two disreputable IP addresses). In example operations disclosed herein, the machine learning controller106may update the graph database and/or graph data structure periodically and/or periodically in the event additional input training data is obtained and/or available.

The example machine learning controller106ofFIG.1is a computing device that obtains the example input training data124and/or the example input data128from either the first connectivity environment108or the second connectivity environment110. For example, a verification request may originate from the first connectivity environment108and, thus, the first connectivity environment108transmits example input data128including IP addresses to be verified to the machine learning controller106. Alternatively, an external entity (e.g., a malware protection service) may initiate a request to verify IP addresses associated with the first connectivity environment108. In such an example, the machine learning controller106communicates with the first connectivity environment108to obtain the IP addresses included in the input data128. In other examples disclosed herein, the machine learning controller106obtains input data128from any number of connectivity environments.

In operation, the machine learning controller106extracts feature data associated with each IP address in the input training data124and/or the input data128. For example, the machine learning controller106is configured to identify characteristics of IP addresses such as, for example, the particular subnetwork of a Class C network, the ASN, the geolocation, etc., associated with the IP address. In this manner, the identified characteristics (e.g., the extracted feature data) are organized as edges in the graph database and/or other graph data structure. For example, if two of the four IP addresses known to be reputable (e.g., non-malicious) originate within the same Class C subnetwork, an edge indicating the Class C subnetwork is generated between the two IP addresses sharing the same Class C subnetwork. In this manner, the machine learning controller106generates an example graph database and/or other graph data structure that represents the identified IP addresses and common relationships between each IP address. An illustration of an example graph database and/or graph data structure is described below, in connection withFIG.4.

In operation, the machine learning controller106may update the graph database and/or graph data structure with additional nodes and edges extracted from the input data128. For example, the machine learning controller106likewise extracts feature data from each IP address in the input data128. In this manner, the machine learning controller106updates the graph database and/or graph data structure using the extracted feature data. Using the trained GCNN model, the machine learning controller106executes the GCNN model with the updated graph database. The machine learning controller106generates an example feature matrix and an adjacency matrix using the nodes and edges, respectively, of the graph database and/or graph data structure. Further, the machine learning controller106aggregates the feature matrix and the adjacency matrix as an input to the trained GCNN model. In this manner, the machine learning controller106performs layer-wise propagation (e.g., a non-linear transformation) to the aggregated feature matrix and adjacency matrix. The machine learning controller106performs node classification on the resultant output and, once completed, identifies the probabilities for each node being reputable or disreputable.

In the event the machine learning controller106identifies nodes as disreputable, the machine learning controller106initiates anti-malware pre-emptive measures such as, for example, blacklisting the IP address associated with the node classified as disreputable, notifying the owners of the IP address associated with the node classified as disreputable, notifying the owners of neighboring IP addresses, etc.

As described above, the environment100is a transductive machine learning environment and, thus, the machine learning controller106may not have access to a previously trained GCNN model. In such an example, the machine learning controller106either (1) obtains the input training data124from the network102or (2) obtains the input data128from either the first connectivity environment108or the second connectivity environment110. The machine learning controller106then may subsequently label a subset of IP addresses within the input data128for use in operation. In this example, the machine learning controller106extracts feature data associated with each IP address in the input training data124and the input data128. For example, the machine learning controller106is configured to identify characteristics of IP addresses such as, for example, the particular subnetwork of a Class C network, the ASN, the geolocation, etc., associated with the IP address. In this manner, the identified characteristics (e.g., the extracted feature data) are organized as edges in the graph database and/or other graph data structure. For example, if two of the four IP addresses known to be reputable (e.g., non-malicious) originate within the same Class C subnetwork, an edge indicating the Class C subnetwork is generated between the two IP addresses sharing the same Class C subnetwork. In this manner, the machine learning controller106generates an example graph database and/or other graph data structure that represents the identified IP addresses and common relationships between each IP address. An illustration of an example graph database and/or graph data structure is described below, in connection withFIG.4.

In an example in which the environment100is a transductive machine learning environment, the machine learning controller106is configured to train a GNN such as, for example, a GCNN, using the graph database and/or graph data structure. Further, the machine learning controller106is configured to reiterate training of the GCNN until a training threshold accuracy is satisfied. Once the threshold accuracy is satisfied, the machine learning controller106may store the graph database and/or any results.

In operation, the machine learning controller106generates an example feature matrix and an adjacency matrix using the nodes and edges, respectively, of the graph database and/or graph data structure. Further, the machine learning controller106aggregates the feature matrix and the adjacency matrix as an input to the GCNN. In this manner, the machine learning controller106performs layer-wise propagation (e.g., a non-linear transformation) to the aggregated feature matrix and adjacency matrix. The machine learning controller106performs node classification on the resultant output and, once completed, identifies the probabilities for each node being reputable or disreputable.

In the example illustrated inFIG.1, the first connectivity environment108is represented as a residential household. In such an example, the first connectivity environment108includes the first network device112, the second network device114, and the third network device116. Any number of network devices may be present in the first connectivity environment108. The first connectivity environment108further includes an example residential router130. In this manner, the residential router130communicates the input data128to the machine learning controller106. In examples disclosed herein, the input data128may include a local IP address associated with each of the first network device112, the second network device114, the third network device116, and/or the IP address assigned to the residential router130by an ISP.

In the example illustrated inFIG.1, the second connectivity environment110is represented as a commercial building. In such an example, the second connectivity environment110includes the fourth network device118, the fifth network device120, and the sixth network device122. Any number of network devices may be present in the second connectivity environment110. The second connectivity environment110further includes an example commercial router132. In this manner, the commercial router132communicates the input data128to the machine learning controller106. In examples disclosed herein, the input data128may include an IP address associated with the fourth network device118, the fifth network device120, the sixth network device122, and/or the IP address assigned to the commercial router132by an ISP.

In the example illustrated inFIG.1, the first network device112is a gaming console, the second network device114is a cellular phone, the third network device116is a personal computer, the fourth network device118is a plotter, the fifth network device120is a personal organizer, and the sixth network device122is a personal computer. While, in the illustrated example, an Internet enabled gaming console, cellular phone, personal computer, plotter, and personal organizer are shown, any other type(s) and/or number(s) of network device(s) may additionally or alternatively be used. For example, Internet-enabled mobile handsets (e.g., a smartphone), tablet computers (e.g., an iPad®, a Google Nexus, etc.) digital media players (e.g., a Roku® media player, a Slingbox®, etc.) etc. may additionally or alternatively be implemented. Further, while in the illustrated example six network devices are shown, any number of network devices may be implemented. While in the illustrated example, the network devices112,114,116,118,120,122are wireless devices (e.g., connected to the Internet via a wireless communications method) any of the network devices112,114,116,118,120may be wired devices (e.g., connected to Internet via a wired connection such as, for example, an Ethernet connection).

FIG.2is an example block diagram illustrating the machine learning controller106ofFIG.1. InFIG.2, the machine learning controller106includes an example input processor202, an example model executor204, an example activity manager206, an example output processor208, and an example inference data store210. In the example ofFIG.2, the input processor202, the model executor204, the activity manager206, the output processor208, and the inference data store210are configured to operate in an transductive machine learning environment (e.g., when the environment100is a transductive machine learning environment) when a trained GCNN, or GNN, model is not available.

In the example illustrated inFIG.2, the input processor202obtains the example input training data124and the example input data128ofFIG.1. In examples disclosed herein, the input training data124is provided by any suitable entity capable of providing an IP address and/or requesting the verification of IP addresses. In examples disclosed herein, the input processor202obtains the input data128from the first connectivity environment108and/or the second connectivity environment110. In other examples disclosed herein, the input processor202may obtain the input training data124and/or the input data128from any number of connectivity environments and/or providers (e.g., an ISP). In some examples disclosed herein, the input processor202may request the input data128from at least one of the first connectivity environment108and the second connectivity environment110.

In examples disclosed herein, the input processor202obtains the input training data124from either (1) the network102ofFIG.1or (2) from either the first connectivity environment108or the second connectivity environment110and subsequently label a subset of IP addresses within the input data128for use in operation. In some examples disclosed herein, the input processor202may obtain the input training data124and/or the input data128that has been previously analyzed and/or labeled by the machine learning controller106. For example, a verification request may request the reputation of a first IP address. Once verified, the input processor202obtains and stores such a result and such a first IP address for use in generating an example graph database212. The example input processor202of the illustrated example ofFIG.2is implemented by a logic circuit such as, for example, a hardware processor. However, any other type of circuitry may additionally or alternatively be used such as, for example, one or more analog or digital circuit(s), logic circuits, programmable processor(s), application specific integrated circuit(s) (ASIC(s)), programmable logic device(s) (PLD(s)), field programmable logic device(s) (FPLD(s)), digital signal processor(s) (DSP(s)), etc.

In the example illustrated inFIG.2, the model executor204is configured to execute a GNN, or a GCNN, model using the input training data124and the input data128. In the event the graph database212has been previously generated, the model executor204updates the example graph database212to include newly extracted features about the IP addresses in the input training data124and/or input data128.

In operation, the model executor204extracts feature data from each IP address in the input training data124and the input data128. For example, model executor204identifies characteristics of IP addresses such as, for example, the particular subnetwork of a Class C network, the ASN, the geolocation, etc., associated with the IP address. In this manner, the identified characteristics (e.g., the extracted feature data) are organized as edges in the graph database212by the model executor204.

In response to performing feature extraction, the model executor204executes the GNN, or GCNN, model using the graph database212. In some examples disclosed herein, the model executor204stores the graph database212in the example inference data store210. In executing the GNN, or GCNN, the model executor204generates and utilizes an example feature matrix (x) and an example adjacency matrix (a) based on the graph database212. The example model executor204of the illustrated example ofFIG.2is implemented by a logic circuit such as, for example, a hardware processor. However, any other type of circuitry may additionally or alternatively be used such as, for example, one or more analog or digital circuit(s), logic circuits, programmable processor(s), application specific integrated circuit(s) (ASIC(s)), programmable logic device(s) (PLD(s)), field programmable logic device(s) (FPLD(s)), digital signal processor(s) (DSP(s)), etc.

Additional description of the model executor204is described below, in connection withFIG.3.

In the example illustrated inFIG.2, the activity manager206determines whether the model executor204executed the GNN, or GCNN, model and, thus, whether results are obtained. In the event the activity manager206determines that results are obtained, the activity manager206parses the results to determine whether an IP address from the input data128is disreputable. In the event the activity manager206determines an IP address from the input data128is disreputable, the activity manager206may take anti-malware actions such as, for example, notifying the owner of the IP address, notifying the owner of a neighboring IP address, etc. In examples disclosed herein, the activity manager206parses the results from the model executor204until analyzing each IP address with an associated result. The example activity manager206of the illustrated example ofFIG.2is implemented by a logic circuit such as, for example, a hardware processor. However, any other type of circuitry may additionally or alternatively be used such as, for example, one or more analog or digital circuit(s), logic circuits, programmable processor(s), application specific integrated circuit(s) (ASIC(s)), programmable logic device(s) (PLD(s)), field programmable logic device(s) (FPLD(s)), digital signal processor(s) (DSP(s)), etc.

InFIG.2, the example output processor208is configured to transmit any results from execution of the GNN, or GCNN, to the inference data store210. In examples disclosed herein, the output processor208communicates with first connectivity environment108and/or the second connectivity environment110to provide the results. The example output processor208of the illustrated example ofFIG.2is implemented by a logic circuit such as, for example, a hardware processor. However, any other type of circuitry may additionally or alternatively be used such as, for example, one or more analog or digital circuit(s), logic circuits, programmable processor(s), application specific integrated circuit(s) (ASIC(s)), programmable logic device(s) (PLD(s)), field programmable logic device(s) (FPLD(s)), digital signal processor(s) (DSP(s)), etc.

In the example illustrated inFIG.2, the inference data store210is configured to store the graph database212, or any updated versions of the graph database212. In addition, the inference data store210stores the input data128, the results obtained regarding the input data128, and/or any features extracted from the IP addresses in the input data128. The example inference data store210of the illustrated example ofFIG.2may be implemented by any device for storing data such as, for example, flash memory, magnetic media, optical media, etc. Furthermore, the data stored in the example inference data store210may be in any data format such as, for example, binary data, comma delimited data, tab delimited data, structured query language (SQL) structures, etc.

FIG.3is a block diagram illustrating the model executor204ofFIG.2. InFIG.3, the model executor204includes an example input processor302, an example file analyzer304, an example graph generator306, an example file generator308, an example aggregator310, an example model trainer312, an example classifier314, an example mapper316, and an example output processor318. In the example ofFIG.3, the input processor302, the file analyzer304, the graph generator306, the file generator308, the aggregator310, the model trainer312, the classifier314, the mapper316, and the output processor318are configured to operate in an transductive machine learning environment (e.g., when the environment100is a transductive machine learning environment).

In the example illustrated inFIG.3, the input processor302is configured to obtain example input training data124and example input data128. In operation, the input processor302transmits the obtained input training data124and the input data128to the file analyzer304. The example input processor302of the illustrated example ofFIG.3is implemented by a logic circuit such as, for example, a hardware processor. However, any other type of circuitry may additionally or alternatively be used such as, for example, one or more analog or digital circuit(s), logic circuits, programmable processor(s), application specific integrated circuit(s) (ASIC(s)), programmable logic device(s) (PLD(s)), field programmable logic device(s) (FPLD(s)), digital signal processor(s) (DSP(s)), etc.

InFIG.3, the example file analyzer304analyzes each IP address included in the input training data124and the input data128to identify whether the IP address is known. For example, the file analyzer304determines whether the IP address is already included in a previously generated graph database212. In the event the file analyzer304determines an IP address from the input training data124and/or the input data128is/are not included in a previously generated graph database212, or the graph database212has not yet been generated, the file analyzer304communicates such an IP address to the graph generator306.

In operation, the file analyzer304extracts feature data from each IP address in the input training data124and the input data128. For example, the file analyzer304is configured to identify characteristics of IP addresses such as, for example, the particular subnetwork of a Class C network, the ASN, the geolocation, etc., associated with the IP address. In this manner, the identified characteristics (e.g., the extracted feature data) are organized as edges in the graph database421. For example, if two of the four IP addresses known to be reputable (e.g., non-malicious) originate within the same Class C subnetwork, an edge indicating the Class C subnetwork is generated between the two IP addresses sharing the same Class C subnetwork.

Alternatively, in the event the file analyzer304determines an IP address is previously included in the graph database212, the file analyzer304determines whether the node and edge data associated with the IP address is accurate. For example, the file analyzer304determines whether the edges associated with the IP address have changed (e.g., the IP address is assigned to a new Class C subnetwork, etc.). In the event the file analyzer304determines the features (e.g., node and/or edge) corresponding to the IP address have changed, the file analyzer304communicates with the graph generator306to update the graph database212. The example file analyzer304of the illustrated example ofFIG.3is implemented by a logic circuit such as, for example, a hardware processor. However, any other type of circuitry may additionally or alternatively be used such as, for example, one or more analog or digital circuit(s), logic circuits, programmable processor(s), application specific integrated circuit(s) (ASIC(s)), programmable logic device(s) (PLD(s)), field programmable logic device(s) (FPLD(s)), digital signal processor(s) (DSP(s)), etc.

InFIG.3, the example graph generator306is configured to generate, construct, and/or update the graph database212. For example, the graph generator306, using the features extracted by the file analyzer304, organizes the nodes and edges based on the common characteristics. For example, if a first IP address and a second IP address are a part of the same Class C subnetwork, then the graph generator306connects a first node (e.g. a first node that represents the first IP address) and the second node (e.g., a second node that represents the second IP address), with a common edge (e.g., the common Class C subnetwork). In examples disclosed herein, the graph generator306organizes any suitable number of edges associated with each node. In some examples disclosed herein, the graph generator306obtains extracted features associated with an IP address that has been previously included in the graph database421. In this example, the graph generator306updates, if necessary, the nodes and/or edges associated with the known IP address. The example graph generator306of the illustrated example ofFIG.3is implemented by a logic circuit such as, for example, a hardware processor. However, any other type of circuitry may additionally or alternatively be used such as, for example, one or more analog or digital circuit(s), logic circuits, programmable processor(s), application specific integrated circuit(s) (ASIC(s)), programmable logic device(s) (PLD(s)), field programmable logic device(s) (FPLD(s)), digital signal processor(s) (DSP(s)), etc.

In the example ofFIG.3, the file generator308obtains the graph database212from the data store210. Accordingly, the file generator308generates an example feature matrix (x) and an example adjacency matrix (a). In examples disclosed herein, the feature matrix (x) generated by the file generator308is a matrix of size “N” by “D” in which “N” corresponds the sample size (e.g., the number of IP addresses) and “D” corresponds to the feature dimension. The feature matrix (x) includes input features for each node. In examples disclosed herein, the adjacency matrix (a) generated by the file generator308is a matrix of size “N” by “N.” The elements in the adjacency matrix include a binary representation of whether an edge exists between two nodes. For example, if an edge corresponding to a particular Class C subnetwork exists between a first node and a second node, such a corresponding element in the adjacency matrix is the binary value “1.” The example file generator308of the illustrated example ofFIG.3is implemented by a logic circuit such as, for example, a hardware processor. However, any other type of circuitry may additionally or alternatively be used such as, for example, one or more analog or digital circuit(s), logic circuits, programmable processor(s), application specific integrated circuit(s) (ASIC(s)), programmable logic device(s) (PLD(s)), field programmable logic device(s) (FPLD(s)), digital signal processor(s) (DSP(s)), etc.

In the example illustrated inFIG.3, the aggregator310aggregates the feature matrix (x) and the adjacency matrix (a) as a single input into the model trainer312. In other examples disclosed herein, the aggregator310may aggregate the feature matrix (x) and the adjacency matrix (a) as any suitable number of inputs into the model trainer312. The example aggregator310of the illustrated example ofFIG.3is implemented by a logic circuit such as, for example, a hardware processor. However, any other type of circuitry may additionally or alternatively be used such as, for example, one or more analog or digital circuit(s), logic circuits, programmable processor(s), application specific integrated circuit(s) (ASIC(s)), programmable logic device(s) (PLD(s)), field programmable logic device(s) (FPLD(s)), digital signal processor(s) (DSP(s)), etc.

In the example illustrated inFIG.3, the model trainer312utilizes and trains a GCNN, or a GNN, using the aggregated feature matrix (x) and adjacency matrix (a). In operation, the model trainer312implements a hidden layer in the GCNN, or GNN, to perform layer-wise propagation on the aggregated input matrix. For example, the model trainer312may perform a non-linear transformation (e.g., a rectified linear unit (ReLu) transformation) to the aggregated input matrix. The resulting output matrix, an example feature matrix (z), is a matrix of size “N” by “F.” The variable “F” corresponds to the feature embedding dimension, is sent to the classifier314. In examples disclosed herein, the feature matrix (z) is a matrix generated by the model trainer312that includes the embeddings of the output features for each node in the graph database421. The example model trainer312of the illustrated example ofFIG.3is implemented by a logic circuit such as, for example, a hardware processor. However, any other type of circuitry may additionally or alternatively be used such as, for example, one or more analog or digital circuit(s), logic circuits, programmable processor(s), application specific integrated circuit(s) (ASIC(s)), programmable logic device(s) (PLD(s)), field programmable logic device(s) (FPLD(s)), digital signal processor(s) (DSP(s)), etc.

In the example ofFIG.3, the classifier314classifies the feature matrix (z) by performing a classification method. For example, the classifier314is operable with the model trainer312to perform a supervised form of classification on the feature matrix (z) to learn based on input training data. In examples disclosed herein, any suitable method of classification may be implemented. The example classifier314of the illustrated example ofFIG.3is implemented by a logic circuit such as, for example, a hardware processor. However, any other type of circuitry may additionally or alternatively be used such as, for example, one or more analog or digital circuit(s), logic circuits, programmable processor(s), application specific integrated circuit(s) (ASIC(s)), programmable logic device(s) (PLD(s)), field programmable logic device(s) (FPLD(s)), digital signal processor(s) (DSP(s)), etc.

InFIG.3, the example mapper316maps the output of the classifier314to each node in the graph database212. For example, the output of the classifier314is a probability that a node is reputable or disreputable and, as such, the mapper316maps that probability to the corresponding node. The example mapper316of the illustrated example ofFIG.3is implemented by a logic circuit such as, for example, a hardware processor. However, any other type of circuitry may additionally or alternatively be used such as, for example, one or more analog or digital circuit(s), logic circuits, programmable processor(s), application specific integrated circuit(s) (ASIC(s)), programmable logic device(s) (PLD(s)), field programmable logic device(s) (FPLD(s)), digital signal processor(s) (DSP(s)), etc.

InFIG.3, the example output processor318is configured to transmit the example graph database212and the trained GCNN model to the activity manager206ofFIG.2. The example output processor318of the illustrated example ofFIG.3is implemented by a logic circuit such as, for example, a hardware processor. However, any other type of circuitry may additionally or alternatively be used such as, for example, one or more analog or digital circuit(s), logic circuits, programmable processor(s), application specific integrated circuit(s) (ASIC(s)), programmable logic device(s) (PLD(s)), field programmable logic device(s) (FPLD(s)), digital signal processor(s) (DSP(s)), etc.

FIG.4is an illustration400of the graph database212ofFIGS.2and/or3. For example, the illustration400is an example implementation of the graph database212ofFIGS.2and/or3. In the example ofFIG.4, the graph database includes example nodes402a-p, an example first group of edges404, an example second group of edges406, an example third group of edges408, an example fourth group of edges410, an example fifth group of edges412.

InFIG.4, the nodes402a-peach represent a single IP address. WhileFIG.4illustrates nodes402a-p, any number of nodes may be included in the graph database212. In the example illustrated inFIG.4, the first group of edges404represents a first common feature among nodes402a-d. For example, the first common feature corresponds to the Class C subnetwork 72.43.19. Thus, as illustrated in the graph database212, nodes402a-dbelong to the same Class C subnetwork, 72.43.19.

In the example illustrated inFIG.4, the second group of edges406represents a second common feature among nodes402e-h. For example, the second common feature corresponds to the Class C subnetwork 172.2.156. Thus, as illustrated in the graph database212, nodes402e-hbelong to the same Class C subnetwork, 172.2.156.

In the example illustrated inFIG.4, the third group of edges408represents a third common feature among nodes402i-l. For example, the third common feature corresponds to the Class C subnetwork 62.2.60. Thus, as illustrated in the graph database212, nodes402i-lbelong to the same Class C subnetwork, 62.2.60.

In the example illustrated inFIG.4, the fourth group of edges410represents a fourth common feature among nodes402m-p. For example, the fourth common feature corresponds to the Class C subnetwork 201.156.16. Thus, as illustrated in the graph database212, nodes402m-pbelong to the same Class C subnetwork, 201.156.16.

In the example illustrated inFIG.4, the fifth group of edges412represents a fifth common feature among nodes402c,402g,402i,402m. For example, the fifth common feature corresponds to a common ASN group. Thus, as illustrated in the graph database212, nodes402c,402g,402i,402mbelong to the same ASN group.

While an example manner of implementing the machine learning controller106ofFIG.1is illustrated inFIGS.1,2, and/or3, one or more of the elements, processes and/or devices illustrated inFIGS.1,2, and/or3may be combined, divided, re-arranged, omitted, eliminated and/or implemented in any other way. Further, the example input processor202, the example model executor204, the example activity manager206, the example output processor208, the example inference data store210, and/or, more generally, the example machine learning controller106ofFIGS.1and/or2, and/or the example input processor302, the example file analyzer304, the example graph generator306, the example file generator308, the example aggregator310, the example model trainer312, the example classifier314, the example mapper316, the example output processor318, and/or, more generally, the example model executor204ofFIGS.2and/or3may be implemented by hardware, software, firmware and/or any combination of hardware, software and/or firmware. Thus, for example, any of the example input processor202, the example model executor204, the example activity manager206, the example output processor208, the example inference data store210, and/or, more generally, the example machine learning controller106ofFIGS.1and/or2, and/or the example input processor302, the example file analyzer304, the example graph generator306, the example file generator308, the example aggregator310, the example model trainer312, the example classifier314, the example mapper316, the example output processor318, and/or, more generally, the example model executor204ofFIGS.2and/or3could be implemented by one or more analog or digital circuit(s), logic circuits, programmable processor(s), programmable controller(s), graphics processing unit(s) (GPU(s)), digital signal processor(s) (DSP(s)), application specific integrated circuit(s) (ASIC(s)), programmable logic device(s) (PLD(s)) and/or field programmable logic device(s) (FPLD(s)). When reading any of the apparatus or system claims of this patent to cover a purely software and/or firmware implementation, at least one of the example input processor202, the example model executor204, the example activity manager206, the example output processor208, the example inference data store210, the example input processor302, the example file analyzer304, the example graph generator306, the example file generator308, the example aggregator310, the example model trainer312, the example classifier314, the example mapper316, the example output processor318is/are hereby expressly defined to include a non-transitory computer readable storage device or storage disk such as a memory, a digital versatile disk (DVD), a compact disk (CD), a Blu-ray disk, etc. including the software and/or firmware. Further still, the example machine learning controller106ofFIGS.1,2, and/or3, and/or the example model executor204ofFIGS.2and/or3may include one or more elements, processes and/or devices in addition to, or instead of, those illustrated inFIGS.1,2, and/or3, and/or may include more than one of any or all of the illustrated elements, processes and devices. As used herein, the phrase “in communication,” including variations thereof, encompasses direct communication and/or indirect communication through one or more intermediary components, and does not require direct physical (e.g., wired) communication and/or constant communication, but rather additionally includes selective communication at periodic intervals, scheduled intervals, aperiodic intervals, and/or one-time events.

Flowcharts representative of example hardware logic, machine readable instructions, hardware implemented state machines, and/or any combination thereof for implementing the machine learning controller106and/or the model executor204ofFIGS.1,2, and/or3are shown inFIGS.5,6, and/or7. The machine readable instructions may be one or more executable programs or portion(s) of an executable program for execution by a computer processor such as the processor812shown in the example processor platform800discussed below in connection withFIG.8. The program may be embodied in software stored on a non-transitory computer readable storage medium such as a CD-ROM, a floppy disk, a hard drive, a DVD, a Blu-ray disk, or a memory associated with the processor812, but the entire program and/or parts thereof could alternatively be executed by a device other than the processor812and/or embodied in firmware or dedicated hardware. Further, although the example program is described with reference to the flowcharts illustrated inFIGS.5,6, and/or7many other methods of implementing the example machine learning controller106, and/or the example model executor204may alternatively be used. For example, the order of execution of the blocks may be changed, and/or some of the blocks described may be changed, eliminated, or combined. Additionally or alternatively, any or all of the blocks may be implemented by one or more hardware circuits (e.g., discrete and/or integrated analog and/or digital circuitry, an FPGA, an ASIC, a comparator, an operational-amplifier (op-amp), a logic circuit, etc.) structured to perform the corresponding operation without executing software or firmware.

FIG.5is a flowchart representative of example machine readable instructions500that may be executed by a processor to implement the example machine learning controller106ofFIGS.1,2, and/or3to update the example graph database212ofFIGS.2and/or3.

In the example ofFIG.5, the input processor302obtains input data (e.g., the example input training data124and/or the example input data128ofFIG.1). (Block502). In examples disclosed herein, the input processor302obtains the input data (e.g., the example input training data124and/or the input data128) as a set of labeled IP addresses. In response, the example file analyzer304analyzes each IP address included in the input data (e.g., the input training data124and/or the input data128) to identify whether the IP address is known. (Block504). For example, the file analyzer304determines whether the IP address is already included a previously generated graph database. In the event the file analyzer304determines an IP address from the input data (e.g., the input training data124and/or the input data128) is not included in a graph database (e.g., the graph database212ofFIG.2) (e.g., the control of block504returns a result of NO), the process proceeds to block602ofFIG.6.

In the event the file analyzer304determines an IP address is known (e.g., an IP address is included in the graph database212) (e.g., the control of block504returns a result of YES), the file analyzer304determines whether the graph database (e.g., the graph database212) is accurate. (Block506). For example, the file analyzer304compares the node and edge data associated with the IP address which the node and edge data included in the graph database (e.g., the graph database212). For example, the file analyzer304determines whether the edges associated with the IP address have changed (e.g., the IP address is assigned to a new Class C subnetwork, etc.). In the event the file analyzer304determines the graph database is not accurate (e.g., the control of block506returns a result of NO), the graph generator306updates the graph database (e.g., the graph database212). (Block508). In this example, the graph generator306updates, if necessary, the nodes and/or edges associated with the known IP address. Alternatively, in the event the file analyzer304determines the graph database is accurate (e.g., the control of block506returns a result of YES), the process proceeds to block510.

At block510, the machine learning controller106determines whether to continue operating. (Block510). For example, the machine learning controller106may determine to continue operating in the event additional input training data is obtained. Alternatively, the machine learning controller106may determine not to continue operating in the event additional input training data is not available. In the event the machine learning controller106determines to continue operating (e.g., the control of block510returns a result of YES), the process returns to block502. Alternatively, in the event the machine learning controller106determines not to continue operating (e.g., the control of block510returns a result of NO), the process stops.

FIG.6is a flowchart representative of example machine readable instructions600that may be executed by a processor to implement the example machine learning controller106ofFIGS.1,2, and/or3execute a GNN model.

At block602, the input processor302obtains input data (e.g., the input training data124and the input data128ofFIG.1). (Block602). InFIG.6, the example file analyzer304of the model executor204extracts feature data from each IP address in the input training data124and the input data128. (Block604). In addition, the file analyzer304identifies edge characteristics of the IP addresses. (Block606).

InFIG.6, the example graph generator306of the model executor204is configured to generate a graph database (e.g., the graph database212ofFIG.2). (Block608). For example, the graph generator306, using the features extracted by the file analyzer304, organizes the nodes and edges based on the common characteristics. In operation, the file analyzer304determines whether additional edge characteristics are available. (Block610). In the event the file analyzer304determines additional edge characteristics are available (e.g., the control of block610returns a result of YES), the process returns to block606. Alternatively, in the event the file analyzer304determines additional edge characteristics are not available (e.g., the control of block610returns a result of NO), the process proceeds to block612.

At block612, the file generator308generates an example feature matrix (x). (Block612). Additionally, the file generator308generates an example adjacency matrix (a). (Block614).

InFIG.6, the aggregator310aggregates the feature matrix (x) and the adjacency matrix (a). (Block616). At block618, the model trainer312performs layer-wise propagation on the aggregated input matrix. (Block618). For example, the model trainer312performs a non-linear transformation (e.g., ReLu) to the aggregated input matrix.

In response, the classifier314determines whether the output matrix (e.g., a feature matrix (z)) is available from the model trainer312. (Block620). In the event the classifier314determines the output matrix (e.g., the feature matrix (z)) is not available (e.g., the control of block620returns a result of NO), the process waits. Alternatively, in the event the classifier314determines the output matrix (e.g., the feature matrix (z)) is available (e.g., the control of block620returns a result of YES), the classifier314performs node classification on the feature matrix (z). (Block622).

In response, the mapper316determines whether the output probability or output probabilities from the classifier314is/are received. (Block624). In the event the mapper316determines the output probability or output probabilities is/are not available (e.g., the control of block624returns a result of NO), the process waits. Alternatively, in the event the mapper316determines the output probability or output probabilities is/are available (e.g., the feature matrix (z)) is available (e.g., the control of block624returns a result of YES), the mapper316maps the output probability or output probabilities of the classifier314to each node in the graph database421. (Block626).

At block628, the machine learning controller106determines whether to continue operating. (Block628). For example, the machine learning controller106may determine to continue operating in the event a new graph database is updated and/or obtained, etc. Alternatively, the machine learning controller106may determine not to continue operating in the event of a loss of power, no additional input data is available, etc. In the event the machine learning controller106determines to continue operating (e.g., the control of block628returns a result of YES), the process returns to block602. Alternatively, in the event the machine learning controller106determines not to continue operating (e.g., the control of block628returns a result of NO), the process stops.

FIG.7is a flowchart representative of example machine readable instructions700that may be executed by a processor to implement the example machine learning controller106ofFIGS.1,2, and/or3initiate anti-malware measures.

InFIG.7, the activity manager206determines whether results are obtained. (Block702). In the event the activity manager206determines that results are not obtained (e.g., the control of block702returns a result of NO), the process waits.

In the event the activity manager206determines that results are obtained (e.g., the control of block702returns a result of YES), the activity manager206parses the results to determine whether an IP address from the input data128is indicative of malicious activity (e.g., disreputable). (Block704).

In the event the activity manager206determines an IP address from the input data128is indicative of malicious activity (e.g., the control of block704returns a result of YES), the activity manager206performs anti-malware actions. (Block706). For example, the activity manager206may notify the owner of the IP address. In response, the activity manager206determines whether there is another IP address to analyze. (Block708). In the event the activity manager206determines there is another IP address to analyze (e.g., the control of block708returns a result of YES), the process returns to block704.

Alternatively, in the event the activity manager206determines there is not another IP address to analyze (e.g., the control of block708returns a result of NO), or in the event the activity manager206determines that an IP address from the input data128is not indicative of malicious activity (e.g., reputable) (e.g., the control of block704returns a result of NO), the activity manager206determines whether to continue operating. (Block710).

At block710, the machine learning controller106determines whether to continue operating. (Block710). For example, the machine learning controller106may determine to continue operating in the event a new graph database is updated and/or obtained, additional input data is available, etc. Alternatively, the machine learning controller106may determine not to continue operating in the event of a loss of power, no additional input data available, etc. In the event the machine learning controller106determines to continue operating (e.g., the control of block710returns a result of YES), the process returns to block702. Alternatively, in the event the machine learning controller106determines not to continue operating (e.g., the control of block710returns a result of NO), the process stops.

FIG.8is a block diagram of an example processor platform800structured to execute the instructions ofFIGS.5,6, and/or7to implement the machine learning controller106ofFIGS.1,2, and/or3, and/or the model executor204ofFIGS.2and/or3. The processor platform800can be, for example, a server, a personal computer, a workstation, a self-learning machine (e.g., a neural network), a mobile device (e.g., a cell phone, a smart phone, a tablet such as an iPad™), a personal digital assistant (PDA), an Internet appliance, a DVD player, a CD player, a digital video recorder, a Blu-ray player, a gaming console, a personal video recorder, a set top box, a headset or other wearable device, or any other type of computing device.

The processor platform800of the illustrated example includes a processor812. The processor812of the illustrated example is hardware. For example, the processor812can be implemented by one or more integrated circuits, logic circuits, microprocessors, GPUs, DSPs, or controllers from any desired family or manufacturer. The hardware processor may be a semiconductor based (e.g., silicon based) device. In this example, the processor implements the example input processor202, the example model executor204, the example activity manager206, the example output processor208, the example inference data store210, the example input processor302, the example file analyzer304, the example graph generator306, the example file generator308, the example aggregator310, the example model trainer312, the example classifier314, the example mapper316, and/or the example output processor318.

The processor platform800of the illustrated example also includes an interface circuit820. The interface circuit820may be implemented by any type of interface standard, such as an Ethernet interface, a universal serial bus (USB), a Bluetooth® interface, a near field communication (NFC) interface, and/or a PCI express interface.

In the illustrated example, one or more input devices822are connected to the interface circuit820. The input device(s)822permit(s) a user to enter data and/or commands into the processor812. The input device(s) can be implemented by, for example, an audio sensor, a microphone, a camera (still or video), a keyboard, a button, a mouse, a touchscreen, a track-pad, a trackball, isopoint and/or a voice recognition system.

The processor platform800of the illustrated example also includes one or more mass storage devices828for storing software and/or data. Examples of such mass storage devices828include floppy disk drives, hard drive disks, compact disk drives, Blu-ray disk drives, redundant array of independent disks (RAID) systems, and digital versatile disk (DVD) drives.

The machine executable instructions832ofFIGS.5,6, and/or7may be stored in the mass storage device828, in the volatile memory814, in the non-volatile memory816, and/or on a removable non-transitory computer readable storage medium such as a CD or DVD.

From the foregoing, it will be appreciated that example methods, apparatus and articles of manufacture have been disclosed that efficiently analyze network traffic for malicious activity. The disclosed methods, apparatus and articles of manufacture improve the efficiency of using a computing device by generating a graph data structure based on one or more IP addresses. Furthermore, the disclosed methods, apparatus and articles of manufacture improve the efficiency of using a computing device by utilizing the generated graph to detect whether an IP address is associated with malicious activity. As such, by determining the reputation of an IP address, examples disclosed herein prevent a user from initiating a malicious attack from an IP address determined to be disreputable. For example, in determining the reputation of an IP address, examples disclosed herein can reduce the number of malicious attacks carried out because anti-malware measures may be taken once a disreputable IP address is identified. In addition, examples disclosed herein may prevent future installation of malicious software in the event an associated IP address is determined to be disreputable.

Accordingly, the disclosed methods, apparatus and articles of manufacture enable a computing device to identify the reputation of an IP address and, as such, perform action in the event the reputation is determined to be disreputable. For example, the disclosed methods, apparatus and articles of manufacture perform anti-malware measures such as, for example, notifying the owner and/or neighbors of the IP address that such an address is disreputable. The graph database and/or other graph data structure enable examples disclosed herein to facilitate verification of an IP address reputation in a computationally efficient manner. The disclosed methods, apparatus and articles of manufacture are accordingly directed to one or more improvement(s) in the functioning of a computer.

Example methods, apparatus, systems, and articles of manufacture to analyze network traffic for malicious activity are disclosed herein. Further examples and combinations thereof include the following:

Example 1 includes an apparatus comprising a graph generator to, in response to obtaining one or more internet protocol addresses included within input data, generate a graph data structure based on one or more features of the one or more internet protocol addresses in the input data, a file generator to generate a first matrix using the graph data structure, the first matrix to represent nodes in the graph data structure, and generate a second matrix using the graph data structure, the second matrix to represent edges in the graph data structure, and a classifier to, using the first matrix and the second matrix, classify at least one of the one or more internet protocol addresses to identify a reputation of the at least one of the one or more internet protocol addresses.

Example 2 includes the apparatus of example 1, wherein the apparatus is implemented in a transductive machine learning environment.

Example 3 includes the apparatus of example 2, further including an input processor to obtain the input data from at least one of a training controller and a connectivity environment.

Example 4 includes the apparatus of example 3, wherein the input processor is to obtain the input data in response to a reputation verification request, the reputation verification request requesting to identify the reputation of at least one of the one or more internet protocol addresses.

Example 5 includes the apparatus of example 2, further including a file analyzer to extract the one or more features from the one or more internet protocol addresses in the input data.

Example 6 includes the apparatus of example 5, wherein, to extract the one or more features, the file analyzer is to identify at least one of a subnetwork or an autonomous system numbers group associated with the one or more internet protocol addresses.

Example 7 includes the apparatus of example 1, wherein the classifier is operable with a graph neural network.

Example 8 includes a non-transitory computer readable storage medium comprising instructions which, when executed, cause at least one processor to at least generate, in response to obtaining one or more internet protocol addresses included within input data, a graph data structure based on one or more features of the one or more internet protocol addresses in the input data, generate a first matrix using the graph data structure, the first matrix to represent nodes in the graph data structure, generate a second matrix using the graph data structure, the second matrix to represent edges in the graph data structure, and classify, using the first matrix and the second matrix, at least one of the one or more internet protocol addresses to identify a reputation of the at least one of the one or more internet protocol addresses.

Example 9 includes the computer readable storage medium of example 8, wherein the at least one processor is implemented in a transductive machine learning environment.

Example 10 includes the computer readable storage medium of example 9, wherein the instructions, when executed, cause the at least one processor to obtain the input data from at least one of a training controller and a connectivity environment.

Example 11 includes the computer readable storage medium of example 10, wherein the instructions, when executed, cause the at least one processor to obtain the input data in response to a reputation verification request, the reputation verification request requesting to identify the reputation of at least one of the one or more internet protocol addresses.

Example 12 includes the computer readable storage medium of example 9, wherein the instructions, when executed, cause the at least one processor to extract the one or more features from the one or more internet protocol addresses in the input data.

Example 13 includes the computer readable storage medium of example 12, wherein the instructions, when executed, cause the at least one processor to extract the one or more features by identifying at least one of a subnetwork or an autonomous system numbers group associated with the one or more internet protocol addresses.

Example 14 includes the computer readable storage medium of example 8, wherein the at least one processor is operable with a graph neural network.

Example 15 includes a method comprising generating, in response to obtaining one or more internet protocol addresses included within input data, a graph data structure based on one or more features of the one or more internet protocol addresses in the input data, generating a first matrix using the graph data structure, the first matrix to represent nodes in the graph data structure, generating a second matrix using the graph data structure, the second matrix to represent edges in the graph data structure, and classifying, using the first matrix and the second matrix, at least one of the one or more internet protocol addresses to identify a reputation of the at least one of the one or more internet protocol addresses.

Example 16 includes the method of example 15, wherein classifying the at least one of the one or more internet protocol addresses is implemented in a transductive machine learning environment.

Example 17 includes the method of example 16, further including obtaining the input data in response to a reputation verification request, the reputation verification request requesting to identify the reputation of at least one of the one or more internet protocol addresses.

Example 18 includes the method of example 16, further including extracting the one or more features from the one or more internet protocol addresses in the input data.

Example 19 includes the method of example 18, further including extracting the one or more features by identifying at least one of a subnetwork or an autonomous system numbers group associated with the one or more internet protocol addresses.

Example 20 includes the method of example 15, wherein classifying the at least one of the one or more internet protocol addresses is implemented with a graph neural network.