Patent ID: 12250239

The present disclosure is described with reference to the accompanying drawings. In the drawings, generally, like reference numbers indicate identical or functionally similar elements. Additionally, generally, the left-most digit(s) of a reference number identifies the drawing in which the reference number first appears.

DETAILED DESCRIPTION

Provided herein are system, apparatus, device, method and/or computer program product embodiments, and/or combinations and sub-combinations thereof, for providing functionality for implementing anomaly detection using vector data.

FIG.1illustrates an example system100for generating vector representation of network behavior and detecting anomaly using vector data, according to some aspects of the disclosure. Example system100is provided for the purpose of illustration only and does not limit the disclosed embodiments. According to some embodiments, the anomaly detection system of this disclosure can be implemented with a system configured to track the behavior of one or more network devices (e.g., network endpoints) by, for example, modeling the behavior with a behavior model. Some aspects of the anomaly detection system of this disclosure can be used to perform anomaly detection of any type of vector data.

According to some aspects, system100can be configured to generate vector representation of network behavior. The network behavior can include the behavior of one or more network devices such as, but not limited to, network endpoints. In some aspects, system100can be configured to receive (e.g., ingest) one or more network flows and generate one or more flow vectors representing the behavior of a network device. The one or more network flows are from the network device and/or are going to the network device. The network flow represents nature of a network traffic and can include information such as, but not limited to, timestamps, amount of data (e.g., number of bytes) being sent and/or received, one or more descriptors of one or more applications associated with the network traffic, addresses of source and/or destination device, and the like.

In some examples, system100is configured to generate the one or more flow vectors as vector representations of the one or more network flows. For example, system100is configured to generate the one or more flow vectors from the one or more network flows using one or more machine learning algorithms. In some examples, the flow vector(s) can be a dense vector of floating-point number, which encapsulates the “meaning” of each network flow. In some examples, similar network flows (e.g., flows to the same destination, etc.) can correspond to nearby locations of a multi-dimensional space containing the flow vectors.

In addition to generating the flow vectors, system100is configured to analyze the flow vectors and determine/detect anomaly with the network device. As discussed in more detail, in some aspects of this disclosure, system100can be configured to receive the network flow associated with the network device and compare the network flow to one or more flow clusters associated with the network device. Based on this comparison and at the flow level (e.g., by operating on the network flow(s) and comparing the network flow(s) to flow cluster(s)), system100can determine whether the network flow indicates an anomaly in the behavior of the network device. In other words, system100can detect the anomaly in the behavior of the network device at the flow level by analyzing the network flow(s) and comparing them to flow cluster(s). In some examples, system100can generate and use the flow vector associated with the network device to make the comparison and the determination.

According to some aspects of this disclosure, system100can include control circuitry102, one or more buffers130, one or more queues140, one or more processing systems150, storage circuitry160, and Application Program Interface (“API”)170. Illustrated systems are provided as exemplary parts of system100, and system100can include other circuit(s) and subsystem(s). Also, although the systems of system100are illustrated as separate components, the embodiments of this disclosure can include any combination of these, less, or more components. For example, although system100is depicted as one system including several components, this is merely for convenience and the components of system100can be distributed across multiple servers and databases.

According to some aspects of this disclosure, system100is configured to model and/or detect anomaly in the behavior of the network devices of, for example, network110. These network devices can include, but are not limited to, network endpoint112and network endpoint114. In some examples, a network endpoint can be any end device, such as, but not limited to, a consumer electronics device (e.g., smartphone, personal computer, etc.), an Internet-of-Things device, or any other user-facing device that is connected to network110.

According to some aspects of this disclosure, control circuitry102can receive records from network devices of network110(e.g., network device112and network device114) by way of communications circuitry120. Communications circuitry120can be any receiver, transmitter, transceiver, or any other means of transmitting and/or receiving data. As used herein, the term “record” can refer to logs of network activities. Examples of records are Netflow records, Internet Protocol Flow Information Export (“IPFIX”) records, Hypertext Transfer Protocol (“HTTP”) proxy logs, and the like. In some examples, each record identifies a single network flow. In some examples, control circuitry102can augment the records to include extra metadata, such as an application identifier, HTTP/HTTPs (HTTP Secure) header values, Transport Layer Security (“TLS”) certificate details, and the like. Control circuitry102can augment the records through a fingerprinting process, and/or can perform this augmentation by ingesting bidirectional IPFIX records.

The records can be received at buffer130. Control circuitry102can determine to which network device (e.g., network endpoint) each record corresponds. For example, control circuitry102can differentiate records that correspond to network endpoint112from records that correspond to network endpoint114. Control circuitry102can then designate a different queue for each network endpoint, such that records corresponding to each different network endpoint are transmitted from buffer130to a designated queue of queues140. As depicted inFIG.1, records corresponding to network endpoint112can be transmitted to queue142, and records corresponding to network endpoint114can be transmitted to queue144. Control circuitry102can instantiate as many queues n as is necessary to use a dedicated queue for each network endpoint for which records are received. In some embodiments, queues140are FIFO queues. In other embodiments, queues140can be any other form of queue.

In some examples, control circuitry102schedules processing of the records in queues140, where processing is performed by processing systems150. In some examples, processing systems150are not dedicated to a given queue. As an example, queue144can be assigned to processing system152for processing, as depicted inFIG.1. When any of processing systems150completes processing of the records from a given queue, the processing systems150can revert to an idle state. In some examples, control circuitry102identifies idle processing systems, and commands each idle processing system to process records from a specific queue. According to some examples, in selecting to which queue of queues150an idle processing system should be assigned, control circuitry can determine which queues are overflowing in size by determining which queues have a number of records that exceed a threshold. In some examples, the threshold is configured by a network administrator. In some embodiments, the threshold is a default value. Control circuitry102can prioritize queues that have a number of records that exceed the threshold by assigning idle processing systems to those queues first. Control circuitry can assign remaining idle processing systems based on any known load balancing scheme (e.g., based on which queues have the most records), or arbitrarily.

In some aspects of this disclosure, processing systems150generate a behavior model as a result of processing the records of a given queue of queues140. A given processing system (e.g., processing system154) can generate the behavior model by encoding data of the records into a multi-dimensional vector. In some examples, to encode the data, control circuitry102can instruct a processing system of processing system150(e.g., processing system152) to extract data from a subset of fields of records of a given queue (e.g., queue144). Control circuitry102can instruct the processing system (e.g., processing system152) to generate a string from the extracted data. Control circuitry102can then concatenate the extracted data derived from the queue to form a document.

According to some aspects of this disclosure, after forming a document, control circuitry102can convert the document into a vector. For example, control circuitry102can feed the document into a word/document embedding algorithm (e.g., Document to Vector (“doc2vec”), FastText, and the like). In some examples, doc2vec algorithms can be based on Word to Vector (“word2vec”) algorithms. When control circuitry102feeds the document into the doc2vec algorithm, control circuitry102can use a shallow neural network to generate a vector encoding for each word that appears in a given document, and for the document itself. In some examples, control circuitry102can implement a “Paragraph Vector-Distributed Bag of Words” formulation of the doc2vec algorithm. This entails control circuitry102implementing a sliding window (e.g., of a configurable or default size) iterating over the document by selecting a subset of words of the document. Control circuitry102then applies a stochastic gradient descent to compute weights and biases that best fit the shallow neural network in predicting a target identifier for the endpoint. Control circuitry102then averages the set of weights for each word to compose a flow vector that represents the network device (e.g., the network endpoint) to which the document corresponds. The flow vector can be represented as an array of floating point values. In some non-limiting examples, the flow vector is formed of three-hundred to five-hundred floating point values.

It is noted that although some exemplary methods are provided for generating the flow vector from the network flow, aspects of this disclosure are not limited to these examples. And system100and/or control circuitry102can use other methods to generate the flow vector from the network flow representing the behavior of the network device (e.g., network endpoint such as network end point112,114).

Control circuitry102can cause each flow vector to be stored to memory by, for example, storage circuitry160. Moreover, as described above, because the flow vectors are limited in size, behavior modeling is possible without use of a “big data” facility. There are additional advantages to avoiding storing the records themselves. For example, these records often include sensitive private information about users (e.g., personally-identifying information, financial information, and the like). Thus, if these records are inappropriately accessed (e.g., through a hacking or malware operation), legal and privacy issues can arise. The storage of a vector, as disclosed herein, rather than storing the records themselves, avoids these risks by avoiding storing such sensitive information, while still maintaining the ability to monitor the behavior of the network endpoint.

According to some examples, storage circuitry160can be any media capable of storing data. The computer readable media can be transitory, including, but not limited to, propagating electrical or electromagnetic signals, or can be non-transitory including, but not limited to, volatile and non-volatile computer memory or storage devices such as a hard disk, floppy disk, USB drive, DVD, CD, media cards, register memory, processor caches, Random Access Memory (“RAM”), etc. Control circuitry102can be based on any suitable processing circuitry, such as one or more microprocessors, microcontrollers, digital signal processors, programmable logic devices, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), etc., and can include a multi-core processor (e.g., dual-core, quad-core, hexa-core, or any suitable number of cores) or supercomputer. In some embodiments, processing circuitry can be distributed across multiple separate processors or processing units, for example, multiple of the same type of processing units or multiple different processors. In some examples, control circuitry102executes instructions stored in memory (i.e., storage circuitry160).

In some examples, following storage of the flow vector, control circuitry102can receive a request from a network administrator to view a given flow vector. Control circuitry102can respond to such a request by using Application Program Interface (“API”)170to output a visual depiction of a behavior model.

In some examples, control circuitry102can track behavior of the network endpoint over time. For example, by performing a word/document embedding computation (e.g., Doc2Vec or FastText) for a given network endpoint periodically over time, control circuitry102can identify recurring patterns of the endpoint. Differences in network behavior would be indicated by a movement of a resulting vector from subsequent computations to a different position in multidimensional space. Control circuitry102can implement Kalman filters to track the point position over time, or derive a multivariate Gaussian distribution to determine the probability of the point corresponding to the network endpoint's behavior being in a given position of the multidimensional space, or use a recursive neural network to learn behavior change over time. Control circuitry102can determine, if the point is located in a region of low probability value, that the network endpoint is engaged in anomalous behavior, and can alert a network administrator of the anomaly.

FIG.2illustrates a block diagram of system200implementing anomaly detection using vector data, according to some embodiments of the disclosure. System200may be part of system100ofFIG.1. For example, as illustrated inFIG.2, control circuitry102can include anomaly detection system207and alert system209. Control circuitry102can receive and/or retrieve flow vector201,203, and205from, for example, storage circuitry160ofFIG.1. Illustrated systems are provided as exemplary parts of system200, and system200can include other circuit(s) and subsystem(s). Also, although the systems of system200are illustrated as separate components, the embodiments of this disclosure can include any combination of these, less, or more components.

According to some aspects of the disclosure, anomaly detection system207and alert system209can be part of control circuitry102. Additionally, or alternatively, anomaly detection system207and/or alert system209can be part of system100ofFIG.1and can be separate from control circuitry102. Also, control circuitry102can include more or less components/systems for performing the operations of this disclosure.

According to some aspects of this disclosure, one or more flow vectors201are associated with one or more network flows from and/or to a network device (e.g., device A such as network endpoint112ofFIG.1). Anomaly detection system207can receive and/or retrieve one or more flow vectors201. A non-limiting example of four flow vectors201a-dis illustrated inFIG.3A. In this example, flow vectors201a-dare associated with network flows of, for example, network device A. It is noted that number of flow vectors and their structures are provided inFIG.3Aas an example and they do not limit aspects of this disclosure.

In some examples, anomaly detection system207is configured to group the flow vectors (e.g., flow vectors201) into one or more groups. For example, and as discussed in more detail below, anomaly detection system207is configured to group the flow vectors (and their associated network flows) that are more similar to one another than to a threshold. By grouping the flow vectors, anomaly detection system207can reduce the number of flow vectors. In one example, anomaly detection system207is configured to use a similarity measure and a similarity threshold to group flow vectors201. In some examples, anomaly detection system207can use a cosine similarity measure as the similarity measure.

According to some examples, cosine similarity measure can be a measure of similarity between two non-zero vectors of an inner product space that measures the cosine of the angle between them. In this example, anomaly detection system207can determine a pairwise cosine similarity measure between pairs of flow vectors201. As a non-limiting example, one aspect of the grouping operation can be discussed with respect toFIGS.3A and3B.FIG.3Billustrates one exemplary matrix300that includes the values of pairwise cosine similarity measure of flow vectors201a-dofFIG.3A.

For example, value301(value=1) is the cosine similarity value between flow vector201aand itself. For example, value302(value=0.66) is the cosine similarity value between flow vector201aand flow vector201b. For example, value303(value=0.89) is the cosine similarity value between flow vector201aand flow vector201c. For example, value304(value=0.94) is the cosine similarity value between flow vector201aand flow vector201d. Similar cosine similarity values can be determined for other pairs of flow vectors. Cosine similarity value is in the range of [−1, +1], with −1 for completely different vectors and +1 for identical vectors. Matrix300is a square matrix, which is symmetrical. Therefore, half of the operations of determining a pairwise cosine similarity values between pairs of flow vectors can be skipped.

In some examples, the pairwise cosine similarity values can be efficiently vectorized by storing the flow vectors (e.g., flow vectors201a-d) in a contiguous memory space M. In some examples, the following operation can output a square matrix C with each cell being the cosine similarity value between a pair of corresponding columns in M:
M=M/√{square root over (Σm∈Mm2)};C=MMT

After determining the similarity values between the pairs of flow vectors, anomaly detection system207can determine which pairs of flow vectors are more similar to one another than to a similarity threshold. For example, anomaly detection system207can compare the determined similarity values to a similarity measure to determine which pairs of flow vectors are more similar to one another than to the similarity threshold. According to some examples, the similarity threshold can be a pre-configured threshold that can be set by a user (e.g., a network administrator). Additionally, or alternatively, the similarity threshold can be a configurable threshold configured by the user. In some examples, the similarity threshold can be set by anomaly detection system207and/or control circuitry102by analyzing flow vectors and network flows. For example, the similarity threshold can dynamically change based on the analysis by anomaly detection system207and/or control circuitry102.

As a non-limiting example, and as illustrated inFIG.3B, the similarity threshold can be 0.9. In this example, anomaly detection system207compares, for example, the similarity values302,303, and304(e.g., similarity values between flow vector201aand flow vectors201b-d) to similarity threshold 0.9. In this example, anomaly detection system207determines that flow vector201aand flow vector201dare more similar to one another than to the similarity threshold of 0.9.

As discussed above,FIGS.3A and3Bare provided as examples and do not limit aspects of this disclosure. Also, using a cosine similarity measure for determining a similarity measure between two flow vectors is provided as one example. Other aspects of this disclosure can use other methods to determine a similarity measure between two vectors.

After determining the pairs of flow vectors that are more similar to one another than to the similarity threshold, anomaly detection system207can combine these pairs of flow vectors. For example, in the non-limiting example ofFIG.3B, after determine that flow vectors201aand201dare more similar to one another than to the similarity threshold, anomaly detection system207can combine flow vectors201aand201dinto a new flow vector. According to some examples, combining two flow vectors can include merging the two flow vectors. For example, the merging the flow vectors can include determining (e.g., computing) an element-wise average of the two flow vectors. For example, merging flow vectors201aand201dcan include element-wise average of flow vectors201aand201d(example elements of flow vectors201aand201dare illustrated inFIG.3A).

In some aspects of the disclosure, the element-wise average of flow vectors can include weighted element-wise average of the flow vectors. In these examples, the weight in the weighted element-wise average can include the number of previous merges associated with each flow vector. As a non-limiting example, if flow vector201ais a result of three merges and flow vector201dis a result of five merges, then the weighted element-wise average of flow vectors201aand201dincludes using a weight of three for elements of flow vector201aand using a weight of five for elements of flow vector201d.

Although some examples of this disclosure are discussed with respect to using element-wise average of flow vectors as one example of combining the flow vectors, aspects of this disclosure can use other methods for combining the flow vectors.

Returning to the non-limiting example ofFIG.3B, after determining the similarity values, comparing the similarity values with the similarity threshold, and combining flow vectors (e.g., merging flow vectors201aand201d), the number of flow vectors is reduced from four to three.

According to some aspects of this disclosure, by combining the flow vectors having similarity values more than the similarity threshold, anomaly detection system207is configured to generate one or more flow clusters for each network device (e.g., each of network devices such as devices A, B, C, for example, network endpoints112,114). According to some examples, each flow cluster can represent the flow vectors that are more frequently observed for the network device. Additionally, each flow cluster can be timestamped with the time that the last flow vector was combined (e.g., merged) into it. In some examples, anomaly detection system207can use the similar methods discussed above to combine the flow vector into a corresponding flow cluster. In other words, anomaly detection system207can determine similarity values between the flow vector and the flow clusters associated with the network device, can compare the similarity values to a similarity threshold, and combine flow vector with a flow cluster being more similar to one another than to the similarity threshold. The time that the last flow vector was combined (e.g., merged) with its corresponding flow cluster can be stored with the flow cluster as a timestamp, according to some examples.

In some examples, the flow clusters can be determined by anomaly detection system207, control circuitry102, and/or processing systems150. The flow clusters can be stored, for example, in storage circuitry160.

A non-limiting example of four flow clusters201a-dis illustrated inFIG.4A. In this example, flow clusters401a-dare associated with network flows of, for example, network device A. It is noted that number of flow clusters and their structures are provided inFIG.4Aas an example and they do not limit aspects of this disclosure. As illustrated inFIG.4A, each flow cluster can have a correspond timestamp403a-d, as discussed above.

In some examples, anomaly detection system207can periodically detect and delete the flow cluster(s) with a timestamp that is older than a maximum age threshold. For example, after a time period T, anomaly detection system207can examine the timestamp associated with each flow cluster, compare a difference of the timestamp to the current time with a maximum age threshold, and delete the flow cluster having a timestamp older than the maximum age threshold.

According to some aspects of this disclosure, anomaly detection system207is configured to use the flow clusters associated with a network device to determine any anomaly with the behavior of that network device. For example, anomaly detection system207is configured to receive and/or retrieve a flow vector associated with the network device (e.g., device A such as network endpoint112). In some examples, anomaly detection system207can receive and/or retrieve the flow vector from storage circuitry160. In some examples, the received (and/or retrieved) flow vector is a flow vector previously generated by combining two or more other flow vectors.

In some examples, anomaly detection system207can determine, using a similarity measure, one or more similarity values between the flow vector and one or more flow clusters. In some examples, the similarity measure can include a cosine similarity measure for determining the similarity values between the flow vector and the one or more flow clusters. However, other aspects of this disclosure can use other methods to determine the similarity value between two vectors (e.g., between the flow vector and the one or more flow clusters).

According to some aspects, anomaly detection system207can determine similarity values between one or more flow vectors of the network device with one or more flow clusters of the network device. For example,FIG.4Billustrates one exemplary matrix410that includes the values of pairwise cosine similarity measure of flow vectors411a-c(FV1−FV3) with flow clusters401a-d(FC1-FC4).

For example, value413(value=0.9) is the cosine similarity value between flow vector411aand flow cluster401a. For example, value414(value=0.3) is the cosine similarity value between flow vector411aand flow cluster401b. For example, value415(value=0.7) is the cosine similarity value between flow vector411aand flow cluster401c. For example, value416(value=0.6) is the cosine similarity value between flow vector411aand flow cluster401d. For example, value417(value=0.1) is the cosine similarity value between flow vector411band flow cluster401a. Similar cosine similarity values can be determined for other pairs of flow vector and flow cluster.

According to some aspects, after determining, using the similarity measure, the one or more similarity values between the flow vector and the one or more flow clusters, anomaly detection system207can determine a maximum similarity value as a maximum of the one or more similarity values. According to some examples, anomaly detection system207can be configured to determine the maximum similarity value of each of the flow vectors that anomaly detection system207receives (and/or retrieves). For example, as illustrated inFIG.4B, anomaly detection system207is configured to determine the maximum similarity value for each column of table410. For example, anomaly detection system207can determine the maximum value421a(value=0.9) associated with flow vector411a. For example, anomaly detection system207can determine the maximum value421b(value=0.8) associated with flow vector411b. For example, anomaly detection system207can determine the maximum value421c(value=0.4) associated with flow vector411c.

According to some aspects of the disclosure, anomaly detection system207can be configured to perform additional operation(s) on each determined maximum similarity value for each flow vector. In one example, anomaly detection system207can perform a quantile sketch algorithm on the maximum similarity value(s). In some examples, quantile sketch algorithm can be a stochastic streaming sketch that enables near-real time analysis of the approximate distribution of comparable values from a very large stream in a single pass. In some examples, the quantile sketch algorithm used by anomaly detection system207can include a DDSketch algorithm. DDSketch algorithm can include a fully mergeable, relative-error quantile sketching algorithm with formal guarantees, according to some aspects of this disclosure. By applying the quantile sketch algorithm, anomaly detection system207can generate quantiles with high accuracy while operating within storage requirements. It is noted that DDSketch algorithm is one exemplary algorithm that anomaly detection system207can perform. The embodiments of this disclosure are not limited to this algorithm and anomaly detection system207can use other suitable algorithms.

According to some aspects of this disclosure, anomaly detection system207can use the generated quantiles and a minimum confidence threshold to generate an anomaly threshold. As discussed in more detail below, the anomaly threshold can be used to determine whether the flow vector represents an anomaly in the behavior of the network device. In some examples, the minimum confidence threshold can be provided to anomaly detection system207by, for example, a user (e.g., a network administrator). The minimum confidence threshold can be specific to the network, to the network devices, and/or to the types of network flows. Additionally, or alternatively, anomaly detection system207can determine the minimum confidence threshold by analyzing the network, the network devices, and/or the network flows. In some examples, the minimum confidence threshold can be used as a threshold for confidence in the alerts to be generated. For example, the minimum confidence threshold indicates the confidence that anomaly detection system207has that a given alert is a true positive. As a non-limiting example, the minimum confidence threshold is a value between 0 and 1. A minimum confidence threshold of 0 can indicate that every network flow generates an alert. A minimum confidence threshold of 1 can indicate that an alert is generated if anomaly detection system207is confident that the corresponding flow is anomalous.

According to some examples, the anomaly threshold can be a pre-configured threshold that can be set by a user (e.g., a network administrator). For example, anomaly detection system207can receive the anomaly threshold from the user. Additionally, or alternatively, the anomaly threshold can be a configurable threshold configured by the user. In some examples, the anomaly threshold can be set by anomaly detection system207and/or control circuitry102by analyzing flow vectors and network flows. For example, the anomaly threshold can dynamically change based on the analysis by anomaly detection system207and/or control circuitry102. For example, anomaly detection system207and/or control circuitry102can dynamically update the anomaly threshold based on at least one of the flow associated with the network device or the behavior of the network device.

According to some aspects of the disclosure, anomaly detection system207can further compare the maximum similarity value(s) (and/or the generated quantile(s)) to the anomaly threshold to determine whether the flow vector represents an anomaly in the behavior of the network device. For example, if the maximum similarity value is less than the anomaly threshold, anomaly detection system207can determine (e.g., detect) an anomaly in the behavior of the network device. In response to detecting anomaly, anomaly detection system207can use alert system209and/or API170to alert, for example, a network administrator that an anomaly has been detected in the behavior of the network device. Additionally, or alternatively, in response to detecting the anomaly, anomaly detection system207can generate a new flow cluster based on the flow vector and associate a timestamp to the new flow cluster. The timestamp can indicate a time that the new flow cluster is generated.

If the maximum similarity value is equal to or greater than the anomaly threshold, anomaly detection system207can update the flow cluster associated with the maximum similarity value. For example, anomaly detection system207can combine (e.g., merge) the flow vector with the flow cluster associated with the maximum similarity value. In some examples, the combining can include determine an exponentially weighted moving average between the flow vector and the flow cluster associated with the maximum similarity value. However, other methods can be used for combining the flow vector with the flow cluster associated with the maximum similarity value. Additionally, or alternatively, anomaly detection system207can update a timestamp associated with the flow cluster associated with the maximum similarity measure. The updated timestamp can indicate a time that the flow cluster associated with the maximum similarity value is updated.

As a non-limiting example, the anomaly threshold of 0.55 is considered inFIG.4B. In this non-limiting example, the maximum similarity values421aand421bare greater than anomaly threshold 0.55. In this example, maximum similarity value421ais associated with flow cluster401a. In this example, flow cluster401ais updated by combining flow cluster401awith flow vector411a. In some example, the combining includes determining an exponentially weighted moving average between flow vector411aand the flow cluster401a. The exponentially weighted moving average can be (0.9*FC 1+0.1*FV 1). Additionally, maximum similarity value421bis associated with flow cluster401d. In this example, flow cluster401dis updated by combining flow cluster401dwith flow vector411b. In some example, the combining includes determining an exponentially weighted moving average between flow vector411band the flow cluster401d. The exponentially weighted moving average can be (0.8*FC 4+0.2*FV 2).

According to some aspects of this disclosure, if a network device is a new device in the network (e.g., network110) and system100has not fully developed the flow clusters of the new device, anomaly detection system207can be configured to develop the flow clusters as discussed above. In some examples, if anomaly detection system207does not find a flow cluster that is similar to a receive flow vector for the new device, that can be because the flow clusters are not fully developed yet. In these examples, for a given number of detected anomalies, anomaly detection system207may not generate alerts but develop the flow clusters. This given number of detected anomalies can be specific to the network, the network device, the network flows, etc.

According to some aspects of this disclosure, system100, control circuitry102, and/or anomaly detections system207can detect anomalies in network behavior to provide fine-grained root explanation. For example, the methods and systems of this disclosure can identify which network flows are unusual at a given point in time for a specific network device using, for example, the network device's previous history. Additionally, or alternatively, the systems and methods of this disclosure can operate within specific memory/storage requirements while providing anomaly detection. These systems can enable “commodity hardware” to operate the anomaly detection methods on a large installed base. Additionally, or alternatively, the methods and systems of this disclosure can provide the end-user a simple way to specify a minimum confidence of the alerts being generated by, for example, providing the anomaly threshold. In some examples, the systems and methods of this disclosure can dynamically adjust the confidence sensitivity based on the behavior of the network, the behavior of the network device, the network data being ingested, etc. rather than relying on hardcoded parameters.

In a non-limiting example, the anomaly detection systems and methods of this disclosure can be applied to networks having Internet of Things (“IoT”) devices as endpoint devices. Additionally, or alternatively, aspects of this disclosure can be used for networks in enterprises where employees use their personal devices network endpoints (e.g., “Bring Your Own Device”). Aspects of this disclosure can be used for early detection of anomaly with flow level and/or device level detection. In some case, the anomaly can be based on security attacks, malware, ransomware, etc. on the network devices. Aspects of this disclosure can detect these security attacks by monitoring the network devices at a flow level and provide alerts and/or protective solutions.

FIG.5illustrates an example method500for detecting an anomaly in a behavior of a network device, according to some embodiments of the disclosure. As a convenience and not a limitation,FIG.5may be described with regard to elements ofFIGS.1-4. Method500may represent the operation of a system (e.g., control circuitry102and/or anomaly detection system207) implementing anomaly detection methods of this disclosure. Method500may also be performed by computer system800ofFIG.8. But method500is not limited to the specific embodiments depicted in those figures, and other systems may be used to perform the method as will be understood by those skilled in the art. It is to be appreciated that not all operations may be needed, and the operations may not be performed in the same order as shown inFIG.5.

At502, a network flow associated with a network device is received. For example, control circuitry102and/or anomaly detection system207receives the network flow associated with the network device (e.g., network endpoint112). At504, the network flow is compared to one or more flow clusters associated with the network device. For example, control circuitry102and/or anomaly detection system207compares the received network flow (and/or one or more parameters associated with the network flow) to one or more flow clusters.

At506, it is determined, based on the comparing and at a flow level, whether the network flow indicates an anomaly in a behavior of the network device. For example, control circuitry102and/or anomaly detection system207can use the results of the comparison to determine whether an anomaly has occurred. In some examples, in response to determining that the network flow indicates the anomaly in the behavior of the network device, control circuitry102and/or anomaly detection system207can update one of the one or more flow clusters and can update a timestamp associated with the updated flow cluster. The updated timestamp can indicate a time that the flow cluster is updated. In some examples, in response to determining that the network flow does not indicate the anomaly in the behavior of the network device, control circuitry102and/or anomaly detection system207can generate a new flow cluster based on the received network flow and associate a timestamp to the new flow cluster. The timestamp can indicate a time that the new flow cluster is generated.

One example of steps502-506is further discussed with respect toFIG.6.

FIG.6illustrates an example method600for an anomaly detection system detecting an anomaly in a behavior of a network device, according to some embodiments of the disclosure. As a convenience and not a limitation,FIG.6may be described with regard to elements ofFIGS.1-5. Method600may represent the operation of a system (e.g., control circuitry102and/or anomaly detection system207) implementing anomaly detection methods of this disclosure. Method600may also be performed by computer system800ofFIG.8. But method600is not limited to the specific embodiments depicted in those figures and other systems may be used to perform the method as will be understood by those skilled in the art. It is to be appreciated that not all operations may be needed, and the operations may not be performed in the same order as shown inFIG.6.

At602, a flow vector corresponding to a flow associated with a network device is received. For example, anomaly detections system207retrieves and/or receives the flow vector corresponding to the flow associated with the network device. According to some embodiments, the received flow vector can be a combination of two or more flow vectors.

At604, one or more similarity values between the flow vector and one or more flow clusters associated with the network device are determined. For example, anomaly detection system207determine the similarity values using a similarity measure. In some examples, the similarity measure can be a cosine similarity measure.

At606, a maximum similarity value is determined as a maximum of the one or more similarity values. For example, anomaly detections system207can determine which one of the one or more flow clusters is more similar than the others to the received flow vector. At608, the maximum similarity value is compared to a threshold (e.g., the anomaly threshold discussed above.) In some examples, anomaly detection system207(and/or system100) can receive the threshold from, for example, a user (e.g., a network administrator). Additionally, or alternatively, the threshold can be dynamically updated based on at least one of the flow associated with the network device or a behavior of the network device.

At610, it is determined whether the maximum similarity value is less than the threshold. In response to the maximum similarity measure being less than the threshold, method600moves to612. At612, it is determined that there is an anomaly in the network device. For example, anomaly detection system207detects the anomaly in the behavior of the network device. In some examples, detecting the anomaly in the behavior of the network device can include generating a new flow cluster based on the flow vector. Also, the detecting can include associating a timestamp to the new flow cluster. The timestamp can indicate a time that the new flow cluster is generated. Anomaly detection system207can generate the new flow cluster and associate the timestamp after detecting the anomaly, according to some examples. After detecting the anomaly (or as part of the anomaly detection process), anomaly detection system207(alone or in combination with alert system209and/or API170) can generate an alert (e.g., an alert message). The alert can be sent to, for example, one or more network users, one or more network administrators, one or more network devices, the device with detected anomaly, or the like. In some examples, the alert is based on the detected anomaly. For example, the alert can include information associated with the network device with the anomaly, information associated with the flow that triggered the anomaly, information about the flow vector and/or flow cluster that triggered the anomaly, one or more timestamps, etc.

Returning to610, in response to the maximum similarity value being equal to or greater than the threshold, method600moves to614. At614, a flow cluster associated with the maximum similarity value is updated. For example, anomaly detection system207can combine the received flow vector with the flow cluster associated with the maximum similarity value. The combining can include determining an exponentially weighted moving average between the flow vector and the flow cluster associated with the maximum similarity value. The combining can also include updating a timestamp associated with the flow cluster associated with the maximum similarity value. The updated timestamp can indicate a time that the flow cluster associated with the maximum similarity value is updated. In some examples, anomaly detection system207can update the timestamp after combining the received flow vector with the flow cluster associated with the maximum similarity value.

According to some aspects of the disclosure, method600can be performed each time anomaly detection system207receives a flow vector for each network device. Additionally, or alternatively, method600can be performed when anomaly detection system207receives a number of flow vectors that is more than a threshold. In some aspects, method600can be performed based on a time period.

FIG.7illustrates an example method700for an anomaly detection system generating a flow vector based on two or more flow vectors, according to some embodiments of the disclosure. As a convenience and not a limitation,FIG.7may be described with regard to elements ofFIGS.1-6. Method700may represent the operation of a system (e.g., control circuitry102and/or anomaly detection system207) implementing anomaly detection methods of this disclosure. Method700may also be performed by computer system800ofFIG.8. But method700is not limited to the specific embodiments depicted in those figures and other systems may be used to perform the method as will be understood by those skilled in the art. It is to be appreciated that not all operations may be needed, and the operations may not be performed in the same order as shown inFIG.7. According to some examples, method700can be performed as part of step602of method600ofFIG.6.

For example, at702, a first initial flow vector corresponding to a first flow associated with a network device is received. For example, anomaly detection system207receives and/or retrieves the first initial flow vector (e.g., flow vector201a) corresponding to a first flow associated with a network device (e.g., device A, such as network endpoint112).

At704, a second initial flow vector corresponding to a second flow associated with the network device is received. For example, anomaly detection system207receives and/or retrieves the second initial flow vector (e.g., flow vector201d) corresponding to a second flow associated with the network device (e.g., device A, such as network endpoint112).

At706, a similarity value between the first initial flow vector and the second initial flow vector is determined. For example, anomaly detection system207determines a similarity value (using for example cosine similarity measure) between the first initial flow vector (e.g., flow vector201a) and the second initial flow vector (e.g., flow vector201d).

At708, the similarity value is compared to a similarity threshold. For example, anomaly detection system207compares the determined similarity value to the similarity threshold. At710, in response to the similarity value being equal to or greater than the similarity threshold, a flow vector is generated. For example, anomaly detection system207generates the flow vector in response to the similarity value being equal to or greater than the similarity threshold. As discussed above, in some examples, generating the flow vector can include combining (e.g., creating a weighted average of) the first initial flow vector and the second initial flow vector. In some examples, the first and second initial flow vectors are stored in contiguous memory spaces in, for example, storage circuitry160ofFIG.1.

Various embodiments may be implemented, for example, using one or more well-known computer systems, such as computer system800shown inFIG.8. One or more computer systems800may be used, for example, to implement any aspect of the disclosure discussed herein, as well as combinations and sub-combinations thereof.

Computer system800may include one or more processors (also called central processing units, or CPUs), such as a processor804. Processor804may be connected to a communication infrastructure or bus806.

Computer system800may also include customer input/output device(s)803, such as monitors, keyboards, pointing devices, etc., which may communicate with communication infrastructure806through customer input/output interface(s)802.

One or more of processors804may be a graphics processing unit (GPU). In an embodiment, a GPU may be a processor that is a specialized electronic circuit designed to process mathematically intensive applications. The GPU may have a parallel structure that is efficient for parallel processing of large blocks of data, such as mathematically intensive data common to computer graphics applications, images, videos, etc.

Computer system800may also include a main or primary memory808, such as random access memory (RAM). Main memory808may include one or more levels of cache. Main memory808may have stored therein control logic (i.e., computer software) and/or data.

Computer system800may also include one or more secondary storage devices or memory810. Secondary memory810may include, for example, a hard disk drive812and/or a removable storage device or drive814. Removable storage drive814may be a floppy disk drive, a magnetic tape drive, a compact disk drive, an optical storage device, tape backup device, and/or any other storage device/drive.

Removable storage drive814may interact with a removable storage unit818. Removable storage unit818may include a computer usable or readable storage device having stored thereon computer software (control logic) and/or data. Removable storage unit818may be a floppy disk, magnetic tape, compact disk, DVD, optical storage disk, and/any other computer data storage device. Removable storage drive814may read from and/or write to removable storage unit818.

Secondary memory810may include other means, devices, components, instrumentalities or other approaches for allowing computer programs and/or other instructions and/or data to be accessed by computer system800. Such means, devices, components, instrumentalities or other approaches may include, for example, a removable storage unit822and an interface820. Examples of the removable storage unit822and the interface820may include a program cartridge and cartridge interface (such as that found in video game devices), a removable memory chip (such as an EPROM or PROM) and associated socket, a memory stick and USB port, a memory card and associated memory card slot, and/or any other removable storage unit and associated interface.

Computer system800may further include a communication or network interface824. Communication interface824may enable computer system800to communicate and interact with any combination of external devices, external networks, external entities, etc. (individually and collectively referenced by reference number828). For example, communication interface824may allow computer system800to communicate with external or remote devices828over communications path826, which may be wired and/or wireless (or a combination thereof), and which may include any combination of LANs, WANs, the Internet, etc. Control logic and/or data may be transmitted to and from computer system800via communication path826.

Computer system800may also be any of a personal digital assistant (PDA), desktop workstation, laptop or notebook computer, netbook, tablet, smart phone, smart watch or other wearable, appliance, part of the Internet-of-Things, and/or embedded system, to name a few non-limiting examples, or any combination thereof.

Computer system800may be a client or server, accessing or hosting any applications and/or data through any delivery paradigm, including but not limited to remote or distributed cloud computing solutions; local or on-premises software (“on-premise” cloud-based solutions); “as a service” models (e.g., content as a service (CaaS), digital content as a service (DCaaS), software as a service (SaaS), managed software as a service (MSaaS), platform as a service (PaaS), desktop as a service (DaaS), framework as a service (FaaS), backend as a service (BaaS), mobile backend as a service (MBaaS), infrastructure as a service (IaaS), etc.); and/or a hybrid model including any combination of the foregoing examples or other services or delivery paradigms.

Any applicable data structures, file formats, and schemas in computer system800may be derived from standards including but not limited to JavaScript Object Notation (JSON), Extensible Markup Language (XML), Yet Another Markup Language (YAML), Extensible Hypertext Markup Language (XHTML), Wireless Markup Language (WML), MessagePack, XML User Interface Language (XUL), or any other functionally similar representations alone or in combination. Alternatively, proprietary data structures, formats or schemas may be used, either exclusively or in combination with known or open standards.

In some embodiments, a tangible, non-transitory apparatus or article of manufacture comprising a tangible, non-transitory computer useable or readable medium having control logic (software) stored thereon may also be referred to herein as a computer program product or program storage device. This includes, but is not limited to, computer system800, main memory808, secondary memory810, and removable storage units818and822, as well as tangible articles of manufacture embodying any combination of the foregoing. Such control logic, when executed by one or more data processing devices (such as computer system800), may cause such data processing devices to operate as described herein.

Based on the teachings contained in this disclosure, it will be apparent to persons skilled in the relevant art(s) how to make and use embodiments of this disclosure using data processing devices, computer systems and/or computer architectures other than that shown inFIG.8. In particular, embodiments can operate with software, hardware, and/or operating system implementations other than those described herein.

It is to be appreciated that the Detailed Description section, and not any other section, is intended to be used to interpret the claims. Other sections can set forth one or more but not all exemplary embodiments as contemplated by the inventor(s), and thus, are not intended to limit this disclosure or the appended claims in any way.

While this disclosure describes exemplary embodiments for exemplary fields and applications, it should be understood that the disclosure is not limited thereto. Other embodiments and modifications thereto are possible, and are within the scope and spirit of this disclosure. For example, and without limiting the generality of this paragraph, embodiments are not limited to the software, hardware, firmware, and/or entities illustrated in the figures and/or described herein. Further, embodiments (whether or not explicitly described herein) have significant utility to fields and applications beyond the examples described herein.

Embodiments have been described herein with the aid of functional building blocks illustrating the implementation of specified functions and relationships thereof. The boundaries of these functional building blocks have been arbitrarily defined herein for the convenience of the description. Alternate boundaries can be defined as long as the specified functions and relationships (or equivalents thereof) are appropriately performed. Also, alternative embodiments can perform functional blocks, steps, operations, methods, etc. using orderings different than those described herein.

References herein to “one embodiment,” “an embodiment,” “an example embodiment,” or similar phrases, indicate that the embodiment described can include a particular feature, structure, or characteristic, but every embodiment can not necessarily include the particular feature, structure, or characteristic. Moreover, such phrases are not necessarily referring to the same embodiment. Further, when a particular feature, structure, or characteristic is described in connection with an embodiment, it would be within the knowledge of persons skilled in the relevant art(s) to incorporate such feature, structure, or characteristic into other embodiments whether or not explicitly mentioned or described herein. Additionally, some embodiments can be described using the expression “coupled” and “connected” along with their derivatives. These terms are not necessarily intended as synonyms for each other. For example, some embodiments can be described using the terms “connected” and/or “coupled” to indicate that two or more elements are in direct physical or electrical contact with each other. The term “coupled,” however, can also mean that two or more elements are not in direct contact with each other, but yet still co-operate or interact with each other.

The breadth and scope of this disclosure should not be limited by any of the above-described exemplary embodiments, but should be defined only in accordance with the following claims and their equivalents.