Patent Document ID: 9191398
Application ID: 13262112
Patent Flag: 1

Claim One:
1. A method for classifying intrusion alerts in a computer network, the method comprising: a) monitoring traffic data in a computer network; b) detecting an occurrence of an intrusion from the monitored traffic data; c) providing an intrusion alert and data in relation to the intrusion alert in response to the detection of the occurrence of the intrusion; d) generating a statistical analysis of the data in relation to the intrusion alert, the data in relation to the intrusion alert as provided in response to the detection of the occurrence of the intrusion; and e) classifying the intrusion alert as provided in the response to the detection of the occurrence of the intrusion, based on said statistical analysis of the data in relation to the intrusion alert, the classifying the intrusion alert providing an attack classification that identifies a context of the detected intrusion with respect to a vulnerability exploited and a target, wherein generating said statistical analysis of the data in relation to the intrusion alert comprises generating information about a statistical distribution of n-grams using an n-gram analysis in at least a part of the data in relation to the intrusion alert, when n=1, the n-gram analysis being a 1-gram analysis, storing average byte frequency and standard deviation values, and when n>1 a fact is stored that a certain n-gram of the n-grams occurred without storing the average byte frequency and standard deviation values, wherein generating the statistical analysis of the data in relation to the intrusion alert comprises applying a bloom filter on the statistical distribution of n-grams or storing the statistical distribution of n-grams in bitmap data structures, and wherein classifying the intrusion alert based on said statistical analysis comprises: e1) comparing at least a part of the statistical analysis, the statistical analysis comprising the statistical distribution of the n-grams, with at least a part of a model of intrusion alerts with predefined alert classes, using a machine learning technique; and e2) assigning one of the predefined alert classes to the intrusion alert based on the comparison, thereby providing the attack classification that identifies the context of the detected intrusion with respect to the vulnerability exploited and the target.