Patent Document ID: 9635050
Application ID: 14338526
Patent Flag: 1

Claim One:
1. A method, comprising: receiving, at a device in a network, data flows in a network; providing information relating to the received data flows to a machine learning attack detector that is configured to generate an attack detection indication by analyzing the provided information; and in response to receiving the attack detection indication from the machine learning attack detector, performing a traffic segregation procedure to segregate normal traffic flows in the received data flows from attack traffic flows, the traffic segregation procedure including: setting the anomaly threshold value to an initial value, computing an anomaly score for each of the received data flows, the anomaly score computed for each received data flow based on a degree of divergence between the data flows and an expected traffic model, determining a subset of the received data flows that have an anomaly score that is lower than or equal to an anomaly threshold value, providing information relating to the subset of the received data flows to the machine learning attack detector, performing the traffic segregation procedure on the subset of received data flows until an attack is no longer detected by the machine learning attack detector in the subset of received data flows provided to the machine learning attack detector, and iteratively decreasing the anomaly threshold value in response to each subsequent attack detection indication.