Patent Document ID: 9386030
Application ID: 14029474
Patent Flag: 1

Claim One:
1. A method for detecting and predicting network attacks, the method comprising: acquiring attack alerts and indicator values representative of network traffic; converting the alerts and indicator values into vectors; using the vectors to generate training data representative of the alerts and the indicator values; implementing a learning algorithm to process the training data to generate decision rules; and performing network attack detection or prediction based on the generated decision rules, the performing network attack detection or prediction comprising: processing network traffic to generate indicator values, each indicator value indicative of whether a respective attack characteristic is observed in the network traffic, wherein the indicator values are representative of indicators that include volume of traffic, rate of spoofing, rate of occurrence of unique source addresses, rate of occurrence of unique geographical locations of the source of traffic, ratio of SYN to non-SYN traffic and rate of occurrence of malicious source addresses, wherein each indicator value has a respective dynamic threshold associated therewith based on which the indicator value is set to indicate whether the respective attack characteristic is observed, and wherein the dynamic threshold varies over time based at least in part on historical values for the dynamic threshold; and determining, based on the generated indicator values, whether a network attack is indicated by the network traffic.