Patent Document ID: 20140283052
Application ID: 13828510
Patent Status: 0

Claim One:
1. A process for defending a network of computers against attack, comprising: inspecting network traffic for malicious data using a signature-based sensor; and simultaneously inspecting said network traffic for malicious data using a machine-learning based sensor; wherein said machine-learning based sensor has been trained to detect attacks on blind spots of said signature-based sensor by a process comprising; modifying patterns of attack on said signature-based sensor to compile blind spot malicious samples that avoid intrusion detection by said signature-based sensor; tagging said blind spot malicious samples as tagged malicious samples; acquiring samples of normal network traffic patterns; sanitizing a normal portion of said samples of normal network traffic patterns to obtain normal samples; tagging said normal samples as tagged normal samples; and tagging a portion of said samples of normal network traffic that are not said normal portion as untagged samples, presenting a machine-learning training dataset comprising said tagged malicious samples, said tagged normal samples, and said untagged samples, to said machine-learning based sensor to create models of normal network traffic and to detect samples that fail to conform to said models of normal network traffic as malicious data; iteratively testing accuracy of said machine-learning based sensor using said models of normal network traffic to reduce false positives of said machine-learning based sensor and to achieve iteratively tested models of normal network traffic; whereby said machine-learning sensor recognizes malicious data as data that fails to conform to said iteratively tested models of normal traffic, with a reduced rate of false positives; and whereby said signature-based sensor recognizes as malicious data any network traffic that matches signatures provided to said signature-based sensor.