Systems and methods for capturing or analyzing time-series data

Abstract

Provided is an intrusion detection system configured to detect anomalies indicative of a zero-day attack by statistically analyzing substantially all traffic on a network in real-time. The intrusion detection system, in some aspects, includes a network interface; one or more processors communicatively coupled to the network interface; system memory communicatively coupled to the processors. The system memory, in some aspects, stores instructions that when executed by the processors cause the processors to perform steps including: buffering network data from the network interface in the system memory; retrieving the network data buffered in the system memory; applying each of a plurality of statistical or machine-learning intrusion-detection models to the retrieved network data; aggregating intrusion-likelihood scores from each of the intrusion-detection models in an aggregate score, and upon the aggregate score exceeding a threshold, outputting an alert.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS[0001]The present application is a continuation of U.S. patent application Ser. No. 13 / 648,176, filed Oct. 9, 2012.BACKGROUND[0002]1. Field of the Invention[0003]The present disclosure relates generally to data processing and, more specifically, to capturing, replaying, and analyzing time-series data.[0004]2. Description of the Related Art[0005]In recent years, it has become increasingly difficult to detect malicious activity carried on networks. The volume of traffic moving through a given node on modern networks is substantially larger than even in the recent past, making it more difficult to assess whether any particular portion of the data conveyed will cause harm. Further, the sophistication of attacks has increased substantially, as entities with greater resources, such as organized crime and state actors, have directed resources towards developing new modes of attack. Many existing intrusion detection systems fail to assess network traff...

AI Technical Summary

Benefits of technology

The present invention is an intrusion detection system that can detect zero-day attacks in real-time by analyzing network data in real-time. The system includes a network interface, one or more processors, system memory, and system storage. The system can buffer network data from the network interface, apply statistical or machine-learning intrusion-detection models to the data, and aggregate the results to output an alert if an anomaly is detected. The system can also pre-process the network data and move it to the system memory before sending it to the network interface. The technical effects of the invention include improved detection of zero-day attacks and improved efficiency in detecting and responding to intrusions in real-time.

Problems solved by technology

In recent years, it has become increasingly difficult to detect malicious activity carried on networks.

The volume of traffic moving through a given node on modern networks is substantially larger than even in the recent past, making it more difficult to assess whether any particular portion of the data conveyed will cause harm.

Many existing intrusion detection systems fail to assess network traffic at the rates supported by modern networking equipment and at desired levels of accuracy and are, thus, vulnerable to being overwhelmed, for example, with a denial of service attack.

Similar problems are present in other fields in which data is captured, replayed, or analyzed at relatively high rates.

Images