Systems and methods for capturing or replaying time-series data

Abstract

Provided is an intrusion detection system configured to detect anomalies indicative of a zero-day attack by statistically analyzing substantially all traffic on a network in real-time. The intrusion detection system, in some aspects, includes a network interface; one or more processors communicatively coupled to the network interface; system memory communicatively coupled to the processors. The system memory, in some aspects, stores instructions that when executed by the processors cause the processors to perform steps including: buffering network data from the network interface in the system memory; retrieving the network data buffered in the system memory; applying each of a plurality of statistical or machine-learning intrusion-detection models to the retrieved network data; aggregating intrusion-likelihood scores from each of the intrusion-detection models in an aggregate score, and upon the aggregate score exceeding a threshold, outputting an alert.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS[0001]The present application is a continuation of U.S. patent application Ser. No. 13 / 648,176, filed Oct. 9, 2012.BACKGROUND[0002]1. Field of the Invention[0003]The present disclosure relates generally to data processing and, more specifically, to capturing, replaying, and analyzing time-series data.[0004]2. Description of the Related Art[0005]In recent years, it has become increasingly difficult to detect malicious activity carried on networks. The volume of traffic moving through a given node on modern networks is substantially larger than even in the recent past, making it more difficult to assess whether any particular portion of the data conveyed will cause harm. Further, the sophistication of attacks has increased substantially, as entities with greater resources, such as organized crime and state actors, have directed resources towards developing new modes of attack. Many existing intrusion detection systems fail to assess network traff...

AI Technical Summary

Benefits of technology

The present invention is an intrusion detection system that can detect anomalies in network traffic in real-time. The system includes a network interface, one or more processors, system memory, and system storage. The system memory buffers network data from the network interface and applies statistical or machine-learning intrusion-detection models to the data. The models analyze the data to determine if it indicates a potential attack. The system can also pre-process the network data and store it in a buffer for further analysis. The technical effect of this invention is to provide a more effective way to detect and prevent unauthorized attacks on computer networks.

Problems solved by technology

In recent years, it has become increasingly difficult to detect malicious activity carried on networks.

The volume of traffic moving through a given node on modern networks is substantially larger than even in the recent past, making it more difficult to assess whether any particular portion of the data conveyed will cause harm.

Many existing intrusion detection systems fail to assess network traffic at the rates supported by modern networking equipment and at desired levels of accuracy and are, thus, vulnerable to being overwhelmed, for example, with a denial of service attack.

Similar problems are present in other fields in which data is captured, replayed, or analyzed at relatively high rates.

Images