System and method for real-time network traffic analysis

Abstract

To provide a system, method and program for detecting malicious traffic flows in a network.SOLUTION: A system calculates, based on packet information received over a network, inter-arrival times and packet durations for a plurality of data packets, filters the packet information to remove noise, and generates at least one histogram based on the packet information, the inter-arrival times, and the packet durations. In addition, the system generates a power spectral density estimate based on the packet information, the inter-arrival times, and the packet durations, analyzes the at least one histogram and the power spectral density estimate to detect one or more unexpected data flows, and reports the one or more unexpected data flows.SELECTED DRAWING: Figure 18

Description

Background Art

[0001] This field generally relates to network traffic analysis, and more specifically to detecting malicious traffic flows within traffic in a known controlled and constantly changing environment.

[0002] Communication systems (including communication satellites) can be targets of malicious actors. Detecting an intrusion by such a malicious actor can be difficult. This is because it may not be realistic to monitor all communications between a satellite and other communication systems, as the configurations and topologies of devices and networks are constantly changing over time.

[0003] Furthermore, much of the traffic flow between network devices (such as satellites) and other systems is encrypted, which can slow down the analysis of the transmitted messages and may even make the analysis impossible. In many situations, an intrusion detection system needs to be able to analyze messages in real time and handle intermittent or short messages. Therefore, additional security or systems that can improve the detection capabilities of communication systems would be advantageous.

[0004] This "Background Art" section is for introducing readers to various aspects of the technical field related to various aspects of the present disclosure, and the description and / or claims of the present disclosure will be made below. This description section is considered useful in providing readers with background technical information to facilitate a deeper understanding of various aspects of the present disclosure. Therefore, these descriptions should be understood as being read from this perspective and not as admissions of prior art.

Summary of the Invention

[0005] In one embodiment, a system is provided for detecting malicious traffic flows in a network. This system includes a computer system including at least one processor communicating with at least one memory device. The at least one processor is programmed to calculate the arrival interval and packet duration of a plurality of data packets based on received packet information relating to a plurality of data packets transmitted over the network. This at least one processor is also programmed to filter the packet information to remove noise. The at least one processor is further programmed to generate at least one histogram based on the packet information, arrival interval, and packet duration. The at least one processor is further programmed to generate a power spectral density estimate based on the packet information, arrival interval, and packet duration. In addition, the at least one processor is programmed to analyze the at least one histogram and power spectral density estimate to detect one or more unexpected data flows. Furthermore, the at least one processor is programmed to report these one or more unexpected data flows.

[0006] In another embodiment, a method is provided for detecting malicious traffic flows in a network. This method is implemented by a computer system including at least one processor communicating with at least one memory device. The method further includes the processor receiving packet information of a plurality of data packets transmitted over the network. The method also includes the processor calculating the arrival interval of the plurality of data packets based on the packet information. In addition, the method includes the processor calculating the packet duration of the plurality of data packets based on the packet information. Furthermore, the method includes the processor filtering the packet information to remove noise. Furthermore, the method includes the processor generating at least one histogram based on the packet information, arrival interval, and packet duration. In addition, the method also includes the processor generating a power spectral density estimate based on the packet information, arrival interval, and packet duration. Furthermore, the method further includes the processor analyzing at least one histogram and the power spectral density estimate to detect one or more unexpected data flows. Furthermore, the method also includes the processor reporting one or more unexpected data flows.

[0007] In a further embodiment, a system is provided for detecting malicious traffic flows in a network. This system includes a computer system, which includes at least one processor communicating with at least one memory device. This at least one processor is programmed to receive security policies, which include configuration data, and which are executed on the system. The at least one processor is also programmed to receive packet information of a plurality of data packets transmitted over the network. The at least one processor is further programmed to calculate the arrival interval of the plurality of data packets based on the packet information and the security policy. In addition, the at least one processor is programmed to calculate the packet duration of the plurality of data packets based on the packet information. Furthermore, the at least one processor is programmed to filter the packet information to remove noise based on the security policy. Furthermore, the at least one processor is programmed to generate at least one histogram based on the packet information, arrival interval, and packet duration. In addition, the at least one processor is also programmed to generate a power spectral density estimate based on the packet information, arrival interval, and packet duration. In addition, at least one processor is further programmed to analyze at least one histogram and power spectral density estimate based on security policies to detect one or more unexpected data flows. Furthermore, at least one processor is also programmed to report one or more unexpected data flows.

[0008] Various improved versions of the features described in relation to the embodiments described above exist. Furthermore, additional features may be incorporated into the embodiments described above. Such improved versions and additional features may exist individually or in some combination. For example, the various features described later in relation to any of the examples provided may be incorporated into any of the embodiments described above, either individually or in some combination.

[0009] The figures described below depict various aspects of the systems and methods disclosed therein. Each figure should be understood as illustrating an example of a particular aspect of the disclosed systems and methods, and is intended to correspond to a feasible example of such an aspect. Furthermore, the following explanations refer to the reference numerals included in the figures below whenever possible, and in these figures, features described in multiple figures are referred to by the same reference numeral.

[0010] While the diagrams presented here illustrate the configuration, please understand that the examples in this book are not strictly limited to the configurations and instruments shown in the following diagrams. [Brief explanation of the drawing]

[0011] [Figure 1] An example block diagram of an exemplary communications satellite system is shown in this disclosure. [Figure 2] Figure 1 shows a block diagram of the exemplary network in the first network configuration, which includes the exemplary communications satellite system shown. [Figure 3] Figure 2 shows a block diagram illustrating the transition from the first network configuration to the second network configuration. [Figure 4] This document presents an exemplary algorithm for analyzing traffic flow data to detect malicious data flows in the system shown in Figure 1 and the network shown in Figure 2. [Figure 5] Figure 4 shows the first graph of the first analysis of traffic flow using the algorithm shown. [Figure 6] Figure 5 shows the first histogram of the first analysis of the traffic flow. [Figure 7] Figure 4 shows the second graph of the second analysis of traffic flow using the algorithm shown. [Figure 8] Figure 7 shows the second histogram of the second analysis of the traffic flow. [Figure 9]Figure 4 shows the third graph of the third analysis of traffic flow using the algorithm shown. [Figure 10] Figure 9 shows the third histogram of the third analysis of the traffic flow. [Figure 11] Figure 4 shows the fourth graph of the fourth analysis of traffic flow using the algorithm shown. [Figure 12] Figure 11 shows the fourth histogram of the fourth analysis of the traffic flow. [Figure 13] Figure 4 shows the fifth graph of the fifth analysis of traffic flow using the algorithm shown. [Figure 14] Figure 13 shows the fifth histogram of the fifth analysis of the traffic flow. [Figure 15] Figure 4 shows the sixth graph of the sixth analysis of traffic flow using the algorithm shown. [Figure 16] Figure 15 shows the sixth histogram of the sixth analysis of the traffic flow. [Figure 17] Figure 2 shows a simplified block diagram of an exemplary communications network analyzer (CNA) system for analyzing communication traffic on the network shown. [Figure 18] Figure 17 shows an exemplary process for analyzing communication traffic on the network shown in Figure 2, using the system shown in Figure 17. [Figure 19] Figure 17 shows an exemplary configuration of a user computer device used in the system shown in this disclosure. [Figure 20] Figure 17 shows an exemplary configuration of a server computer device used in the system shown in this disclosure. [Modes for carrying out the invention]

[0012] This field generally concerns breach detection, and more specifically, the detection of malicious traffic flows within encrypted traffic in known, controlled, and constantly changing environments. For example, a communications network analyzer (CNA) computer device determines a communications network based on the available communications devices at the time and activates an algorithm using security policies to monitor packets transmitted over such communications network. The systems and methods described in this document are designed to enable real-time traffic monitoring but are independent of the communications protocols used on the network.

[0013] In typical network traffic, various packet types (flows) may not arrive at a given rate. This can lead to problems in distinguishing pseudo-packet types with lower arrival frequencies using standard techniques. In addition, various packet types may have different durations, and in this case, using standard techniques may result in reduced energy and signatures in shorter-duration packets.

[0014] The analysis techniques described in this book combine power spectral density (PSD) estimation with histogram data to enhance the energy of packet types (flows) with low arrival frequencies or short durations, enabling improved detection and analysis of such flows. This analysis technique generates a clear and visible signature for all packet types (flows), enhancing the signature of the aperiodic pseudo-packet arrival times. This analysis technique further reduces the amount of capture data required for effective analysis. In most cases, if more accurate analysis is required, it becomes necessary to analyze more data. However, in many situations (such as real-time analysis), there may not be much processing data and / or processing time. By enhancing the signature and visibility of packets, the amount of data required for proper analysis of network traffic can be reduced. By combining PSD analysis with histogram data, the system can add resolution and / or accuracy to the information about the packets being analyzed (such as, but not limited to, the number of packets in each flow, the type of packet, the packet size, the frequency, and the data rate).

[0015] The systems and methods disclosed in this book are described as being executed by a CNA computer device. In one example, the CNA computer device is the data plane of a switch of a network communication device (when traffic passes through this switch). In other examples, the CNA computer device can also be any other device configured to read messages (such as packets), either internal or external to the data plane, such as a network card, a repeater hub, a network bridge, a switch hub, a bridge hub, a MAC bridge, a tap port, or the like, but is not limited thereto.

[0016] The CNA computer device determines information about packets arriving from a network and / or packets transmitted to a network. This information includes packet arrival time (seconds), packet length (bits), and packet content bit rate (bits / second). The CNA computer device uses this information to analyze the packets and, by analyzing the presence, shape, form, and / or frequency of the packets being analyzed by the CNA computer device, finds the presence of an undesirable series or set of packets.

[0017] The CNA computer device generates histogram and PSD data based on the information about the packets and compares it with an expected flow to detect an unexpected data flow in the traffic.

[0018] This document describes computer systems (such as the CNA computer device and related computer systems). As described in this document, such computer systems include a processor and a memory. However, any of the processors in the computer devices mentioned in this document may also refer to one or more processors, and the processors may exist within one computing device or within multiple computing devices operating in parallel. In addition, any of the memories in the computer devices mentioned in this document may also refer to one or more memories, and the memories may exist within one computing device or within multiple computing devices operating in parallel.

[0019] The systems and processes are not limited to the specific examples described in this document. In addition, the components of each system and each process are individually practicable and separate from the other components and processes described in this document. Each of the components and processes may also be used in combination with other assembly packages and processes.

[0020] Figure 1 shows a block diagram of an exemplary communications satellite system 100 according to an example of the present disclosure. The exemplary satellite system 100 includes a network processor 102, a storage unit 104, and a payload processor 106, all connected to an Ethernet switch 108. The Ethernet switch 108 is further connected to one or more bus controllers 110, which facilitate communication with a satellite bus subsystem 112 and a packet switch 114. In some examples, the packet switch 114 is a secure, programmable data plane, which enables the execution of algorithms for monitoring a plurality of ports 116 used for communication connections 118 with the satellite 100. The plurality of connections 118 may include, but are not limited to, an interstellar link (ISL), a downlink (DL), and a port 116 that can function as either an ILS or DL.

[0021] Figure 2 shows a block diagram of an exemplary network 200 in a first network configuration 202, which includes an exemplary communications satellite system 100 (see Figure 1). Network 200 includes multiple satellites 100. As illustrated in the first network configuration 202, the multiple satellites 100 are in multiple orbits (e.g., geostationary Earth orbit (GEO) 204, medium Earth orbit (MEO) 206, and low Earth orbit (LEO) 208). Network 200 may also include satellites 100 in non-geostationary (NGSO) orbits around highly elliptical orbits, lunar orbits, or any other celestial body (if the connectivity and location of such satellites are known and / or predictable).

[0022] Network 200 also includes multiple user devices 210. User devices 210 may include aircraft, spacecraft, ships, ground-based vehicles, ground stations, and / or space stations (if user devices 210 are connected to Network 200).

[0023] As illustrated in the first network configuration 202, each satellite 100 has one or more ISL connections 212. There are also DL connections 214 from user devices 210 to satellites 100. Each DL connection 214 connects the user devices 210 on the network 200 to the satellites 100 (although not shown as a direct connection in Figure 2).

[0024] Due to the characteristics of each satellite 100, different satellites 100 orbit the Earth at different speeds, so the satellites 100 in the network configuration 202 at time A will be different from those at time B. For example, a satellite 100 on LEO208 orbits the Earth in 90-120 minutes, while a satellite 100 on MEO206 may take 12 hours to complete one orbit. This means that the satellites 100 that make up network 200 change over time. Therefore, knowing when the network configuration 202 of network 200 changes is important for properly securing and monitoring network 200.

[0025] Figure 3 shows a block diagram of the transition 300 from the first network configuration 202 to the second network configuration 302. In the transition 300, the ISL connection 212 between satellite #4 and satellite #7 is terminated, and a new ISL connection 212 is created between satellite #5 and satellite #8.

[0026] Network configurations 202 and 302 each represent network 200 at different points in time. While the different network configurations 202 and 302 presented in this document are related to satellites, the systems and methods described here also work with other types of computer networks 200 to which multiple user devices 210 are connected.

[0027] Figure 4 shows an exemplary algorithm 400 for analyzing traffic flow data to detect malicious data flows in System 100 (see Figure 1) and other similar systems, as well as in a network such as Network 200 (see Figure 2). The steps of algorithm 400 are performed by a packet switch 114 (see Figure 1). The packet switch 114 is programmed to monitor data flows transmitted through or received by port 116 (see Figure 1). The packet switch 114 uses algorithm 400 to monitor data flows on port 116. In one example, the packet switch 114 stores one or more security policies, in this case the security policies relate to configurations of Network 200, such as Configurations 202 and 302 (both see Figure 3). In at least one example, the security policies include information about the network configuration and how traffic flows are supported. In some cases, the packet switch 114 is co-located with another processor, which performs one or more steps of the algorithm 400 (e.g., the analysis step).

[0028] The packet switch 114 determines three different input packet characteristics based on either the received data packet or the transmitted packet. Such inputs include, but are not limited to, the packet arrival time 402, the packet length 404, and the packet bitrate 406.

[0029] The packet switch 114 uses the arrival time 402 to calculate the arrival interval 408, which is the period between arrivals of data packets. The packet switch 114 determines the minimum gap length based on either packet statistics or prior knowledge (e.g., as defined in security policies). If the distance between consecutive packet arrivals exceeds a predetermined criterion (e.g., a threshold amount), the packet switch 114 recognizes the gap and narrows the arrival interval to the central arrival interval. The packet switch 114 removes the gap period because such gaps can introduce deviations into the analysis results. The packet switch 114 calculates the inter-arrival rate 412 and the central inter-arrival rate 414. The inter-arrival rate and the central inter-arrival rate are combined at a non-linear ratio 416. The inter-arrival rate represents the rate of arrival of data packets associated with the corresponding flow.

[0030] The packet switch 114 generates a ratio 418 using the packet length 404 and the packet bitrate 406, and calculates the packet duration 420. The packet switch 114 calculates the maximum packet duration 422, and generates a nonlinear ratio 424 of packet duration 420 to maximum packet duration.

[0031] The results of the nonlinear ratio 416 of arrival intervals and the nonlinear ratio 424 of packet durations are combined and used to calculate one or more histograms 432. The packet switch 114 applies a detection criterion (e.g., a threshold) 434 to the histogram to reduce and / or overcome jitter or noise. In a computer network (e.g., network 200), there can be a lot of jitter based on the number of repeater links each packet passes through (jitter increases as the number of links increases). By applying the detection threshold 434 to the histogram, packets above the detection threshold 434 are retained as actual data packets, while those below the detection threshold 434 are discarded as jitter. The detection threshold 434 can be calculated by the packet switch 114. The detection threshold 434 may be pre-calculated based on the network configuration 202 or provided within a security policy.

[0032] Next, the packet switch 114 performs several steps to appropriately apply the histogram to the data generated for PSD analysis. Such steps include, but are not limited to, determining the ratio 436 of the maximum number of data packets beyond the histogram packets, determining the relative packet gain 438, and determining the sorted nonlinear weighing and rounding 440. The purpose of this is to maintain the positive signal-to-noise ratio even for short-duration and burst packets.

[0033] Next, the packet switch 114 uses half of the minimum packet duration, 442, as the sample time for generating the sampled rectangular sequence. This rectangular sequence represents the enhanced data packets as a rectangular sequence of data packets, in which case the duration represents the actual data packets and the amplitude represents the energy assigned to the data packets.

[0034] The packet switch 114 analyzes power spectral density data to show at what frequencies various packet sequences are occurring. In this example, the power spectral density estimate 446 is calculated using a Welch periodogram. The packet switch 114 combines the power spectral density estimate 446, which has data packets exceeding a detection threshold 434, with a histogram 432 to determine the detected packet type (flow) 448. The histogram data includes the number of data packets in each flow. The security policy includes expected flows. The packet switch 114 compares the expected flows with the detected flows to detect any unexpected flows. In one example, the packet switch 114 removes expected flows from the detected flows in the histogram 432 to determine if there are any unexpected flows remaining in the modified histogram.

[0035] Since the topology of network 200 is known, anything beyond it is unexpected, and therefore anomalous and potentially malicious. When unexpected data is detected, packet switch 114 sends a notification that an unexpected flow exists. Packet switch 114 may also provide the frequency, arrival time, duration, and / or the number of anomalous data packets. Anomaly data packets may indicate a malicious threat or a misconfiguration of the security policy that packet switch 114 was using for analysis. Packet switch 114 may notify or take action at the operations center or security center. Actions may include, but are not limited to, providing additional notifications, issuing warnings, triggering other programs, changing the network topology, and / or blocking traffic.

[0036] Figures 5 to 14 show the results of various exemplary flow analyses using algorithm 400 (see Figure 4) performed by packet switch 114. Table 1 below shows the various flows that may be included in each analysis. In this analysis, flow 1 is only a hypothetical flow. Flow 1 provides 128,000 data packets of 1500B each at 25kHz with a flow data rate of 300Mbps.

[0037] Table 1 Flow number Packet size (bytes) packets / second Number of packets Flow data rate 1 1500B 25,000 128,000 300Mbps 2 1500B 2 10 24Kbps 3 1500B 20 100 240Kbps 4 100B 2 10 1.6Kbps 5 100B 20 100 16Kbps

[0038] Figure 5 shows the first graph 500 of the first analysis of the traffic flow using algorithm 400 (see Figure 4). Graph 500 shows a plot of the power spectral density of flow 1. Graph 500 includes the frequencies of packet arrivals of various packet types in kilohertz (kHz) on the x-axis and the power spectral density (PSD) in decibels (dB) on the y-axis. Flow 1 is illustrated at 25 kHz in the center of graph 500. Another component shown in graph 500 is inter-arrival jitter below -70 dB.

[0039] Figure 6 shows the first histogram 600 of the first analysis of the traffic flow shown in Figure 5. In algorithm 400 (see Figure 4), the dominant flow is excluded from algorithm 600. This allows the packet switch 114 (or co-located processor) to identify further flows shown in the histogram 600. The histogram 600 includes relative weight in dB on the x-axis and the number of packets on the y-axis. By excluding the dominant flow, the histogram 600 can display information about the other detected flows without being obscured by the dominant flow. In this specification, the dominant flow (flow 1) is a expected flow, while all other flows are unexpected and may be malicious flows. The packet switch 114 removes all expected flows from the histogram 600 in order to focus on the unexpected flows. In an ideal state, there are no unexpected flows, so the histogram 600 is blank.

[0040] Figure 7 shows the second graph 700 of the second analysis of the traffic flow using algorithm 400 (see Figure 4). Graph 700 illustrates the dominant flow (flow 1) at 25 kHz and the second flow which repeats every 2 Hz. This second flow is flow 2 in Table 1. Figure 8 shows the second histogram 800 of the second analysis of the traffic flow shown in Figure 7. Histogram 800 illustrates flow 2, which has 10 packets. The dominant flow (flow 1) is excluded from histogram 800. Therefore, the second flow has 2 packets / second for a total of 10 packets.

[0041] Figure 9 shows the third graph 900 of the third analysis of the traffic flow using algorithm 400 (see Figure 4). Graph 900 illustrates the dominant flow at 25 kHz (flow 1), the second flow repeated every 20 Hz (flow 3), and the third flow repeated every 2 Hz (flow 2). Figure 10 shows the third histogram 1000 of the third analysis of the traffic flow shown in Figure 9. Histogram 1000 illustrates packets of 10 or less at 16 dB, 1 packet at 17 dB, 10 or less at 19.5 dB, and 100 or less at 21 dB. In the analysis, sets of packets within 2 dB of each other are considered to be part of the same flow (but affected by jitter). Therefore, 1 packet at 17 dB is part of the packets at 16 dB, and packets of 10 or less at 19.5 dB are part of the packets at 21 dB. As illustrated in Figures 9 and 10, most of the jitter is removed by the detection threshold 434, but some jitter still remains. However, this is acceptable for analysis purposes, as the dominant flow is clearly visible on graph 900. Thus, the second flow delivers 100 packets at 20 packets / second, and the third flow delivers 10 packets at 2 packets / second.

[0042] Flows 1, 2, and 3 all have 1500-byte packets, but algorithm 400 can detect packets of various byte sizes. In Figures 11 and 12, packets in the dominant flow (flow 1) remain 1500 bytes in size, while packets in the second flow (flow 4) are only 100 bytes long. Furthermore, algorithm 400 detects various flows with different flow data rates. Flow 1 has a flow data rate of 300 Mbps, while flow 4 has a flow data rate of 1.6 Kbps. Figure 11 shows the fourth graph 1100 of the fourth analysis of traffic flow using algorithm 400 (see Figure 4). Graph 1100 illustrates the dominant flow (flow 1) at 25 kHz and the second flow (flow 4) repeating at 2 Hz. Figure 12 shows the fourth histogram 1200 of the fourth analysis of traffic flow shown in Figure 11. Histogram 1200 illustrates 3 packets at 19.5 dB and 7 packets at 21 dB. Therefore, the second flow is delivering 10 packets at 2 packets / second.

[0043] Figure 13 shows the fifth graph 1300 of the fifth analysis of the traffic flow using algorithm 400 (see Figure 4). Graph 1300 illustrates the dominant flow at 25 kHz (flow 1), the second flow repeated at 20 Hz (flow 5), and the third flow repeated at 2 Hz (flow 4). Figure 14 shows the fifth histogram 1400 of the fifth analysis of the traffic flow shown in Figure 13. Histogram 1400 illustrates 10 packets at 64 dB and 100 packets at 21 dB. Thus, the second flow provides 100 packets at 20 packets / second, and the third flow provides 10 packets at 2 packets / second.

[0044] Figure 15 shows the sixth graph 1500 of the sixth analysis of the traffic flow using algorithm 400 (see Figure 4). Graph 1500 illustrates the dominant flow at 25 kHz (flow 1) and the secondary flow (flow 5) repeating at 20 Hz. Figure 16 shows the sixth histogram 1600 of the sixth analysis of the traffic flow shown in Figure 15. Histogram 1600 illustrates 3 packets at 19.5 dB and 97 packets at 21 dB. Therefore, the secondary flow provides 100 packets at 20 packets / second.

[0045] Figure 17 shows a simplified block diagram of an exemplary communications network analyzer (CNA) system 1700 for analyzing communications traffic on network 200 (see Figure 2). In this example, the CNA system 1700 is used to control the computation of algorithms for monitoring communications from satellite 100 (see Figure 1) and other devices on network 200. The algorithms monitor communications on network 200 for malicious data flows that may indicate cybersecurity threats and attacks, enabling other systems to respond to identified and detected cybersecurity threats and attacks.

[0046] The CNA system 1700 includes a CNA computer device 1710 that communicates with one or more communication ports 1705. The CNA computer device 1710 may be similar to a packet switch 114 (see Figure 1) in network 200, or other processing units running on satellite 100 (see Figure 1) or user device 210 (see Figure 2). In some examples, packet switch 114 is co-located with one or more additional processors capable of performing one or more steps of algorithm 400 (see Figure 4). Communication port 1705 may be similar to port 116 (see Figure 1). One or more communication ports 1705 each communicate with communication device 1730. Communication device 1730 may be similar to satellite 100 and / or user device 210. In one example, the CNA computer device also communicates with network controller 1725, which provides security policies to the CNA computer device 1710. The CNA computer device 1710 may also communicate with database server 1715 to read data from database 1720 and store data in database 1720.

[0047] The CNA computer device 1710 is programmed to receive signature information and / or security policies about various configurations of the computer network 200. Since the security policy may include information about the network topology, algorithms analyzing traffic flows can recognize expected data flows and detect unexpected data flows (if any). In some examples, the security policy includes signatures of expected traffic flows for the network's configuration at that time. The security policy may include, but is not limited to, information such as when users are supported to connect, how long users can connect, the MOD / COD of connection 118, the data rate of connection 118, that requests via connection 118 require a specified number of data flows, information about such data flows (such as packet size), how applications transmit such data packets, arrival time, and protocols (if available). All of this information is compiled on a connection 118 basis. Security policies may be based on network information, including, but are not limited to, knowledge of satellite 100 (see Figure 1) within network 200 at a specific point in time or at a specified time interval (including where satellite 100 is located, which devices 100 and 210 are connected to it, which devices 100 and 210 should be connected at each of a specific point in time or at a specific time interval, and / or the duration of each connection 118). Network information may also include, but is not limited to, how user devices 210 are connected to network 200 and satellite 100, the types of connections 118 between satellites 100 and between satellites 100 and user devices 210, MOD / COD (modulation and coding: where coding refers to FEC (forward error correction) overhead), data rate, and traffic profiles along each network 200 of network configurations 202 and 302 (shown in Figures 2 and 3, respectively) (what types of traffic the user is expected to generate).In some examples, the CNA computer device 1710 receives security policies from the network controller 1725. In other examples, the CNA computer device 1710 stores multiple security policies and uses different security policies at different times based on the configuration of the network 200. In some examples, all connections 212 and 214 (both see Figure 2) are known in advance. In some of these examples, the algorithm controller 1725 sends signals indicating when to use each security policy. In another of the above examples, the network controller 1725 sends a schedule informing the CNA computer device 1710 which security policies to use and when. In some examples, the CNA computer device 1710 stores multiple different algorithms. In some of these examples, the network controller 1725 informs the CNA computer device 1710 which algorithms to use, when, and with which security policies.

[0048] In other examples, one or more user devices 210 may be connected to the network 200 on an ad-hoc basis. In such examples, the new user device 210 negotiates a connection 118 to the network 200. Information about the new user device is sent to the network controller 1725 or the CNA computer device 1710, which generates a new security policy for the new user device 210 and for devices 100 and 210 that have a connection 118 with the new user device 210.

[0049] The CNA computer device 1710 uses a security policy on communication port 1705 that has connections 118 to communication device 1730. In this example, the CNA computer device 1710 runs an algorithm to monitor each connection 118 (if the algorithm is configured to use a security policy to monitor communication port 1705 associated with one or more connections 118 for malicious traffic flows). When network 200 is configured accordingly, the CNA computer device 1710 activates the appropriate algorithm and security policy.

[0050] For example, the CNA computer device 1710 determines, based on network configurations 202 and 302, that the first network configuration 202 will be active from time A to time B, and the second network configuration 302 will be active from time B to time C. Furthermore, the CNA computer device 1710 is aware of the security policies for each of the network configurations 202 and 302. These security policies may be stored in the database 1720 or received from the network controller 1725.

[0051] For each of network configurations 202 and 302, the CNA computer device 1710 determines which algorithm and security policy to use to monitor each connection 118. For example, in the first network configuration 202, the CNA computer device 1710 associated with satellite #1 determines which security policy to implement, along with the algorithm (such as algorithm 400 shown in Figure 4) to be executed for the ISL connection 212 with satellite #2 on satellite #1. The CNA computer device 1710 may use different security policies for monitoring the ISL connection 212 with satellite #2. Furthermore, the CNA computer device 1710 may run multiple copies of the algorithm simultaneously, with one algorithm running for each communication port 1705 having an active connection 118. Each of the different copies of the algorithm may use a different security policy based on the target connection and the configuration of network 200. The CNA computer device 1710 associated with satellite #2 determines which algorithm to run on satellite #2 for the ISL connection 212 and which security policy the algorithm on satellite #2 will use to monitor the ISL connection 212. The algorithms and security policies run on each satellite 100 may differ on separate satellites 100, or even on separate ports 116 of the same satellite 100. The CNA computer device 1710 and / or the network controller 1725 select the algorithms and security policies based on one or more attributes of the target satellite and / or the configuration of the network 200.

[0052] The CNA computer device 1710 ensures that the appropriate algorithms and security policies are activated on the satellite 100 corresponding to the correct time. In some examples, the CNA computer device 1710 receives the security policies and algorithms in advance from the network controller 1725, along with a schedule of activation periods that instructs the CNA computer device 1710 when to activate each of the algorithms and security policies. For example, the CNA computer device 1710 may receive algorithms and security policies for a first network configuration 202 and a second network configuration 302. When time A begins, the CNA computer device 1710 associated with each satellite 100 activates the predetermined algorithms and security policies associated with the first network configuration 202. When time B begins, the CNA computer device 1710 associated with each satellite 100 activates the predetermined algorithms and security policies associated with the second network configuration 302, and so on. In such an example, the network controller 1725 may transmit the algorithms and security policies to the CNA computer device 1710 long before the corresponding network configuration begins. Furthermore, in some examples, the network configuration may be repeated at multiple points in time. In such examples, each CNA computer device 1710 may store multiple algorithms and security policies and may receive signals from the network controller 1725 indicating which algorithms and security policies to activate at various points in time. In other examples, the network controller 1725 transmits one or more of the preferred algorithms and security policies to the CNA computer device 1710 at the start of a new network configuration. Although the above is described in relation to satellite 100, any communication device may be used in conjunction with the systems and methods described herein. In some examples, each security policy includes an activation attribute instead of a schedule, and the CNA computer device 1710 activates that security policy in a timely manner.

[0053] In this example, the CNA computer 1710 is a system such as a packet switch 114 (see Figure 1) that can execute algorithms and security policies to monitor communications 118 (both see Figure 1) on port 116. In other examples, the CNA computer device 1710 could be, but is not limited to, a network card, repeater hub, network bridge, switch hub, bridge hub, MAC bridge, or any other device configured to send and receive messages (such as data packets). In this example, the CNA computer 1710 communicates with the network controller 1725 to receive signals about which algorithms and security policies to use and when. In this example, the network controller 1725 may communicate with the CNA computer device 1710 via ISL connection 212 and DL connection 214. The CNA computer 1710 may further provide the network controller 1725, user device 210 (see Figure 2), or other communication device 1730 with information about any detected potentially malicious data flows or other deviations from security policies. In other examples, algorithm 400 may be executed at a central location. At this central location, a computer device monitors communications (i.e., data flows) on network 200 and scrutinizes these communications in accordance with a suitable security policy. The CNA computer device 1710 may be part of satellite 100 or user device 210, in which case connection 118 via port 116 is available for monitoring.

[0054] In this example, the communication device 1730 is a computer containing a web browser or software application, which enables the client communication device 1730 to communicate with the CNA computer device 1710 using the Internet, a local area network (LAN), or a wide area network (WAN). In some examples, the communication device 1730 is connected to the Internet via a number of interfaces, including, but not limited to, at least one of the following: a network (such as the Internet, LAN, WAN, or Integrated Services Digital Network (ISDN)), a dial-up connection, a digital subscriber line (DSL), a mobile phone connection, a satellite connection, and a cable modem. The communication device 1730 can be any device that can access a network (such as the Internet), including, but not limited to, a desktop computer, a laptop computer, a personal digital assistant (PDA), a mobile phone, a smartphone, a tablet, a phablet, or other web-based connectable device. In at least one example, one or more communication devices 1730 include a web browser, which may be used to output information to the network controller 1725 or the CNA computer device 1710 to provide, for example, contextual information about one or more configurations of the network 200, or one or more warnings about malicious data flows. In some examples, the communication device 1730 monitors or controls the path of satellite 100 and provides information about satellite 100. In other examples, the communication device 1730 facilitates communication between the CNA computer device 1710 and the network controller 1725.

[0055] The application includes information about satellites 100 and user devices 210 within network 200 and can determine which algorithms and security policies to use at a particular time or in a particular network configuration to monitor the data flow of the computer network 200. The application may be provided as a cloud-based web service over the internet or other networks. In some examples, the network controller 1725 includes at least one application that runs on the network controller 1725 to perform network analysis.

[0056] The database server 1715 is communicatively connected to the database 1720, which stores the data. In one example, the database 1720 contains multiple satellite communication attributes, multiple algorithm attributes, multiple security policy information, and additional information about the user device 210. In some examples, the database 1720 is stored remotely from the CNA computer device 1710. In some examples, the database 1720 is distributed. In this example, a person may access the database 1720 via the user device 210 by logging into at least one of the CNA computer device 1710 and the network controller 1725.

[0057] At a higher level, the algorithm runs on an FPGA or on a processor that is part of another CNA computer device 1710. The algorithm generates data (such as statistical data in the form of logs). The algorithm may be located on satellite 100, user device 210, or communication device 1730, and may also run on a computer device (such as network controller 1725). The computer device then interprets the logs. Based on the algorithm's examination of the logs, something may be detected. Based on the detection, the network controller 1725, CNA computer device 1710, or other client devices may notify the operations center or security center or take action. Actions may include, but are not limited to, providing notifications, issuing warnings, invoking another program, changing the network topology, or blocking traffic.

[0058] Figure 18 shows an exemplary process 1800 for analyzing communication traffic on network 200 (see Figure 2) using system 1700 (see Figure 17). The steps of process 1800 may be performed by a packet switch 114 (both see Figure 1) on satellite 100 or other device 210 (see Figure 2), and / or CNA computer device 1710 (see Figure 17). In at least one example, the packet switch 114 performing process 1800 is located on satellite 100. In one example, the packet switch 114 performs process 1800 for each port 116 (see Figure 1) that communicates 118 (see Figure 1) with another communication device 1730 (see Figure 17). In some examples, the packet switch 114 performs different instantiations of process 1800 for each active port 116. In another example, packet switch 114 runs one instance of process 1800 that monitors multiple ports 116.

[0059] The CNA computer device 1710 or packet switch 114 communicates with one or more devices in the network 200. The devices in the network may include, but are not limited to, the satellite 100, the user device 210, the communication device 1730, and the network controller 1725 (see Figure 17).

[0060] The CNA computer device 1710 receives packet information 1805 of multiple data packets transmitted over network 200 (see Figure 2). The packet information includes, but is not limited to, packet arrival time 402, packet length 404, and packet bitrate 406 (all see Figure 4). The CNA computer device 1710 monitors data packets transmitted over one or more ports 116, or data packets received over one or more ports 116, in real time. The CNA computer device 1710 determines the packet information based on an examination of multiple data packets transmitted over port 116 by computer systems 100 or 210.

[0061] The CNA computer device 1710 calculates the arrival interval 408 (see Figure 4) of multiple data packets based on the packet information 1810. The CNA computer device 1710 adjusts the multiple arrival intervals of the multiple data packets to eliminate the gap 410 (see Figure 4). The CNA computer device 1710 calculates the arrival rate (see Figure 4) of the multiple data packets based on the packet information 412. The CNA computer device 1710 calculates the median (or average) arrival rate (see Figure 4) of the multiple data packets 414. The CNA computer device 1710 then adjusts the multiple arrival intervals based on the median arrival rate 414 to eliminate one or more gaps 410.

[0062] The CNA computer device 1710 calculates the packet duration 420 (see Figure 4) of multiple data packets based on the packet information 1815. The CNA computer device 1710 filters the packet information to remove noise and jitter 1820. The CNA computer device 1710 applies a detection threshold 434 (see Figure 4) to multiple data packets to filter the packet information and remove noise. The CNA computer device 1710 generates at least one histogram 432 (see Figure 4) based on the packet information, arrival interval 408, and packet duration 420 1825. The CNA computer device 1710 further generates a power spectral density estimate 446 (see Figure 4) based on the packet information, arrival interval 408, and packet duration 420 1830.

[0063] The CNA computer device 1710 analyzes at least one histogram 432 and power spectral density estimate 446 to detect one or more unexpected data flows 1835. The CNA computer device 1710 detects one or more data flows 448 (see Figure 4) in at least one histogram 432 and power spectral density estimate 446. The CNA computer device 1710 compares the detected one or more data flows with one or more expected data flows. Based on the comparison, the CNA computer device 1710 detects one or more unexpected data flows. For example, the CNA computer device 1710 filters out one or more expected data flows from at least one histogram 432 and analyzes the filtered at least one histogram 432 to detect one or more unexpected data flows.

[0064] The CNA computer device 1710 reports one or more unexpected data flows based on its detection of one or more unexpected data flows. The CNA computer device 1710 may send a notification to the network controller 1725. In addition, the network controller 1725, the CNA computer device 1710, or other client devices may notify or take action to the operations center or security center. Actions may include, but are not limited to, providing notifications, issuing warnings, triggering other programs, changing the network topology, or blocking traffic.

[0065] The CNA computer device 1710 can receive and store security policies containing one or more anticipated data flows. The CNA computer device 1710 can also store multiple security policies. Each of these multiple security policies is associated with a configuration 202 or 302 (both see Figure 3) of network 200. The CNA computer device 1710 activates the security policy associated with the current configuration 202 of network 200.

[0066] In some examples where the CNA computer device 1710 stores one or more security policies, the CNA computer device 1710 receives from the network controller 1725 (see Figure 17) the security policy that should be activated at that time. In other examples where the CNA computer device 1710 stores one or more security policies, the CNA computer device 1710 receives a signal from the network controller 1725 instructing the CNA computer device 1710 to activate one of the stored security policies. In yet another example where the CNA computer device 1710 stores one or more security policies, the CNA computer device 1710 may also receive a schedule from the network controller 1725. The schedule includes the activation times for each algorithm and security policy. Based on the script, the CNA computer device 1710 activates the corresponding algorithms and security policies. For example, the script may include all algorithms and security policies to be used for network 200 over a day, an hour, or other period. The security policies may include information about the expected data flow.

[0067] Figure 19 shows an exemplary configuration of a user computer device 1902 used in a CNA system 1700 (see Figure 17) according to an example of the present disclosure. The user computer device 1902 is operated by user 1901. The user computer device 1902 may include, but is not limited to, a satellite 100, a packet switch 114 (both see Figure 1), a user device 210 (see Figure 2), a communication device 1730, and a network controller 1725 (both see Figure 17). The user computer device 1902 includes a processor 1905 for executing instructions. In some examples, executable instructions are stored in a memory area 1910. The processor 1905 may include one or more processing units (e.g., in a multi-core configuration). The memory area 1910 is any device that enables information (such as executable instructions and / or transaction data) to be stored and read. The memory area 1910 may include one or more computer-readable media.

[0068] The user computer device 1902 also includes at least one media output component 1915 for presenting information to the user 1901. The media output component 1915 is any component capable of conveying information to the user 1901. In some examples, the media output component 1915 includes an output adapter (not shown), such as a video adapter and / or an audio adapter. The output adapter is operably connected to the processor 1905 and is operably connected to an output device, such as a display device (e.g., a cathode ray tube (CRT), liquid crystal display (LCD), light-emitting diode (LED) display, or "electronic ink" display) or an audio output device (e.g., a speaker or headphones). In some examples, the media output component 1915 is configured to present a graphical user interface (such as a web browser and / or a client application) to the user 1901. The graphical user interface may include, for example, an interface for viewing monitoring data about the network 200 (see Figure 2). In some examples, the user computer device 1902 includes an input device 1920 for receiving input from user 1901. User 1901 may use the input device 1920 to input network configuration information (but not limited to this). The input device 1920 may include, for example, a keyboard, pointing device, mouse, stylus, touch-sensitive panel (e.g., touchpad or touchscreen), gyroscope, accelerometer, position detector, biometric input device, and / or audio input device. A single component (such as a touchscreen) may also function as both an output device and an input device 1920 for the media output component 1915.

[0069] The user computer device 1902 may also include a communication interface 1925 that is communicatively connected to a remote device (for example, the CNA computer device 1710 shown in Figure 17). The communication interface 1925 may include, for example, a wired or wireless network adapter and / or a wireless data transceiver used with a mobile communication network.

[0070] The memory area 1910 stores computer-readable instructions, for example, to provide a user interface to user 1901 via the media output component 1915 (and optionally to receive and process input from input device 1920). The user interface may include (but is not limited to) a web browser and / or a client application. The web browser allows the user (such as user 1901) to view and interact with information from the media and other information from the CNA computer device 1710 (typically embedded in a web page or website). The client application allows user 1901 to interact with the CNA computer device 1710, for example. For example, instructions may be stored by a cloud service, and the output of instruction execution may be sent to the media output component 1915.

[0071] The processor 1905 executes computer executable instructions to implement an aspect of the present disclosure.

[0072] Figure 20 shows an exemplary configuration of a server computer device 2001 used in a CNA system 1700 (see Figure 17) according to an example of the present disclosure. The server computer device 2001 may include, but is not limited to, a CNA computer device 1710, a database server 1715, and a network controller 1725 (all see Figure 17). The server computer device 2001 also includes a processor 2005 for executing instructions. Instructions may be stored in a memory area 2010. The processor 2005 may include one or more processing units (e.g., in a multi-core configuration).

[0073] The operable connection of processor 2005 to communication interface 2015 enables server computer device 2001 to communicate with remote devices (such as another server computer device 2001, CNA computer device 1710, another network controller 1725, or communication device 1730 (see Figure 17)). For example, communication interface 2015 may receive requests from network controller 1725 via the internet, as shown in Figure 17.

[0074] The processor 2005 may further be operablely coupled to a storage device 2034. The storage device 2034 is any computer operating hardware suitable for storing and / or retrieving data (for example, data associated with the database 1720 shown in Figure 17, but not limited to this). In some examples, the storage device 2034 is integrated into a server computer device 2001. For example, a server computer device 2001 may include one or more hard disk drives as the storage device 2034. In other examples, the storage device 2034 is external to the server computer device 2001 and may be accessed by multiple server computer devices 2001. For example, the storage device 2034 may include a storage network (SAN), a network-attached storage (NAS) system, and / or multiple storage units (such as hard disks and / or solid-state disks in a redundant array (RAID) configuration with inexpensive disks).

[0075] In some examples, the processor 2005 is operably coupled to the storage device 2034 via a storage interface 2020. The storage interface 2020 is any component capable of providing the processor 2005 with access to the storage device 2034. The storage interface 2020 may include, for example, an Advanced Technology Accessory (ATA) adapter, a Serial ATA (SATA) adapter, a Small Computer System Interface (SCSI) adapter, a RAID controller, a SAN adapter, a network adapter, and / or any component that provides the processor 2005 with access to the storage device 2034.

[0076] The processor 2005 executes computer executable instructions to implement aspects of the present disclosure. In some examples, the processor 2005 is converted into a particular-purpose microprocessor by executing computer executable instructions or by being otherwise programmed. For example, the processor 2005 is programmed with instructions as shown in Figure 18.

[0077] As used in this book, a processor may include any programmable system, including microcontrollers, reduced instruction set circuits (RISC), application-specific integrated circuits (ASICs), logic circuits, and any other circuits or systems that use a processor capable of performing the functions described herein. The above examples are illustrative and are therefore not intended to limit the definition and / or meaning of the term "processor" in any way.

[0078] As used in this book, the term "cybersecurity threat" includes any unauthorized attempt to gain access to a target system. A cybersecurity threat (also known as a cyberattack or cyber threat) is an attempt to infiltrate a computer system by exploiting its vulnerabilities. Some cybersecurity threats include attempts to damage or disrupt a target system. Such cybersecurity threats may include, but are not limited to, active breaches, spyware, malware, viruses, and worms. A cybersecurity threat can enter a system through numerous pathways (also known as attack vectors). These pathways may include operating system attacks, misconfiguration attacks, application-level attacks, and reduced-wrapping-code attacks. A cybersecurity threat can be introduced remotely through a communication network or connected system, or through the relevant supply chain, by an individual or system directly accessing a computing device.

[0079] As used in this book, the term “database” can refer to either the data itself, a relational database management system (RDBMS), or both. As used in this book, a database can also include any collection of data, including hierarchical databases, relational databases, flat-file databases, object-relational databases, object-oriented databases, and any other structured collection of records or data stored in a computer system. The examples above are illustrative and are therefore not intended to limit the definition and / or meaning of the term “database” in any way. Examples of RDBMS include, but are not limited to, Oracle® Database, MySQL, IBM® DB2, Microsoft® SQL Server, Sybase®, and PostgreSQL. Any database that enables the systems and methods described in this book may be used. (Oracle is a registered trademark of Oracle Corporation in Redwood Shores, California; IBM is a registered trademark of International Business Machines Corporation in Armonk, New York; Microsoft is a registered trademark of Microsoft Corporation in Redmond, Washington; and Sybase is a registered trademark of Sybase in Dublin, California.)

[0080] In another example, a computer program is provided, and this program is implemented on a computer-readable medium. In one example, the system runs on a single computer system without requiring a connection to a server computer. In yet another example, the system runs in a Windows® environment (Windows is a registered trademark of Microsoft Corporation in Redmond, Washington). In yet another example, the system runs in a mainframe environment and a UNIX® server environment (UNIX is a registered trademark of X / Open Company Limited in Reading, Berkshire, UK). In yet another example, the system runs in an iOS® environment (iOS is a registered trademark of Cisco Systems, Inc. in San Jose, California). In yet another example, the system runs in a Mac OS® environment (Mac OS is a registered trademark of Apple Inc. in Cupertino, California). In yet another example, the system runs on the Android® OS (Android is a registered trademark of Google, Inc. in Mountain View, California). In another example, the system runs on the Linux® operating system (Linux is a registered trademark of Linus Torvalds of Boston, Massachusetts). The application is flexible and designed to run in a variety of different environments without compromising any key functionality.

[0081] Where used herein, elements or steps described in the singular and followed by the phrase "a or an" should be understood as not being subject to any exclusion of the plural form of such element or step unless explicitly stated otherwise. Furthermore, references to "example" or "one example" in this disclosure are not intended to be interpreted as excluding the existence of additional examples that similarly encompass the described features. Moreover, where used herein, the words "includes / including," "has," "contains," and similar words are intended to be inclusive, as open-transition terms that do not exclude any additional or other elements, similar to the word "comprises."

[0082] As used in this book, the terms “software” and “firmware” are interchangeable and include any computer program stored in memory for execution by the processor (including RAM memory, ROM memory, EPROM memory, EEPROM memory, and non-volatile RAM (NVRAM) memory). The above types of memory are illustrative and therefore not limited to the types of memory that can be used to store computer programs.

[0083] Furthermore, as used in this book, the term "real-time" refers to at least one of the following: the time when the relevant event occurs, the time when the specified data is measured and collected, the time when the data is processed, and the time when the system responds to the event and environment. In the examples described in this book, such activities and events occur substantially instantaneously.

[0084] The methods and systems described herein may be implemented using computer programming or engineering techniques (including computer software, firmware, hardware, or any combination or subset thereof). As disclosed above, at least one technical problem with prior art systems is the need for a system to monitor communication networks that may change over time. The systems and methods described herein address such technical problems. In addition, at least one of the technical solutions provided by this system to such technical problems may include: (i) monitoring message traffic data in real time; (ii) monitoring encrypted message traffic; (iii) improving the detection of infrequent or low packet data flows from other traffic; (iv) enabling monitoring of message traffic without requiring costly infrastructure upgrades; (v) monitoring message traffic data whenever the network changes; and (vi) reducing the packet data required to enable monitoring of message traffic data.

[0085] The methods and systems described herein may be implemented using computer programming or engineering techniques (including computer software, firmware, hardware, or any combination or subset thereof), and their technical effects may be achieved by performing at least one of the following steps: a) calculating the arrival interval and packet duration of a plurality of data packets based on received packet information relating to a plurality of data packets transmitted over a network, wherein the packet information includes the arrival time associated with the plurality of data packets, the length of the plurality of data packets, and the bitrate of the plurality of data packets, and the computer system is associated with a packet switch; b) filtering the packet information to remove noise; c) generating at least one histogram based on the packet information, arrival interval, and packet duration; d) generating a power spectral density estimate based on the packet information, arrival interval, and packet duration; e) analyzing at least one histogram and power spectral density estimate to detect one or more unexpected data flows; f) Steps include: a) reporting one or more external data flows; g) determining packet information based on a scrutiny of multiple data packets transmitted by the computer system; h) adjusting the arrival intervals of multiple data packets to eliminate one or more gaps; i) calculating the inter-arrival rate of multiple data packets based on the packet information; j) calculating the central inter-arrival rate of multiple data packets; k) adjusting the arrival intervals to eliminate one or more gaps based on the central inter-arrival rate; l) applying detection criteria to the histogram results of multiple data packets to filter the packet information and remove noise; m) detecting one or more data flows in at least one histogram and power spectral density estimate; n) comparing the detected one or more data flows with assumed one or more data flows; o) based on the comparison,Steps include: p) detecting one or more unexpected data flows; p) filtering one or more expected data flows from at least one histogram; o) analyzing at least one filtered histogram to detect one or more unexpected data flows; p) receiving a security policy containing the expected data flows; q) storing the security policy; r) storing multiple security policies, each security policy associated with the network configuration; and s) activating the security policy associated with the current network configuration.

[0086] In some cases, the technical effect may be achieved by performing at least one of the following steps: a) a processor receives packet information of multiple data packets transmitted over a network; b) a processor calculates the arrival interval of multiple data packets based on the packet information; c) a processor calculates the packet duration of multiple data packets based on the packet information; d) a processor filters the packet information to remove noise; e) a processor generates at least one histogram based on the packet information, arrival interval, and packet duration; f) a processor generates a power spectral density estimate based on the packet information, arrival interval, and packet duration; g) a processor analyzes at least one histogram and the power spectral density estimate to detect one or more unexpected data flows; h) a processor reports the one or more unexpected data flows; i) multiple data packets being transmitted by a computer system The steps are: a) determining packet information based on a detailed examination of the data packets; a) adjusting the arrival intervals of multiple data packets to remove one or more gaps; a) calculating the inter-arrival rate of multiple data packets based on the packet information; a) calculating the mid-arrival rate of multiple data packets; a) adjusting the arrival intervals to remove gaps based on the mid-arrival rate; a) applying detection criteria to the histogram results of multiple data packets to filter the packet information and remove noise; a) detecting one or more data flows in at least one histogram and power spectral density estimation; a) comparing the detected one or more data flows with one or more assumed data flows; a) filtering out one or more assumed data flows from at least one histogram; and a) analyzing the filtered at least one histogram to detect one or more unexpected data flows.

[0087] In some cases, the technical effect may be achieved by performing at least one of the following steps: a) receiving a security policy containing configuration data that is executed on the system; b) receiving packet information for multiple data packets transmitted over the network; c) calculating the arrival interval of the multiple data packets based on the packet information and the security policy; d) having a processor calculate the packet duration of the multiple data packets based on the packet information; e) filtering the packet information to remove noise based on the security policy; f) generating at least one histogram based on the packet information, arrival interval, and packet duration; h) generating a power spectral density estimate based on the packet information, arrival interval, and packet duration; i) analyzing at least one histogram and power spectral density estimate based on the security policy to detect one or more unexpected data flows; j) reporting the one or more unexpected data flows; and k) adjusting the arrival interval of the multiple data packets to eliminate one or more gaps based on the security policy.

[0088] The computer implementations described in this document may include additional, fewer, or alternative actions (including actions described elsewhere in this document). The methods may be implemented via one or more local or remote processors, transceivers, servers, and / or sensors (e.g., processors, transceivers, servers, and / or sensors mounted on a vehicle or portable device, or associated with smart infrastructure or a remote server) and / or via computer-executable instructions stored in one or more non-transient computer-readable media. In addition, the computer systems described in this document may include additional, fewer, or alternative functions (including functions described elsewhere in this document). The computer systems described in this document may include, or be implemented via, computer-executable instructions stored in one or more non-transient computer-readable media.

[0089] As used in this book, the term “non-transitory computer-readable media” is intended to represent any tangible computer-based device implemented in any way or technique for short-term and long-term storage of information (e.g., computer-readable instructions, data structures, program modules and submodules, or other data in any device). Therefore, the methods described herein can be encoded as executable instructions embodied in non-transitory, tangible computer-readable storage media (including, but not limited to, storage devices and / or memory devices). When executed by a processor, such instructions cause the processor to implement at least a portion of the methods described herein. Furthermore, as used in this book, the term “non-transient computer-readable media” includes all tangible computer-readable media, including, but not limited to, non-transient computer storage devices, which include, but not limited to, volatile and non-volatile media, as well as removable and non-removable media (e.g., firmware, physical and virtual storage, CD-ROMs, DVDs, and any other digital sources such as networks or the internet). Additionally, “non-transient computer-readable media” may include digital means developed in the future, with the sole exception being transient propagation signals.

[0090] Furthermore, this disclosure includes embodiments as defined below.

[0091] Article 1. A system for detecting malicious traffic flows in a network (200), comprising a computer system (1710) including at least one processor (1905) that communicates with at least one memory device (1910), wherein the at least one processor (1905) Based on the received packet information regarding multiple data packets transmitted over the network (200), the arrival interval (408) and packet duration (420) of the multiple data packets are calculated. Filtering packet information to remove noise, Based on packet information, arrival interval (408), and packet duration (420), generate at least one histogram (600), Based on packet information, arrival interval (408), and packet duration (420), a power spectral density estimate is generated. To detect one or more unexpected data flows by analyzing at least one histogram (600) and power spectral density estimate, A system programmed to report one or more unexpected data flows.

[0092] Article 2. The system as described in Clause 1, wherein at least one processor (1905) is further programmed to determine packet information based on an examination of multiple data packets being transmitted by the computer system (1710).

[0093] Article 3. The system described in Clause 1 or 2, wherein packet information includes the arrival time associated with multiple data packets (402), the length of multiple data packets (404), and the bitrate of multiple data packets (406).

[0094] Article 4. The system according to any one of clauses 1 to 3, wherein at least one processor (1905) is further programmed to adjust the arrival intervals (408) of multiple data packets to eliminate one or more gaps.

[0095] Article 5. At least one processor (1905) Based on packet information, calculate the inter-arrival rate (412) of multiple data packets, Calculating the central arrival rate (412) for multiple data packets, The system described in Clause 4 is further programmed to adjust the arrival interval (408) based on the central arrival rate (412) to eliminate one or more gaps.

[0096] Article 6. The system described in any one of Clauses 1 to 5, wherein at least one processor (1905) is further programmed to apply detection criteria to the results of histograms of multiple data packets in order to filter packet information and remove noise.

[0097] Article 7. At least one processor (1905) To detect one or more data flows in at least one histogram (600) and power spectral density estimation, A system as described in any one of clauses 1 to 6, further programmed to compare one or more detected data flows with one or more assumed data flows.

[0098] Article 8. The system as described in Clause 7, wherein at least one processor (1905) is further programmed to detect one or more unexpected data flows based on comparisons.

[0099] Article 9. At least one processor (1905) Filter one or more expected data flows from at least one histogram (600), The system described in Clause 7 is further programmed to analyze at least one filtered histogram (600) to detect one or more unexpected data flows.

[0100] Article 10. At least one processor (1905) Receiving a security policy that includes one or more anticipated data flows, The system described in Clause 7 is further programmed to remember security policies and perform the following actions.

[0101] Article 11. The system as described in Clause 10, wherein at least one processor (1905) is further programmed to store multiple security policies, each security policy being associated with the configuration of a network (200).

[0102] Article 12. The system as described in Clause 11, wherein at least one processor (1905) is further programmed to activate the security policy associated with the then-current configuration of the network (200).

[0103] Article 13. A computer system (1710) associated with a packet switch, as described in any one of clauses 1 to 12.

[0104] Article 14. A method implemented by a computer system (1710) including at least one processor (1905) communicating with at least one memory device (1910) for detecting malicious traffic flows in a network (200), The processor (1905) receives packet information of multiple data packets transmitted over the network (200), The processor (1905) calculates the arrival interval (408) of multiple data packets based on packet information, The processor (1905) calculates the packet duration (420) of multiple data packets based on packet information, The processor (1905) filters the packet information to remove noise, The processor (1905) generates at least one histogram (600) based on packet information, arrival interval (408), and packet duration (420), The processor (1905) generates a power spectral density estimate based on packet information, arrival interval (408), and packet duration (420). The processor (1905) analyzes at least one histogram (600) and power spectral density estimate to detect one or more unexpected data flows, A method comprising the processor (1905) reporting one or more unexpected data flows.

[0105] Article 15. The method according to clause 14, further comprising adjusting the arrival intervals (408) of multiple data packets to eliminate one or more gaps.

[0106] Article 16. Based on packet information, calculate the inter-arrival rate (412) of multiple data packets, Calculating the central arrival rate (412) for multiple data packets, The method according to clause 14 or 15, further comprising adjusting the arrival interval (408) to eliminate gaps based on the central arrival rate (412).

[0107] Article 17. To detect one or more data flows in at least one histogram (600) and power spectral density estimation, The method of Clause 15 or 16, further comprising comparing one or more detected data flows with one or more assumed data flows.

[0108] Article 18. Filter one or more expected data flows from at least one histogram (600), The method according to Clause 17, further comprising analyzing at least one filtered histogram (600) to detect one or more unexpected data flows.

[0109] Article 19. A system for detecting malicious traffic flows in a network (200), comprising a computer system (1710) including at least one processor (1905) that communicates with at least one memory device (1910), wherein the at least one processor (1905) A security policy executed on the system, which receives a security policy that includes configuration data, Receiving packet information of multiple data packets transmitted via the network (200), Based on packet information and security policies, calculate the arrival interval (408) for multiple data packets, The processor (1905) calculates the packet duration (420) of multiple data packets based on packet information, Based on security policies, the packet information is filtered to remove noise, Based on packet information, arrival interval (408), and packet duration (420), generate at least one histogram (600), Based on packet information, arrival interval (408), and packet duration (420), a power spectral density estimate is generated. Based on security policies, at least one histogram (600) and power spectral density estimates are analyzed to detect one or more unexpected data flows, A system programmed to report one or more unexpected data flows.

[0110] Article 20. The system as described in Clause 19, wherein at least one processor (1905) is further programmed to adjust the arrival intervals (408) of multiple data packets to eliminate one or more gaps based on a security policy.

[0111] This specification discloses various forms of execution, including the best mode, and further uses examples to enable any person skilled in the art to practice such various forms of execution, including creating and using any device or system, and performing any combination of multiple methods. The patentability of this disclosure is defined by the claims, which may include other examples that would be conducive to a person skilled in the art. Such other examples are intended to be included in the claims if they have structural elements that are not different from the language of the claims, or if they contain equivalent structural elements that are only slightly different from the language of the claims.

Claims

1. A system for detecting malicious traffic flows in a network (200), comprising: a computer system (1710) including at least one processor (1905) in communication with at least one memory device (1910), the at least one processor (1905) comprising: calculating inter-arrival times (408) and packet durations (420) of a plurality of data packets based on received packet information for the plurality of data packets transmitted over the network (200); filtering the packet information to remove noise; generating at least one histogram (600) based on the packet information, the interarrival times (408), and the packet durations (420); generating a power spectral density estimate based on the packet information, the interarrival time (408), and the packet duration (420); analyzing the at least one histogram (600) and the power spectral density estimate to detect one or more unexpected data flows; reporting the unexpected data flow or flows.

2. 2. The system of claim 1, wherein the at least one processor is further programmed to determine the packet information based on examination of the plurality of data packets being transmitted by the computer system.

3. 3. The system of claim 1, wherein the packet information comprises arrival times (402) associated with the plurality of data packets, lengths (404) of the plurality of data packets, and bit rates (406) of the plurality of data packets.

4. 4. The system of claim 1, wherein the at least one processor is further programmed to adjust the inter-arrival intervals of the plurality of data packets to eliminate one or more gaps.

5. The at least one processor (1905), calculating an inter-arrival rate (412) of the plurality of data packets based on the packet information; calculating a median inter-arrival rate (412) of said plurality of data packets; 5. The system of claim 4, further programmed to: adjust the inter-arrival interval (408) based on the median inter-arrival rate (412) to eliminate the one or more gaps.

6. 6. The system of claim 1, wherein the at least one processor (1905) is further programmed to apply a detection criterion to the results of the histogram of the plurality of data packets to filter the packet information to remove the noise.

7. The at least one processor (1905): Detecting one or more data flows in said at least one histogram (600) and in said power spectral density estimate; 7. The system of claim 1, further programmed to: compare the detected data flow or flows with an expected data flow or flows.

8. The at least one processor (1905): detecting the unexpected one or more data flows based on the comparison; filtering the expected data flow(s) from the at least one histogram (600) and analyzing the filtered at least one histogram (600) to detect the unexpected data flow(s); or receiving a security policy including the one or more anticipated data flows and storing the security policy; The system of claim 7 , further programmed to perform at least one of the following:

9. 10. The system of claim 8, wherein the at least one processor (1905) is further programmed to store a plurality of security policies, each security policy being associated with a configuration of the network (200).

10. 10. The system of claim 9, wherein the at least one processor (1905) is further programmed to activate a security policy associated with a current configuration of the network (200).

11. The system of claim 1 , wherein the computer system (1710) is associated with a packet switch.

12. 1. A method for detecting malicious traffic flows in a network, the method comprising: receiving, by the processor (1905), packet information for a plurality of data packets transmitted over the network (200); calculating, by the processor (1905), an inter-arrival interval (408) of the plurality of data packets based on the packet information; calculating, by the processor (1905), packet durations (420) of the plurality of data packets based on the packet information; filtering, by the processor (1905), the packet information to remove noise; generating, by the processor (1905), at least one histogram (600) based on the packet information, the inter-arrival time (408), and the packet duration (420); generating, by the processor (1905), a power spectral density estimate based on the packet information, the interarrival time (408), and the packet duration (420); analyzing, by the processor (1905), the at least one histogram (600) and the power spectral density estimate to detect one or more unexpected data flows; reporting, by the processor (1905), the unexpected one or more data flows.

13. 13. The method of claim 12, further comprising adjusting the inter-arrival intervals (408) of the plurality of data packets to eliminate one or more gaps.

14. calculating an inter-arrival rate (412) of the plurality of data packets based on the packet information; calculating a median inter-arrival rate (412) of said plurality of data packets; 14. The method of claim 12 or 13, further comprising: adjusting the inter-arrival interval (408) to eliminate gaps based on the median inter-arrival rate (412).

15. Detecting one or more data flows in said at least one histogram (600) and in said power spectral density estimate; The method of claim 14 , further comprising: comparing the detected data flows or flows with one or more expected data flows.

16. The method of claim 15, further comprising filtering the expected data flows or more from the at least one histogram (600) and analyzing the filtered at least one histogram (600) to detect the unexpected data flows or more.

17. A computer program comprising computer program instructions which, when executed by a computer processor, cause the computer processor to perform a method according to any one of claims 12 to 16.

Images