Network protocol anomaly detection

Abstract

The present disclosure provides network protocol anomaly detection. In some embodiments, a training system is provided and configured to generate a trained model of a selected protocol of a network. The trained model is used to predict network features of the select protocol, and the predicted network features are compared against current actual features of the network protocol to determine any changes between the predicted and actual values. Any changes detected may be identified as an existing threat and / or a developing threat that warrants further investigation.

Description

NETWORK PROTOCOL ANOMALY DETECTIONSTATEMENT REGARDING FEDERALLY SPONSORED RESEARCH ORDEVELOPMENT

[0001] This invention was made with government support under Department of Defense CIO CON00026689 G22341.X3.XX.0211.000023. The government has certain rights in the invention.CROSS REFERENCE TO RELATED APPLICATIONS

[0002] The present disclosure claims the benefit of US Provisional Application Serial No.63 / 656,125, filed June 5, 2024, which is hereby incorporated by reference in its entirety.TECHNICAL FIELD

[0003] The present disclosure is generally directed to network protocol anomaly detection.BRIEF DESCRIPTION OF THE DRAWINGS

[0004] Features and advantages of various embodiments of the claimed subject matter will become apparent as the following Detailed Description proceeds, and upon reference to the Drawings, wherein like numerals designate like parts, and in which:

[0005] FIG. 1 illustrates a network protocol anomaly training system according to embodiments of the present disclosure

[0006] 2A illustrates one example of a protocol graph as may be generated by the feature extraction circuitry;

[0007] FIG. 2B illustrates another example protocol graph;

[0008] FIG. 2C illustrates another example graph;

[0009] FIG. 3 A illustrates a cluster graph generated by the cluster membership identification circuitry for the protocol graph of FIG. 2 A;

[0010] FIG. 3B illustrates another example cluster graph generated by the cluster membership identification circuitry for the protocol graph of FIG. 2B;

[0011] FIG. 3C illustrates another example cluster graph generated by the cluster membership identification circuitry for the protocol graph of FIG. 2C;

[0012] FIG. 4 illustrates an anomaly detection system according to embodiments of the present disclosure;

[0013] FIG. 5 illustrates a flowchart of operations according to an embodiment of the present disclosure; and

[0014] FIG. 6 illustrates a flowchart of operations according to an embodiment of the present disclosure.

[0015] Although the following Detailed Description will proceed with reference being made to illustrative embodiments, many alternatives, modifications and variations thereof will be apparent to those skilled in the ait.DETAILED DESCRIPTION

[0016] The present disclosure provides network protocol anomaly detection. In some embodiments, a training system is provided and configured to generate a trained model of a selected protocol of a network. The trained model is used to predict network features of the select protocol, and the predicted network features are compared against current actual features of the network protocol to determine any changes between the predicted and actual values. Any changes detected may be identified as an existing threat and / or a developing threat that warrants further investigation. Features of the present disclosure are described below.

[0017] FIG. 1 illustrates a network protocol anomaly training system 100 according to embodiments of the present disclosure. The training system 100 is generally configured to generate a trained model of characteristics of a protocol of a network. The training system 100 includes protocol selection circuitry 102 configured to select a port that is commonly used by a target protocol. For example, common protocols are assigned port numbers in the range of 1-1024, however, this is just an example of protocol assignments and in other embodiments other protocol assignments may be used. The packet capture data 101 represents packet capture (PCAP) data of a particular network (or a portion thereof), as may be generated by, for example, known packet capturing products such as Wireshark, TCPDump, etc. The packet capture data 101 may include IP addresses, port assignments (also referred to herein as “protocols”), packet sizes, packet contents, etc. associated with a network (or portion thereof). The protocol selection circuitry 102 may utilize, for example, internet assigned numbers authority (IANA) port assignments of the network as reference, and the network transmission control protocol / user datagram protocol (TCP / UDP) destination port may be used as a selected protocol. Thus, the protocol selection circuitry 102 enables filtering by protocol (port) of network data to generate a filtered network data set 103.

[0018] To accurately capture activity of a selected protocol, the protocol selection circuitry 102 may be configured to be executed for a selected time amount, for example, to control for variances in activity associated with the selected protocol. In some embodiments, a run time amount that, a priori, is known to reflect an accurate nature of the protocol may be used. For example, a selected protocol may be known to have “busier” times throughout the day, as compared to other times throughout the day, and circuitry 102 may be configured to run during busier time periods. Inother embodiments, the circuitry 102 may be configured to run over a selected time period, for example, over a day, two days, week, etc.

[0019] The training system 100 also includes feature extraction circuitry 106 generally configured to generate graph data 109 based on the filtered network data set 103 of a selected protocol (or protocols). The feature extraction circuitry 106 is configured to build graph data 109 based on IP data exchanges for the selected (targeted) protocol, where sending and receiving IP addresses are represented as nodes in the graph data. In addition, the feature extraction circuitry 106 is also configured to apply a weighting for each node based on characteristics of the message exchanges at that node. For example, such weighting may be based on, for example, bytes sent by a particular node (e.g., a running sum of Scapy wire length for each packet related to that edge node). The weighting is generally a metric of the volume of data between two IP addresses.

[0020] The feature extraction circuitry 106 is configured to generate the graph 109 (e.g., a protocol graph) of N number of IP addresses (nodes) associated of a selected protocol (port) among the plurality of protocols that may be present in the filtered network data set 103. The protocol graph generally includes the interconnections (input / output (I / O)) of each IP address for the selected protocol. In some embodiments, The feature extraction circuitry 106 may utilize known and / or custom graphing programs such as Python NetworkX, Cytoscape, etc.

[0021] FIG. 2A illustrates one example of a protocol graph 200 as may be generated by the feature extraction circuitry 106. As shown in graph 200, each IP address of the filtered network data set 103 is represented as a node, for example node 202. Each connection link (e.g., VO connection) for a given node to other nodes in the network is illustrated by connection lines between nodes, for example connection link 204 that connects node 202 to node 206, and represents data flow between these two nodes for the selected protocol (port). The overall presentation of graph 200 reflects concentrated portions where the number of connections between nodes is greater, and less concentrated portions generally outside of the concentrated portions. FIG. 2B illustrates another example protocol graph 220. Graph 220 illustrates a concentrated portion 222 and disconnected nodes 224 which do not interact with the nodes of the concentrated portion 222. FIG. 2C illustrates another example graph 230, similar to graph 200 of FIG. 2A.

[0022] The feature extraction circuitiy 106 is also configured to determine one or more node metrics associated with each node of a selected protocol, based on the protocol graph 109 for the selected protocol. In some example embodiments, node metrics include measurements of graphstructure, for example page rank data, betweenness centrality, and subgraph centrality. Page rank data may be generated by, for example, known page rank measurement tools such as the Google PageRank(PR) tool, etc.. Page rank data generally quantifies the number of search engine results for each node in the protocol graph 109, and may be generated by counting the number and quality of links to a node to estimate the importance of a node. In the context of the feature extraction circuitry 106, quality of a link is determined by the weighting assigned to each link (e.g., a summation of bytes exchanged over that link). The importance or influence of a node on the network is defined by the number of other nodes that can be influenced.

[0023] As is known, betweenness centrality is a graph theory operation that generally provides a measure of centrality in a graph based on shortest paths between nodes. For every pair of vertices (nodes) in a connected graph, there exists at least one shortest path between the vertices, that is, there exists at least one path such that either the number of edges that the path passes through (for unweighted graphs) or the sum of the weights of the edges (for weighted graphs) is minimized.

[0024] As is also known, the subgraph centrality metric characterizes the participation of each node in all subgraphs in a network. Subgraph centrality is calculated by taking all the closed walks on the graph 109 that can be calculated from a single node, giving more weight to shorter walks than to longer ones. The number of nodes participating in the closed graph walk are considered a subgraph of the larger graph. Betweenness centrality and subgraph centrality may be generated using known tools such as Python NetworkX, etc.

[0025] The protocol graph 109 and node metrics, determined by the feature extraction circuitry 106, for a given protocol may be used to determine membership information, as described below. In example embodiments, the training system of FIG. 1 also includes cluster membership identification circuitry 108 generally configured to determine a cluster identity for each node (IP address) in the protocol graph 109, based on the aforementioned node metrics. In some embodiments, the cluster membership identification circuitry 108 is configured to apply a K- Means ++ clustering algorithm (for example, using a known K-Means++ clustering algorithm such as a K-Means++ clustering algorithm specified by David Arthur and Segei Vassilivitskii, and / or other known and / or proprietary clustering algorithms) to partition each of the N nodes into K clusters. The cluster membership identification circuitry 108 is also configured to generate a cluster graph 111 that depicts each node as a member of an identified cluster.

[0026] The training system 100 also includes labelling and classification circuitry 110 generally configured to label and classify the nodes of the cluster graph 111 using, for example, known graphing neural network techniques. The output of the labelling and classification circuitry 110 is a labelled and classified cluster graph 111’. The labelling and classification training circuitry 110 is configured to label each node based on cluster identification, for example, by labelling nodes on a spectrum of activity (I / O activity). By way of example, the labels may include, “highly active”, moderately active”, “minimally active”, etc. and nodes associated with each activity level are clustered together. As may be appreciated, the labels “highly active”, moderately active”, “minimally active”, etc. are generally in reference to the selected protocol and generally provide a qualitative measure of activity of a given node for the selected protocol. To that end, the labelling and classification circuitry 110 may define one or more activity thresholds to define a given node as “highly active”, moderately active”, “minimally active”, etc. The labelling and classification training circuitry 110 uses cluster membership (as determined by the combination of centrality metrics) to correlate to activity levels. For example, a cluster index where the cluster members are all low values (as defined by 106) would correlate to “minimally active”, etc.

[0027] FIG. 3A illustrates a labelled and classified cluster graph 300 generated by the labelling and classification circuitry 110 for the protocol graph 200 of FIG. 2A. As illustrated by graph 300, node 302 is identified as a “highly active” node based on the node metrics. The other nodes of the selected protocol, shown generally at 304 and surrounding node 302, are identified as “less active” nodes. Node 302 is identified as belonging to a first cluster (e.g., “cluster 0”) and the rest of the nodes are identified as belonging to a second cluster (e.g., “cluster 1”). FIG. 3B illustrates another example cluster graph 320 generated by the labelling and classification circuitry 110 for the protocol graph of FIG. 2B. Graph 320 illustrates two nodes 322A and 322B as being identified as “highly active” and forming a first cluster (e.g., “cluster 0”), and the other nodes of the selected protocol, shown generally at 324 and surrounding nodes 322A and 322B, are identified as “less active” nodes. FIG. 3C illustrates another example cluster graph 330 generated by the labelling and classification circuitry 110 for the protocol graph of FIG. 2C. Graph 320 illustrates three nodes 332A, 332B and 322C as being identified as “highly active” and forming a first cluster (e.g., “cluster 0”), and the other nodes of the selected protocol, shown generally at 334 and surrounding nodes 332A, 332B and 332C, are identified as “less active” nodes.

[0028] The training system 100 may also includes training / test data dividing circuitry 1 12 generally configured to apportion the labelled and classified cluster data set (represented in graph 111’) into a training data set 113 and a test data set 115. The training data set 113 is utilized to train a model using a machine learning (ML) graphic neural network (as described below) and the test data set 115 is used to test a trained model (as described below). In some embodiments, training / test data dividing circuitry 112 is configured to apportion approximately 80% of the labelled and classified cluster data set as the training data set 113, and apportion approximately 20% of the labelled and classified cluster data set as the test data set 115. Of course, these apportionments are provided only as a non-limiting example, and in other embodiments, the apportionment may vary depending on, for example, the amount of data that may be required for training purposes, testing purposes, etc.

[0029] The system 100 also includes training and validation circuitry 114 generally configured to execute machine learning techniques (e.g., graph convolution neural network techniques) to generate a model, using training data 113, to label and classify a protocol graph (109) for a selected protocol, then test the model using the test data set 115. The labelling and classification circuitry 110 is configured to load the labelled training data 113, train a graph neural network (GNN) for node classification, and generate a trained model (frozen) 116 of the selected protocol. A GNN can include, for example, GraphSAGE, generic graph convolutional neural network, etc.

[0030] As is known, the GNN as used herein is machine learning (ML) technique that creates systems that have the ability to automatically learn and improve from experience. ML involves the development of computer programs that can access data and learn based on that data. ML algorithms typically build mathematical models based on sample, or training, data in order to make predictions or decisions without being explicitly programmed to do so. The use of training data in ML uses feature extraction in creating the training data set. The two main types of ML are Supervised learning and Unsupervised learning. Supervised learning uses labeled datasets that are designed to train or “supervise” algorithms into classifying data or predicting outcomes accurately. Supervised learning is typically used for problems requiring classification or regression analysis. Classification problems use an algorithm to accurately assign test data into specific categories.

[0031] Unsupervised learning uses machine learning algorithms to analyze and cluster unlabeled datasets. These algorithms discover hidden patterns or data groupings without the need forhuman intervention, and their ability to discover similarities and differences in information make unsupcrviscd learning the ideal solution for exploratory data analysis, cross-selling strategics, customer segmentation, and image recognition. Unsupervised learning is typically used for problems requiring clustering, e.g., K-means clustering, or association, which uses different rules to find relationships between variables in a given dataset.

[0032] Deep learning is a sub-field of ML that automates much of the feature extraction, eliminating some of the manual human intervention required and enabling the use of larger data sets. Deep learning typically uses neural networks, which are highly interconnected entities, called nodes. Each node, or artificial neuron, connects to another and has an associated weight and threshold. A node multiplies the input data with the weight, which either amplifies or dampens that input, thereby assigning significance to inputs with regard to the task the algorithm is trying to learn. If the output of any individual node is above the specified threshold value, that node is activated, sending data to the next layer of the network. Otherwise, no data is passed along to the next layer of the network. A neural network that consists of more than three layers can be considered a deep learning algorithm or a deep neural network.

[0033] The present disclosure also includes an anomaly detection system configured to determine, using the trained model, if one or more nodes of the selected protocol of the network are behaving in suspicious manner, or otherwise are behaving in a manner not predicted by the trained model. As used herein, “suspicious” activity of a node is generally defined as a node that has changed activity state (e.g., a node is previously modeled as “low activity” is later determined to be a “high activity” node, etc.) and / or one or more nodes of a selected protocol have been added or removed compared to a trained model for that protocol.

[0034] FIG. 4 illustrates an anomaly detection system 400 according to embodiments of the present disclosure. The anomaly detection system 400 may be executed during a similar state of the training system 100 (FIG. I) for a given protocol, and for a similar duration and / or time interval of the training system 100. The system 400 includes protocol selection circuitry 402 to generate a filtered data set 403 of PCAP data 101 for a selected protocol, similar- to the operations of protocol selection circuitry 102 described above in reference to FIG. 1. The system 400 also includes feature extraction circuitry 406 which operates similar- to feature extraction circuitry 106, described above. In the system 400, the feature extraction circuitry 406 is generally configured to make twocopies, 409 A and 409B, of the protocol graph generated by the feature extraction circuitry 406, as described above.

[0035] The system 400 also includes cluster membership identification, labelling and classification circuitry 420 generally configured to operate in a manner similar to the cluster membership identification circuitry 108 and the labelling and classification circuitry 110 described above with reference to FIG. 1. Using the first copy of the protocol graph data 409A, the cluster membership identification, labelling and classification circuitry 420 is configured to generate a current, run-time, labelled and classified cluster graph 421. The system 400 also includes predicted cluster membership identification, labelling and classification circuitry 422 generally configured to generate a predicted labelled and classified cluster graph 423 based on the second copy of the protocol graph data 409B and the trained model 116, described above with reference to FIG. 1. The predicted cluster membership identification, labelling and classification circuitry 422 runs an identical GNN machine learning algorithm for a classification as the training / validation circuitry 114 of FIG.1.

[0036] The system 400 also includes comparator circuitry 424 to compare the current cluster graph data 421 with the predicted cluster graph data 423 to determine any changes between the current cluster graph 421 (representing an actual current state of the protocol) and the predicted cluster graph 423. The anomaly detection system 400 also includes anomaly detection circuitry 426 generally configured to determine if changes between the predicted cluster graph 423 and the current cluster graph 421, as determined by comparator circuitry 424 are representative of potential threats, for example, increased activity on a node, new nodes added in the protocol, differing page ranks among nodes, etc. For example, a node shifting from “minimally active” to “highly active” on protocols such as Kerberos or Microsoft Server Message Block (SMB) can potentially be an indication of lateral movement behavior of Advanced Persistent Threats (APTs). A node initiating threat behavior such as network scanning may transition from “minimally active” to “highly active” in a short time window. If changes between the predicted cluster graph 423 and the current cluster graph 421 are present and / or if changes between the predicted cluster graph 423 and the current cluster graph 421 represent an actual threat in progress or a potential developing threat, the anomaly detection circuitry 426 may also be configured to flag such threats and notify personnel (e.g., system administrator, etc.) of the state of the protocol.

[0037] FIG. 5 illustrates a flowchart 500 of operations according to one embodiment of the present disclosure. In particular, the flowchart 500 of FIG. 5 illustrates example training operations to develop a model of a selected protocol of a network protocol, to be used for protocol anomaly detection. The operations of FIG. 5 include filtering network data for a selected protocol 502. Operations also include determining one or more network metrics (e.g., page rank and / or centrality, and / or other network metrics, etc.) of the filtered network data and generating a protocol graph representative of the filtered network data 504. Operations further include determining cluster membership for each node of the selected protocol based on the protocol graph and the one or more network metrics 506. Operations also include labelling and classifying the identified cluster membership nodes based on network activity for a given node 508. Operations further include developing a trained model for the labelled and classified cluster members of the protocol 510. Operations further include testing the trained model 512, and freezing the trained model 514.

[0038] FIG. 6 illustrates a flowchart 600 of operations according to an embodiment of the present disclosure. In particular, the flowchart 600 of FIG. 6 illustrates example network anomaly detection operations according to an embodiment. The operations of FIG. 6 include filtering network data for a selected protocol 602. Operations also include determining one or more network metrics (e.g., page rank and / or centrality, and / or other network metrics, etc.) of the filtered network data and generating a first and second copies of a protocol graph representative of the filtered network data 604. Operations further include, using the first copy of the cluster graph, determining current cluster membership identification, labelling and classification for each node in the selected protocol 606. Operations further include determining a predicted cluster membership identification, labelling and classification for each node in the selected protocol, using the second cluster graph and a previously generated trained model of the selected network protocol 608. Operations further include comparing the current cluster membership identification, labelling and classification to the predicted cluster membership identification, labelling and classification for each node of the selected network protocol 610 to determine differences between the current cluster membership identification, labelling and classification and the predicted cluster membership identification, labelling and classification.

[0039] While FIGS. 5 and 6 illustrate various operations according to one or more embodiments, it is to be understood that not all of the operations depicted in FIGS. 5 or 6 are necessary for otherembodiments. Indeed, it is fully contemplated herein that in other embodiments of the present disclosure, the operations depicted in FIGS. 5 and / or 6, and / or other operations described herein, may be combined in a manner not specifically shown in any of the drawings, but still fully consistent with the present disclosure. Thus, claims directed to features and / or operations that are not exactly shown in a single drawing, but otherwise described elsewhere herein, are deemed within the scope and content of the present disclosure.

[0040] As used in this application and in the claims, a list of items joined by the term “and / or” can mean any combination of the listed items. For example, the phrase “A, B and / or C” can mean A; B; C; A and B; A and C; B and C; or A, B and C. As used in this application and in the claims, a list of items joined by the term “at least one of’ can mean any combination of the listed terms. For example, the phrases “at least one of A, B or C” can mean A; B; C; A and B; A and C; B and C; or A, B and C.

[0041] Any of the operations described herein may be implemented in a system that includes one or more non-transitory storage devices having stored therein, individually or in combination, instructions that when executed by circuitry perform the operations. Such instructions may embodied as, for example, machine code, and / or “higher level” implementations such as software programing, application (app) programming, etc. “Circuitry", as used in any embodiment herein, may comprise, for example, singly or in any combination, hardwired circuitry, programmable circuitry such as processors comprising one or more individual instruction processing cores, state machine circuitry, and / or firmware that stores instructions executed by programmable circuitry and / or future computing circuitry including, for example, massive parallelism, analog or quantum computing, hardware embodiments of accelerators such as neural net processors and non-silicon implementations of the above. The circuitry may, collectively or individually, be embodied as circuitry that forms pari of a larger system, for example, an integrated circuit (IC), system on-chip (SoC), application-specific integrated circuit (ASIC), programmable logic devices (PLD), digital signal processors (DSP), field programmable gate array (FPGA), logic gates, registers, semiconductor device, chips, microchips, chip sets, etc.

[0042] The storage device includes any type of tangible medium, for example, any type of disk including hard disks, floppy disks, optical disks, compact disk read-only memories (CD-ROMs), compact disk rewritables (CD-RWs), and magneto-optical disks, semiconductor devices such as read-only memories (ROMs), random access memories (RAMs) such as dynamic and staticRAMs, erasable programmable read-only memories (EPROMs), electrically erasable programmable read-only memories (EEPROMs), flash memories, Solid State Disks (SSDs), embedded multimedia cards (eMMCs), secure digital input / output (SDIO) cards, magnetic or optical cards, or any type of media suitable for storing electronic instructions. Other embodiments may be implemented as software executed by a programmable control device. Also, it is intended that operations described herein may be distributed across a plurality of physical devices, such as processing structures at more than one different physical location.

[0043] Accordingly, one embodiment of the present disclosure provides network protocol anomaly detection system. The network protocol anomaly detection system includes a training system configured to capture network data associated with a network including a plurality of nodes of the network; filter the network based on a selected protocol to determine a number of nodes associated with the selected protocol; determine one or more metrics associated with each node of the selected protocol; determine cluster membership identification for each node of the selected protocol based on the one or more metrics; generate a first cluster graph representing the nodes and the membership identification; train a neural network to determine a function equivalent for each cluster and label each cluster; and generate a frozen trained model of the function equivalent to each cluster membership. The network protocol anomaly detection system also includes an anomaly detection system configured to capture network data associated with the network including a plurality of nodes of the network; filter the network based on the selected protocol to determine a number of nodes associated with the selected protocol; determine the one or more metrics associated with each node of the selected protocol; determine cluster membership identification for each node of the selected protocol based on the one or more metrics; generate a second cluster graph representing the nodes and the membership identification; compare the second cluster graph to the first cluster graph using the frozen trained model; and determine differences between the first cluster graph and the second cluster graph.

[0044] In another embodiment, the present disclosure provides an network protocol anomaly training system that includes a non-transitory storage device that includes machine-readable instructions that, when executed by one or more processors, cause the one or more processors to perform operations including capture network data associated with a network including a plurality of nodes of the network; filter the network based on a selected protocol to determine a number of nodes associated with the selected protocol; determine one or more metrics associatedwith each node of the selected protocol; determine cluster membership identification for each node of the selected protocol based on the one or more metrics; and generate a first cluster graph representing the nodes and the membership identification; train a neural network to determine a function equivalent for each cluster and label each cluster; a generate a frozen trained model of the function equivalent to each cluster membership.

[0045] In yet another embodiment, the present disclosure provides network protocol anomaly detection that includes non-transitory storage device that includes machine-readable instructions that, when executed by one or more processors, cause the one or more processors to perform operations that include: capture network data associated with the network including a plurality of nodes of the network; filter the network based on the selected protocol to determine a number of nodes associated with the selected protocol; determine one or more metrics associated with each node of the selected protocol; generate a first cluster graph and a second cluster graph; determine cluster membership identification for each node of the selected protocol based on the one or more metrics of the first cluster graph; generate a predicted labelling and classification of the second cluster graph based on a previously trained model of the network protocol; compare the second cluster graph to the first cluster graph using the frozen trained model; and determine differences between the first cluster graph and the second cluster graph.

[0046] The terms and expressions which have been employed herein are used as terms of description and not of limitation, and there is no intention, in the use of such terms and expressions, of excluding any equivalents of the features shown and described (or portions thereof), and it is recognized that various modifications are possible within the scope of the claims. Accordingly, the claims are intended to cover ad such equivalents. Various features, aspects, and embodiments have been described herein. The feattires, aspects, and embodiments are susceptible to combination with one another as well as to variation and modification, as will be understood by those having skill in the art. The present disclosure should, therefore, be considered to encompass such combinations, variations, and modifications.

Claims

What is claimed is:

1. A network protocol anomaly detection system, comprising: a training system configured to capture network data associated with a network including a plurality of nodes of the network; filter the network based on a selected protocol to determine a number of nodes associated with the selected protocol; determine one or more metrics associated with each node of the selected protocol; determine cluster membership identification for each node of the selected protocol based on the one or more metrics; generate a first cluster graph representing the nodes and the cluster membership identification; train a neural network to determine cluster membership identification; and generate a frozen trained model of the cluster membership for the selected protocol; and an anomaly detection system configured to capture network data associated with the network including a plurality of nodes of the network; filter the network based on the selected protocol to determine a number of nodes associated with the selected protocol; determine the one or more metrics associated with each node of the selected protocol; determine cluster membership identification for each node of the selected protocol based on the one or more metrics; generate a second cluster graph representing the nodes and the membership identification; compare the second cluster graph to the first cluster graph using the frozen trained model; and determine differences between the first cluster graph and the second cluster graph.

2. The system of claim 1, wherein the selected protocol includes a selected port associated with the network.

3. The system of claim 1, wherein the one or more metrics includes a page rank metric for each node of the selected protocol and centrality data for each node of the selected protocol.

4. The system of claim 3, wherein the centrality data includes betweenness centrality for each node of the selected protocol and subgraph centrality for each node of the selected protocol.

5. The system of claim 1, wherein the cluster membership identification is determined using a K-Means++ algorithm.

6. The system of claim 1 , wherein the neural network is a graph neural network (GNN) and the label includes information of the activity level of a node.

7. A non-transitory storage device that includes machine-readable instructions that, when executed by one or more processors, cause the one or more processors to perform operations, comprising: capture network data associated with a network including a plurality of nodes of the network; filter the network based on a selected protocol to determine a number of nodes associated with the selected protocol; determine one or more metrics associated with each node of the selected protocol; determine cluster membership identification for each node of the selected protocol based on the one or more metrics; generate a first cluster graph representing the nodes and the membership identification; train a neural network to determine a function equivalent for each cluster and label each cluster; a generate a frozen trained model of the function equivalent to each cluster membership.

8. The non-transitory storage device of claim 7, wherein the selected protocol includes a selected port associated with the network.

9. The non-transitory storage device of claim 7, wherein the one or more metrics includes a page rank metric for each node of the selected protocol and centrality data for each node of the selected protocol.

10. The non-transitory storage device of claim 9, wherein the centrality data includes betweenness centrality for each node of the selected protocol and subgraph centrality for each node of the selected protocol.

11. The non-transitory storage device of claim 7, wherein the cluster membership identification is determined using a K-Means protocol.

12. The non-transitory storage device of claim 7, wherein the neural network is a graph neural network (GNN) and the label includes information of the activity level of a node.

13. A non-transitory storage device that includes machine-readable instructions that, when executed by one or more processors, cause the one or more processors to perform operations, comprising: capture network data associated with the network including a plurality of nodes of the network; filter the network based on the selected protocol to determine a number of nodes associated with the selected protocol; determine one or more metrics associated with each node of the selected protocol; generate a first cluster graph and a second cluster graph; determine cluster membership identification for each node of the selected protocol based on the one or more metrics of the first cluster graph; generate a predicted labelling and classification of the second cluster graph based on a previously trained model of the network protocol; compare the second cluster graph to the first cluster graph using the frozen trained model; and determine differences between the first cluster graph and the second cluster graph.

14. The non-transitory storage device of claim 13, wherein the selected protocol includes a selected port associated with the network.

15. The non-transitory storage device of claim 13, wherein the one or more metrics includes a page rank metric for each node of the selected protocol and centrality data for each node of the selected protocol.

16. The non-transitory storage device of claim 15, wherein the centrality data includes betweenness centrality for each node of the selected protocol and subgraph centrality for each node of the selected protocol.

17. The non-transitory storage device of claim 13, wherein the cluster membership identification is determined using a K-Mcans protocol.

18. The non-transitory storage device of claim 13, wherein the neural network is a graph neural network (GNN) and the label includes information of the activity level of a node.

19. The non-transitory storage device of claim 13, wherein the previously trained model includes machine-readable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations, comprising: capture network data associated with a network including a plurality of nodes of the network; filter the network based on a selected protocol to determine a number of nodes associated with the selected protocol; determine one or more metrics associated with each node of the selected protocol; determine cluster membership identification for each node of the selected protocol based on the one or more metrics; generate a first cluster graph representing the nodes and the membership identification; train a neural network to determine a function equivalent for each cluster and label each cluster; a generate a frozen trained model of the function equivalent to each cluster membership.

20. The non-transitory storage device of claim 19, wherein the selected protocol includes a selected port associated with the network.

21. The non-transitory storage device of claim 19, wherein the one or more metrics includes a page rank metric for each node of the selected protocol and centrality data for each node of the selected protocol.

22. The non-transitory storage device of claim 21, wherein the centrality data includes betweenness centrality for each node of the selected protocol and subgraph centrality for each node of the selected protocol.

23. The non-transitory storage device of claim 19, wherein the cluster membership identification is determined using a K-Mcans protocol.

24. The non-transitory storage device of claim 19, wherein the neural network is a graph neural network (GNN) and the label includes information of the activity level of a node.

Images