DETECTING FLOW ANOMALIES

摘要

An example method can include receiving network data related to a distributed system. A statistical model of the distributed system based on the network data can be employed to determine a statistical deviation of a given flow of information through a portion of the distributed system. A number of statistically deviated flows connected to the given flow can be determined based on a context of the distributed system. A determination can be made if the given flow is an anomaly based on the number of statistically deviated flows connected to the given flow.

主权项

1. A method, comprising:
receiving, by a system comprising a non-transitory memory and a processing resource, network data related to a distributed system; employing, by the system, a statistical model of the distributed system based on the network data to determine a statistical deviation of a given flow of information through a portion of the distributed system; determining, by the system, a number of statistically deviated flows connected to the given flow based on a context of the distributed system; and determining, by the system, if the given flow is an anomaly based on the number of statistically deviated flows connected to the given flow.