Traffic anomaly analysis for the detection of aberrant network code

摘要

A method for detecting nodes in an enterprise network infected with aberrant code is presented in which traffic conversation information representative of traffic conversation in the enterprise network over an analysis period is obtained. Analysis of the obtained traffic conversation information identifies suspected infected nodes in the enterprise network that exhibit behavior outside of the normal behavior associated with the one or more traffic conversation factors. Anomaly analysis may be performed on traffic conversation information associated with the suspected infected nodes to identify any existing infected nodes in the enterprise network.

主权项

1. A method, comprising:
obtaining a first plurality of values representative of data transported via respective ones of a plurality of traffic conversations within an enterprise network during an analysis period; computing, via a processor, a statistical attribute of the first plurality of values; computing, via the processor, a threshold based on the computed statistical attribute; comparing the first plurality of values to the computed threshold to identify a subset of nodes of the enterprise network suspected of including aberrant code; and identifying from the subset of nodes a first node as including the aberrant code based on a second plurality of values characterizing destinations contacted by respective ones of the subset of nodes.