Anomaly detector for computer networks

摘要

A computer system includes a data collector and an anomaly detector. The data collector monitors network traffic/event log and sends monitoring data to the anomaly detector. The anomaly detector extracts values for a category of measure from the monitoring data and processes the values to generate a processed value. The anomaly detector predicts an expectation value of the category of measure based at least on time decayed residual processed values. The anomaly detector determines a deviation of the processed value from the expectation value to detect an anomaly event, and applies a security rule to the anomaly event to detect a security event.

主权项

1. A system comprising:
a data collector comprising a first computer, wherein the data collector monitors a computer network; and an anomaly detector comprising one or more computers, wherein the anomaly detector receives monitoring data from the data collector, extracts values for a category of measure from the monitoring data, processes the values for the category of measure to generate a processed value, applies a time decay factor to residual processed values previously received from the data collector to generate time decayed residual processed values, determines an expectation value of the category of measure based at least on the time decayed residual processed values, and determines a deviation of the processed value from the expectation value of the category of measure to detect an anomaly event.