Alert Logic, Inc.

Ian Rickey

Dagen Wang

A network security system collects event data over a long duration and mines the event data to identify unique conversations between each unique pair of a source network address and a destination network address. Events in each unique conversation are associated with signature identifiers that identify different types of attacks. Each signature thus identified is assigned with a unique visual clue. The unique visual clue has a particular visual character that reflects a number of occurrences of a particular event. For payload sizes associated with the event, a spatial scale representation is determined. The network security system generates a visualization relative to a conversation timeline for presentation on a user interface. The visualization contains unique visual clues for the different types of attacks associated with the signature identifiers and the spatial scale representation of the payload sizes associated with the events associated with the signature identifiers.

Systems and methods for threat visualization with signature composure, spatial scale and temporal expansion

Attackers may be uniquely identified by their temporal behavior patterns. Time marks and events in a time sequence between a unique pair of a source network address and a destination network address are pre-processed by a network security system to generate a temporal sequence for spectral extraction. The destination network address resides in a computer network monitored by the network security system. The temporal sequence is transformed from the time domain to the frequency domain to capture periodicity in the time sequence in a spectral vector. The spectral vector is denoised and decorrelated through deep learning to produce a spectral fingerprint that is significantly smaller than the spectral vector. The spectral fingerprint represents a temporal behavior fingerprint of an attacker associated with the source network address with respect to the destination network address over a period of time in the time sequence.

Systems and methods for attacker temporal behavior fingerprinting and grouping with spectrum interpretation and deep learning

This disclosure provides a new automated threat detection using synchronized log and Snort streams. Time segments from a log stream are correlated by time to time segments from a Snort stream that have been identified as indicating 'true' incidents. To determine whether a correlated time segment is 'good' or &#x201c;bad,&#x201d; features are extracted from the correlated time segment and used to determine tuples associated therewith, each tuple containing a message type, a location, and an out of vocabulary word in the correlated time segment. A multidimensional feature vector containing a select number of the tuples is generated and provided as input to a machine learning module which determines, based on machine intelligence, whether the correlated time segment indicates a true incident.

Growing community of inventors

Houston, TX, United States of America

Ian Rickey