AT&T Intellectual Property I, LP

Melissa Lee

Johan Muedsam

Joshua Whitney

Aarthi Reddy

Meredith Ordway-West

Mukund Rao

A method for detecting anomalous streaming network traffic data in real time includes: creating an anomaly detection model including a singular value matrix and a data pattern matrix from a matrix of historical network traffic data; storing the singular value matrix and the data pattern matrix of the anomaly detection model; receiving streaming network traffic data; performing a log transform on the streaming network traffic data; applying the anomaly detection model to a matrix of the streaming network traffic data in real time as the streaming network traffic data is received; detecting anomalous patterns in the streaming network traffic data based on patterns identified by the anomaly detection model; and associating the anomalous patterns in the streaming network traffic data with IP addresses.

Intrusion detection using robust singular value decomposition

A method, computer-readable medium, and apparatus for classifying IP network traffic are disclosed. For example, a method may include a processor for applying a regularized probabilistic model to internet protocol network traffic for performing geolocation, wherein the internet protocol network traffic contains internet protocol address information, detecting an outlier in the internet protocol network traffic, wherein the outlier is associated with a transaction over a network, and performing a remedial action to address the outlier.

Providing security through characterizing internet protocol traffic to detect outliers

A processing system including at least one processor may obtain network traffic data of a network, including a first set of flow data associated with a first node, determine an anomaly factor of the first node from the network traffic data quantifying a deviation of the first set of flow data from a normal flow data associated with the first node, generate an exposure score of the first node in accordance with a measured influence of the first node in the network and the anomaly factor, generate a persistence score of the first node in accordance with a reputation measure of the first node and a measure of a recurrence of anomalous flow data associated with the first node, calculate a threat level of the first node from the exposure score and the persistence score, and reconfigure at least one aspect of the network in response to the threat level.

Growing community of inventors

McKinney, TX, United States of America

Melissa Lee