Raytheon Company

Nightwing Group, Llc.

Nandi O Leslie

Discussed herein are devices, systems, and methods for detecting anomalous or malicious processes based on in-vehicle network traffic data. A method includes receiving, at a monitor device, a controller access network (CAN) bus packet from an electronic control unit (ECU), implementing an ensemble hierarchical agglomerative clustering (E-HAC) algorithm to identify respective clusters to which the CAN bus data maps, and determining, based on the identified respective clusters, whether the CAN bus packet is associated with in-vehicle network intrusion.

In-vehicle network intrusion detection using unsupervised learning

Discussed herein are devices, systems, and methods for detecting anomalous or malicious processes based on a network session. A method includes receiving a network session, implementing a stacked hierarchical agglomerative clustering (HAC) algorithm that operates multiple HAC algorithms to identify respective clusters to which the network session maps, each HAC algorithm of the StackHAC algorithm operates using a different linkage function and distance pair, appending the respective clusters from the multiple HAC algorithms to a feature vector representing the network session resulting in an augmented feature space, and determining, using a classifier or clustering model that operates using the augmented feature space as input, whether each of the network sessions is associated with a network intrusion.

Stack-HAC for machine learning based botnet detection

Discussed herein are devices, systems, and methods for detecting anomalous or malicious processes based on a network flow data. A method for network intrusion detection, the method comprising receiving a network flow data, implementing a topological data analysis (TDA) algorithm to identify respective birth and death of homological classes to which the network flow data maps, appending the respective (birth, death) pairs along with additional TDA-based features to a feature space resulting in an augmented feature space, and determining, using a machine learning algorithm the operates on the augmented feature space as input, whether the network flow data is associated with a network intrusion.

Growing community of inventors

Silver Spring, MD, United States of America

Nandi O Leslie