Battelle Memorial Institute

Satish Chikkagoudar

Thomas E Carroll

Thomas W Edgar

Lars J Kangas

Dennis G Thomas

Daniel M Johnson

Kristine M Arthur

Kiri J Oler

Kristine M Arthur-Durett

A network analysis tool receives network flow information and uses deep learning&#x2014;machine learning that models high-level abstractions in the network flow information&#x2014;to identify dependencies between network assets. Based on the identified dependencies, the network analysis tool can discover functional relationships between network assets. For example, a network analysis tool receives network flow information, identifies dependencies between multiple network assets based on evaluation of the network flow information, and outputs results of the identification of the dependencies. When evaluating the network flow information, the network analysis tool can pre-process the network flow information to produce input vectors, use deep learning to extract patterns in the input vectors, and then determine dependencies based on the extracted patterns. The network analysis tool can repeat this process so as to update an assessment of the dependencies between network assets on a near real-time basis.

Extracting dependencies between network assets using deep learning

A network analysis tool evaluates network flow information in complementary workflows to identify one-hop behavior of network assets and also identify multi-hop dependencies between network assets. In one workflow (e.g., using association rule learning), the network analysis tool can identify significant one-hop communication patterns to and/or from network assets, taken individually. Based on the identified one-hop behavior, the network analysis tool can discover patterns of similar communication among different network assets, which can inform decisions about deploying patch sets, mitigating damage, configuring a system, or detecting anomalous behavior. In a different workflow (e.g., using deep learning or cross-correlation analysis), the network analysis tool can identify significant multi-hop communication patterns that involve network assets in combination. Based on the identified multi-hop dependencies, the network analysis tool can discover functional relationships between network assets, which can inform decisions about configuring a system, managing critical network assets, or protecting critical network assets.

Complementary workflows for identifying one-hop network behavior and multi-hop network dependencies

Growing community of inventors

Richland, WA, United States of America

Satish Chikkagoudar