Emc IP Holding Company LLC

Verizon Patent and Licensing Inc.

Scott G Carter

Scott Moore

Christopher D Bynum

Edward G Quackenbush

Etienne Boucher

Matthew D Tharp

A device receives network data and artificial packets associated with a network, and processes the network data to generate sequential sets of the network data. The device processes the sequential sets of the network data, with a time series model, to generate time series network data, and determines whether the time series network data satisfies a quality threshold. The device transforms, when the time series network data satisfies the quality threshold, residual data in the time series network data to identify data outliers, and removes the data outliers to generate modified time series network data. The device processes the modified time series network data, with a model, to generate a forecast data point, and compares the forecast data point and an actual data point to determine whether an anomaly exists in the network. The device performs one or more actions based on determining whether the anomaly exists in the network.

Systems and methods for determining network data quality and identifying anomalous network behavior

An apparatus in one embodiment comprises a first endpoint device having a processor coupled to a memory. The first endpoint device is adapted for communication with other endpoint devices over a network, and implements a key capture agent configured to interface with an operating system of the first endpoint device. The key capture agent is configured to collect key material associated with a session key utilized to encrypt packets sent by the first endpoint device to a second endpoint device over the network as part of a corresponding session. The key material and an identifier of the corresponding session are transmitted for delivery to a decoder that is not part of the first or second endpoint devices, so as to permit the decoder to be configured to decrypt the encrypted packets in intercepted network traffic. For example, the key capture agent may be configured to transmit the key material.

Decryption and analysis of network traffic using key material collected from endpoint devices of a computer network

Growing community of inventors

Denver, CO, United States of America

Scott G Carter