Narus, Inc.

Supranamaya Ranjan

Antonio Nucci

Aleksandar Kuzmanovic

Zhi-Li Zhang

Joshua Robinson

Feilong Chen

Ionut Trestian

Lixin Gao

Jian Qiu

Travis Edward Dawson

Ram Keralapura

Su Chen

Smriti Bhagat

Joe Cowan

Robert Edward Esposito

Ramakrishna Keralapura

A method is provided for collecting and processing information of a target who is a user of a communication network. The method includes obtaining a first identifier of the target, accessing, based on a handle of the first identifier, a first public webpage associated with the target in a first Internet site identified based on a domain of the first identifier, extracting content of the first public webpage for including in target data of the target, obtaining a third identifier of the target, intercepting a document associated with the target from a private portion of communication network traffic identified based on a domain of the third identifier, extracting content of the document for including in the target data, determining a second identifier by searching the target data, associating the second identifier with the target based on a pre-determined criterion, and collecting information of the target based on the second identifier.

System and method for collecting and processing information of an internet user via IP-web correlation

A method for identifying a botnet in a network, including analyzing historical network data using a pre-determined heuristic to determine values of a connectivity graph based feature in the historical network data, obtaining a ground truth data set having labels assigned to data units in the historical network data identifying known malicious nodes in the network, analyzing the historical network data and the ground truth data set using a machine learning algorithm to generate a model representing the labels as a function of the values of the connectivity graph based feature, analyzing real-time network data using the pre-determined heuristic to determine a value of the connectivity graph based feature for a data unit in the real-time network data, assigning a label to the data unit by applying the model to the value of the connectivity graph based feature, and categorizing the data unit as associated with the botnet based on the label.

Machine learning based botnet detection using real-time connectivity graph based traffic features

A method for identifying a botnet in a network, including analyzing historical network data using a pre-determined heuristic to determine values of a feature in the historical network data, obtaining a ground truth data set having labels assigned to data units in the historical network data identifying known malicious nodes in the network, analyzing the historical network data and the ground truth data set using a machine learning algorithm to generate a model representing the labels as a function of the values of the feature, analyzing real-time network data using the pre-determined heuristic to determine a value of the feature for a data unit in the real-time network data, assigning a label to the data unit by applying the model to the value of the feature, and categorizing the data unit as associated with the botnet based on the label.

Machine learning based botnet detection using real-time extracted traffic features

A method and system to detect botnet beaconing event based on a beacon detection rule set to generate a beacon alert, which is in turn used to trigger an elevated exfiltration detection activity by reducing various thresholds in an exfiltration detection rule set.

Botnet beacon detection

Embodiments of the invention address the problem of detecting bots in network traffic based on a classification model learned during a training phase using machine learning algorithms based on features extracted from network data associated with either known malicious or known non-malicious client and applying the learned classification model to features extracted in real-time from current network data. The features represent communication activities between the known malicious or known non-malicious client and a number of servers in the network.

Machine learning based botnet detection with dynamic adaptation

The present invention relates to a method of profiling an Internet endpoint associated with an Internet Protocol (IP) address, an IP prefix, or a domain name, the method includes generating a profiling rule using an Internet search engine, obtaining a search result by inputting the IP address, the IP prefix, or the domain name to the Internet search engine, and classifying the Internet endpoint based on the search result using the profiling rule.

System and method for internet endpoint profiling

The invention relates to a method for profiling VoIP activity in network traffic. The method includes obtaining a plurality of audio packets from a plurality of packets in the network traffic by analyzing a plurality of parameter sets based on a first pre-determined criterion, wherein each of the plurality of parameter sets corresponds to a packet of the plurality of packets and comprises a packet size and a packet arrival time associated with a corresponding packet of the plurality of packets, generating a count of an IP address by counting at least a portion of the plurality of audio packets, wherein each packet of the portion of the plurality of audio packets comprises the IP address, and identifying an endpoint corresponding to the IP address as a VoIP server and identifying the portion of the plurality of audio packets as VoIP activity associated with the VoIP server when the count exceeds a pre-determined threshold.

VoIP traffic behavior profiling method

With the widespread adoption of SIP-based VoIP, understanding the characteristics of SIP traffic behavior is critical to problem diagnosis and security protection of VoIP services. A general methodology is provided for profiling SIP-based VoIP traffic behavior at several levels: SIP server host, server entity (e.g., registrar and call proxy) and individual user levels. Using SIP traffic traces captured in a production VoIP network, the characteristics of SIP-based VoIP traffic behavior in an operational environment is illustrated and the effectiveness of the general profiling methodology is demonstrated. In particular, the profiling methodology identifies anomalies due to performance problems and/or implementation flaws through a case study. The efficacy of the methodology in detecting potential VoIP attacks is also demonstrated through a test-bed experimentation.

SIP-based VoIP traffic behavior profiling method

A method for content transmission in a cellular network having a collection of cellular zones. The method includes obtaining a statistical trace associated with the cellular network, comprising attributes of historical content chunks received from prior users of the cellular network and trajectories of the prior users moving within the cellular zones, analyzing the statistical trace to identify a portion of the cellular zones as drop zones, allocating drop zone transmission bandwidth to the drop zones based on a pre-determined criterion, receiving, subsequent to the allocating, a transmission request for a content chunk from a mobile device of a user outside the drop zones, delaying transmission of the content chunk while the mobile device remains outside of the drop zones, and transmitting the content chunk in response to detecting the mobile device within the drop zones.

Allocating drop zones in a mobile communication network

A method for detecting automatically generated malicious domain names in a network. The method includes identifying a plurality of domain name service (DNS) queries in the network, wherein the plurality of DNS queries share a common attribute, analyzing, using a central processing unit (CPU) of a computer, the plurality of DNS queries to identify a plurality of alphanumeric elements embedded in a set of domain names associated with the plurality of DNS queries, analyzing, using the CPU, the plurality of alphanumeric elements to determine a distribution metric of the set of domain names, and generating an alert based on the distribution metric according to a pre-determined criterion.

Detecting DNS fast-flux anomalies

A method for providing location based service in a cellular data service network (CDSN) by analyzing accounting data packets of the CDSN to determine a user mobility pattern, classifying application data packets of the CDSN into pre-determined application categories, analyzing the accounting data packets and the application data packets to associate the user mobility pattern and one of the pre-determined application category, comparing a newly received accounting data packet and the user mobility pattern to identify a match, and providing, in response to identifying the match, the location based service to a user based on the pre-determined application category.

Correlating user interests and location in a mobile network

The present invention relates to a method for containing propagation of a malware in a communication network having a plurality of communication nodes. The method steps include obtaining communication statistics from a traffic trace of the communication network, generating a weighted graph from the communication statistics to represent a communication pattern in the communication network, partitioning the weighted graph based on a pre-determined criteria into at least a first sub-graph representing a first portion of the communication network and a second sub-graph representing a second portion of the communication network, identifying a separator vertex from a plurality of vertices of the weighted graph, the separator vertex connecting the first sub-graph and the second sub-graph, the separator vertex representing a separator node of the plurality of communication nodes, and providing a security patch to the separator node for preventing propagation of the malware between the first portion of the communication network and the second portion of the communication network.

System and method for malware containment in communication networks

With the widespread adoption of SIP-based VoIP, understanding the characteristics of SIP traffic behavior is critical to problem diagnosis and security protection of VoIP services. A general methodology is provided for profiling SIP-based VoIP traffic behavior at several levels: SIP server host, server entity (e.g., registrar and call proxy) and individual user levels. Using SIP traffic traces captured in a production VoIP network, the characteristics of SIP-based VoIP traffic behavior in an operational environment is illustrated and the effectiveness of the general profiling methodology is demonstrated. In particular, the profiling methodology identifies anomalies due to performance problems and/or implementation flaws through a case study. The efficacy of the methodology in detecting potential VoIP attacks is also demonstrated through a test bed experimentation.

The present invention relates to a method of compressing data in a network, the data comprising a plurality of packets each having a header and a payload, the header comprising a plurality of header fields, the method comprising generating a classification tree based on at least a portion of the plurality of header fields, determining a inter-packet compression plan based on the classification tree, and performing inter-packet compression in real time for each payload of at least a first portion of the plurality of packets, the inter-packet compression being performed according to at least a portion of the inter-packet compression plan.

System and method for network data compression

The present invention relates to a method of profiling an Internet endpoint associated with an Internet Protocol (IP) address, the method includes generating a profiling rule using an Internet search engine, obtaining a search result by inputting the IP address to the Internet search engine, and classifying the Internet endpoint based on the search result using the profiling rule.

Growing community of inventors

Albany, CA, United States of America

Supranamaya Ranjan