Method and system for intrusion detection

Abstract

Disclosed herein are methods and systems that apply a multi-layer Hidden Markov Model (HMM) for intrusion detection. The methods and systems employ a dimension reduction technique to extract only important features from network packet data and apply a decomposition algorithm to lower levels of data to construct lower level HMMs (representing partial solutions), which lower level HMMs are then combined to form a final, global solution. The multi-layer approach can be expanded beyond the exemplary case of 2 layers in order to capture multi-phase attacks over longer spans of time. A pyramid of HMMs can resolve disparate digital events and signatures across protocols and platforms to actionable information where lower layers identify discrete events (such as network scan) and higher layers identify new states which are the result of multi-phase events of the lower layers.