发明授权
US08644342B2 Apparatus method and medium for detecting payload anomaly using N-gram distribution of normal data
有权
使用正常数据的N-gram分布来检测有效载荷异常的装置方法和介质
- 专利标题： Apparatus method and medium for detecting payload anomaly using N-gram distribution of normal data
- 专利标题（中）： 使用正常数据的N-gram分布来检测有效载荷异常的装置方法和介质
-
申请号： US12615917申请日： 2009-11-10
-
公开(公告)号： US08644342B2公开(公告)日： 2014-02-04
- 发明人: Salvatore J Stolfo , Ke Wang
- 申请人： Salvatore J Stolfo , Ke Wang
- 申请人地址： US NY New York
- 专利权人： The Trustees of Columbia University in the City of New York
- 当前专利权人： The Trustees of Columbia University in the City of New York
- 当前专利权人地址： US NY New York
- 代理机构： Byrne Poh LLP
- 主分类号： H04L12/28
- IPC分类号： H04L12/28 ; H04J3/16 ; H04J3/24 ; G06F9/00 ; G06F11/00
摘要：
A method, apparatus and medium are provided for detecting anomalous payloads transmitted through a network. The system receives payloads within the network and determines a length for data contained in each payload. A statistical distribution is generated for data contained in each payload received within the network, and compared to a selected model distribution representative of normal payloads transmitted through the network. The model payload can be selected such that it has a predetermined length range that encompasses the length for data contained in the received payload. Anomalous payloads are then identified based on differences detected between the statistical distribution of received payloads and the model distribution. The system can also provide for automatic training and incremental updating of models.
公开/授权文献
信息查询
