US 12,225,024 B2
Methods and apparatus for monitoring network events for intrusion detection
Geoffrey Ryan Salmon, East York (CA); Hazem Mohamed Ahmed Soliman, Toronto (CA); and Mohan Rao, Mississaugua (CA)
Assigned to Arctic Wolf Networks, Inc., Eden Prairie, MN (US)
Filed by Arctic Wolf Networks, Inc., Eden Prairie, MN (US)
Filed on Jul. 14, 2023, as Appl. No. 18/352,490.
Application 18/352,490 is a continuation of application No. 18/056,840, filed on Nov. 18, 2022, granted, now 11,792,214.
Prior Publication US 2024/0171595 A1, May 23, 2024
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 29/06 (2006.01); H04L 9/40 (2022.01)
CPC H04L 63/1416 (2013.01) [H04L 63/1425 (2013.01); H04L 63/1441 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A method, comprising:
converting, via a processor, a plurality of sets of events associated with a first device into a time series, each set of events from the plurality of sets of events associated with the first device and a second device from a plurality of second devices that is different for remaining sets of events from the plurality of sets of events and does not include the first device;
performing, via the processor, a discrete Fourier transform based on the time series to generate an output, wherein performing the discrete Fourier transform includes:
normalizing the time series to generate a normalized time series;
calculating, using the normalized time series, a linear regression fit that includes indication of a slope and an intercept;
subtracting the slope and the intercept from the normalized time series to generate a modified normalized time series;
applying a hamming window to the normalized time series to generate an input; and
generating the output based on inputting the input to the discrete Fourier transform;
identifying, via the processor and based on the output, an attribute associated with an event from a set of events from the plurality of sets of events that is predicted to cause a periodic behavior; and
sending, via the processor, a signal to cause an output including representation of the attribute.