US 11,991,199 B2
Malicious traffic detection with anomaly detection modeling
Stefan Achleitner, Arlington, VA (US); and Chengcheng Xu, Santa Clara, CA (US)
Assigned to Palo Alto Networks, Inc., Santa Clara, CA (US)
Filed by Palo Alto Networks, Inc., Santa Clara, CA (US)
Filed on Jan. 27, 2023, as Appl. No. 18/160,834.
Application 18/160,834 is a continuation of application No. 16/999,865, filed on Aug. 21, 2020, granted, now 11,616,798.
Prior Publication US 2023/0179618 A1, Jun. 8, 2023
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/1425 (2013.01) [H04L 63/1416 (2013.01)] 18 Claims
OG exemplary drawing
 
1. A method comprising:
generating a first plurality of feature vectors for unstructured payloads of one or more malicious traffic sessions, wherein generating the first plurality of feature vectors is based, at least in part, on a plurality of malicious features for the unstructured payloads;
training an anomaly detection model on the first plurality of feature vectors to detect malicious unstructured payloads as non-anomalous and benign unstructured payloads as anomalous; and
based, at least in part, on a false positive rate of the trained anomaly detection model satisfying a performance criterion, wherein the false positive rate comprises a rate of false positives in classifications of the trained anomaly detection model on a second plurality of feature vectors,
updating the plurality of malicious features; and
deploying the trained anomaly detection model.