US 12,132,748 B2
Machine learning detection of network attacks using traffic and log information
Zhiyan Chen, Ottawa (CA); Murat Simsek, Ottawa (CA); Burak Kantarci, Ottawa (CA); Petar Djukic, Ottawa (CA); James P'ford't Carnes, III, Baltimore, MD (US); Mehran Bagheri, Orleans (CA); Jinxin Liu, Ottawa (CA); and Yu Shen, Ottawa (CA)
Assigned to Ciena Corporation, Hanover, MD (US)
Filed by Ciena Corporation, Hanover, MD (US)
Filed on Jan. 7, 2022, as Appl. No. 17/571,342.
Claims priority of provisional application 63/150,694, filed on Feb. 18, 2021.
Prior Publication US 2022/0263842 A1, Aug. 18, 2022
Int. Cl. H04L 9/40 (2022.01); G06N 3/08 (2023.01); H04L 41/0631 (2022.01); H04L 43/04 (2022.01); H04L 61/5061 (2022.01)
CPC H04L 63/1416 (2013.01) [G06N 3/08 (2013.01); H04L 41/0631 (2013.01); H04L 43/04 (2013.01); H04L 61/5061 (2022.05); H04L 63/0227 (2013.01); H04L 63/0236 (2013.01); H04L 63/1425 (2013.01); H04L 63/20 (2013.01)] 20 Claims
OG exemplary drawing
 
1. An Intrusion Detection System (IDS) comprising:
a processing device, and
a memory device configured to store a computer program having instructions that, when executed, enable the processing device to
obtain network traffic information regarding data traffic in a network under observation,
obtain system log information regarding operations of the network under observation,
insert the network traffic information and the system log information into multiple different machine learning analysis procedures, wherein each machine learning analysis procedure of the multiple different machine learning analysis procedures is configured to detect a different sub-attack of a multi-stage attack to which the network under observation is susceptible,
combine the outputs of the multiple different machine learning analysis procedures to detect whether and determine a time period during which one or more sub-attacks have been launched against the network under observation, and
in response to detecting that one or more sub-attacks have been launched during the determined time period, determine the type of the one or more sub-attacks.