公开(公告)号：US10154053B2

公开(公告)日：2018-12-11

申请号：US15090992

申请日：2016-04-05

Applicant: CISCO TECHNOLOGY, INC.

Inventor： Navindra Yadav ,  Ellen Scheib ,  Rachita Agasthy

IPC: H04L29/06 ,  H04L12/24 ,  H04L12/26

Abstract: In one embodiment, a method includes receiving network data at an analytics device, identifying features for the network data at the analytics device, grouping each of the features into bins of varying width at the analytics device, the bins comprising bin boundaries selected based on a probability that data within each of the bins follows a discrete uniform distribution, and utilizing the binned features for anomaly detection. An apparatus and logic are also disclosed herein.

公开(公告)号：US20160359886A1

公开(公告)日：2016-12-08

申请号：US15090992

申请日：2016-04-05

Applicant: CISCO TECHNOLOGY, INC.

Inventor： Navindra Yadav ,  Ellen Scheib ,  Rachita Agasthy

IPC: H04L29/06

CPC classification number: H04L63/1425 ,  H04L41/142 ,  H04L41/16 ,  H04L43/062 ,  H04L63/20

Abstract: In one embodiment, a method includes receiving network data at an analytics device, identifying features for the network data at the analytics device, grouping each of the features into bins of varying width at the analytics device, the bins comprising bin boundaries selected based on a probability that data within each of the bins follows a discrete uniform distribution, and utilizing the binned features for anomaly detection. An apparatus and logic are also disclosed herein.

Abstract translation: 在一个实施例中，一种方法包括在分析设备处接收网络数据，识别分析设备处的网络数据的特征，将每个特征分组成分析设备的不同宽度的分组，所述分组包括基于 每个仓内的数据遵循离散均匀分布的概率，并利用装箱特征进行异常检测。 本文还公开了一种装置和逻辑。

公开(公告)号：US20160359695A1

公开(公告)日：2016-12-08

申请号：US15090930

申请日：2016-04-05

Applicant: CISCO TECHNOLOGY, INC.

Inventor： Navindra Yadav ,  Ellen Scheib ,  Rachita Agasthy

IPC: H04L12/26 ,  G06N99/00

CPC classification number: H04L43/04 ,  G06N20/00 ,  H04L41/142 ,  H04L41/16 ,  H04L43/12 ,  H04L63/1425

Abstract: In one embodiment, a method includes receiving at an analytics module operating at a network device, network traffic data collected from a plurality of sensors distributed throughout a network and installed in network components to obtain the network traffic data from packets transmitted to and from the network components and monitor network flows within the network from multiple perspectives in the network, processing the network traffic data at the analytics module, the network traffic data comprising process information, user information, and host information, and identifying at the analytics module, anomalies within the network traffic data based on dynamic modeling of network behavior. An apparatus and logic are also disclosed herein.

Abstract translation: 在一个实施例中，一种方法包括在网络设备上操作的分析模块处接收从分布在整个网络上的多个传感器收集并安装在网络组件中的网络业务数据，以从网络和从网络发送的分组获得网络业务数据 组件，并从网络中的多个角度监控网络内的网络流量，处理分析模块上的网络流量数据，包括进程信息，用户信息和主机信息的网络流量数据，以及在分析模块识别内的异常 基于网络行为动态建模的网络流量数据。 本文还公开了一种装置和逻辑。