WO2024155206A1 - Method and system for detecting anomalous interaction between nodes in a computer network - Google Patents

Abstract

The invention relates to monitoring the operation of computer network nodes. The present method includes the steps of: a) obtaining data about the exchange of messages between computer network nodes; b) generating a graph on the basis of the obtained data; c) determining, with the aid of said graph, the values of the shortest paths between all of the computer network nodes; d) generating a vector representation for each computer network node on the basis of the shortest path values; e) reducing the dimension of the vector representations; f) clustering the computer network nodes on the basis of the vector representations obtained in step e); g) generating a first model of interaction between the computer network nodes, in which the nodes are grouped according to the clustering performed; h) generating a second model of interaction between the computer network nodes by iteratively repeating steps a) - g); i) comparing the models of interaction between the computer network nodes and identifying, in the process, the computer network nodes in the different groups; and j) generating a signal representing the identifiers of the computer network nodes found during the comparison performed in step i) to exhibit anomalous interaction. This increases the efficiency and speed of detecting anomalous interaction between computer network nodes.

Description

METHOD AND SYSTEM FOR DETECTING ANOMALIC INTERACTION OF INFORMATION COMPUTING NETWORK NODES

TECHNICAL FIELD

[0001] The claimed solution relates to the field of computer technology, in particular, to solutions for monitoring the operation of information computer network (ICN) nodes and determining abnormal interactions between nodes.

BACKGROUND OF THE ART

[0002] A method of analyzing IVS nodes to assess possible anomalous phenomena in the operation of IVS is known from the prior art (US 20200021607 A1, 01/16/2020). The solution exposes a security platform for detecting anomalies and threats in a computer network environment. The security platform is based on Big Data and uses machine learning to perform security analytics. The security platform performs User/Entity Behavior Analysis (UEBA) to detect security anomalies and threats, regardless of whether such anomalies/threats were previously known. An analysis of paths and modes for detecting anomalies and threats in real time is carried out, followed by an assessment of the network security risks of nodes.

[0003] The disadvantages of the known approach are its insufficient effectiveness in identifying abnormal operation of IVS nodes, due to the fact that the activity of nodes is not analyzed in terms of their interaction with each other and the use of this information to form behavior models of IVS nodes.

SUMMARY OF THE INVENTION

[0004] The claimed invention is aimed at solving a technical problem in terms of creating a more effective approach to analyzing anomalous interactions between nodes in an IVS.

[0005] The technical result is to increase the efficiency and speed of identifying anomalous interaction between IVS nodes, due to constant monitoring of the number of messages between nodes within a given cluster.

[0006] The claimed technical result is achieved through a method for detecting anomalous interaction of nodes of an information and computer network (ICN), which contains stages in which: a) receive data on the exchange of messages between the nodes of the IVS, wherein the data contains at least information about the number of messages transmitted between the mentioned nodes; b) form a graph based on the received data, in which the vertices are the identifiers of the IVS nodes, and the edges are the fact of message exchange between nodes, and each edge has a weight characterizing the intensity of message exchange between the corresponding nodes; c) using the resulting graph, determine the values of the shortest paths between all nodes of the IVS; d) form a vector representation for each IVS node based on the obtained values of the shortest paths; e) reducing the dimension of the resulting vector representations; f) perform clustering of IVS nodes based on the vector representations obtained at step e); g) form the first model of interaction of IVS nodes, in which the nodes are defined in groups in accordance with the performed clustering; h) form a second model of interaction between IVS nodes using iterative repetition of stages a) - g); i) perform a comparison of the first and second models of interaction between IVS nodes, during which IVS nodes located in different groups are identified; and j) generate a signal characterizing the identifiers of the IVS nodes demonstrating anomalous interaction during the comparison performed at stage i).

[0007] In one of the particular embodiments of the method, the weight of the edge is the reciprocal of the number of messages between the IVS nodes per unit of time.

[0008] In another particular embodiment of the method, step e) is performed using a machine learning algorithm.

[0009] In another particular embodiment of the method, the vector representation of nodes characterizes accumulated historical information about the interaction of the node.

[0010] The claimed result is also achieved using a system for detecting anomalous interaction of IVS nodes, wherein the system contains at least one processor and at least one memory that stores machine-readable instructions, which, when executed by the processor, implement the above method. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] FIG. 1 illustrates a block diagram of the claimed method.

[0012] FIG. Figure 2 illustrates an example of a graph generated based on information about IVS nodes.

[0013] FIG. 3 illustrates the circuit diagrams of the computing system.

IMPLEMENTATION OF THE INVENTION

[0014] In FIG. Figure 1 shows a block diagram of the implementation of the claimed method (100) for determining the anomalous interaction of IVS nodes. At the first stage (101), data about the IVS nodes is collected, in particular, such data can be device identifiers within the network, IP addresses, MAC addresses, etc. Data collection can be carried out using automated solutions, for example, data collector modules, or using software components or applications that monitor IVS. [0015] Next, based on the collected data about the IVS nodes, at stage (102), a graph (200) is generated that displays the node interaction model. In FIG. Figure 2 shows an example of the generated graph (200) between nodes (201) - (206). Node identifiers form the vertices of the graph, while edges characterize the fact that messages are exchanged between nodes. Each edge has a weight that depends on the intensity of message exchange between nodes (201) - (206) per unit of time. As shown in the example in FIG. 2, the number of messages transmitted between nodes (201)-(206) is as follows: 201-202: 4; 201-203: 5; 201-204: 2; 202-201: 8; 202-206: 14; 203-201: 3; 203-205: 2; 204-201: 5; 204-206: 3; 204-205: 7; 205-204: 12; 205-203: 4; 205-206: 8; 206-202: 6; 206-204: 1; 206-205: 5.

[0016] Intensity characteristics can be thought of as the inverse of the number of messages from node to node. Moreover, if there are no messages between nodes, then you can add connections between such nodes to this graph (200). For the number of messages between such nodes, one can determine a value equal to l/(sum(N)), where N is the number of messages transmitted between nodes. Then the number of messages between such nodes will be equal to: 1 / (4+5+2+8+14+...) = 1/89 = 0.01123.

[0017] Based on the obtained data, a matrix representation of a connected graph is formed, presented in Table 1. To describe the above graph (200), it can be represented as a matrix inherited from the adjacency matrix. In this representation, each (i, j) position will correspond to the connection between the i and j nodes of the IVS. The values in the matrix will be the distances dij, which characterize the length of the path in the graph from i-ro to j-ro node. Table 1. Matrix representation of a connected graph

[0018] At step (103), the shortest paths are determined based on the generated graph and the matrix representation of the connectivity graph. The search for shortest paths can be performed using any algorithm for finding the shortest distances between vertices of a graph, for example, Wellman, Floyd-Warshell, Dijkstra, Johnson, etc. An example of the shortest path values for some nodes is presented in Table 2.

Table 2. Values of the shortest paths between IVS nodes

[0019] Next, at step (104) for each node (201) - (206), based on the obtained values of the shortest paths, a vector representation is formed, which can have the following form:

- For node (201) vector = (3/8; 1/4; 1/5; 1/2; 9/14; 9/28);

- For node (202) vector = (1/8; 5/11; 13/40; 15/14; 1/35; 1/14).

[0020] Since the width of the matrix is not fixed, in order to transition to a vector representation of connections of nodes with a given size, a space of a lower dimension is formed at step (105). For this purpose, methods such as matrix decomposition, SVD (singular matrix decomposition), PCA (principal component analysis), IncrementalPCA, KemelPCA, SparsePCA (Sparse Principal Component Analysis), MiniBatchSparsePCA, ICA (Independent Component Analysis), NMF or NNMF ( non-negative matrix factorization), LDA (Latent Dirichlet Allocation), FactorAnalysis (Factor Analysis), K-means quantization for dimensions (K-means), SOM for dimensions (Self Organizing Map of Kohonen), LVQ (Learning Vector Quantization), t-SNE (T-distributed Stochastic Neighbor Embedding ), UMAP (Uniform Manifold Approximation and Projection), Autoencoders. Each characteristic in such a vector will characterize the correspondence to some latent connectivity. Latent connectivity is understood as a hidden (latent), implicit connection of a node with other nodes along several parameters in the aggregate. In this case, each vector parameter characterizes the connection of a node not only with one selected node, but with a group of nodes. In this case, the formation of such groups is carried out on the basis of the similarity of nodes (for example, the functional purpose of the node, control servers, etc.).

[0021] The vector representation for the reduced dimensionality nodes (201) - (206) may be as follows:

201 (15/12 7/8)

202 (7/5 43/17)

203 (13/12 9/8)

204 (31/11 23/12)

205 (7/3 5/2)

206 (3/2 3/2)

[0022] Based on the reduced-dimensional vector representations obtained at step (105), further clustering of IVS nodes is performed at step (106). Clustering is performed automatically taking into account the interaction of nodes in a given time period. To solve the problem, self-regulating algorithms (uncontrolled) can be used without initially specifying the number of clusters, taking into account the nature of a normal or other distribution.

[0023] A Gaussian mixture model may be used, which assumes that the data should be divided into clusters such that each data point in a given cluster follows a specific multivariate Gaussian distribution, and the multivariate Gaussian distributions of each cluster are independent of each other. To cluster data in such a model, it is necessary to calculate the posterior probability of a data point belonging to a given cluster given the observed data. An example method for this purpose is the Bayesian method. Since there is only a need to find the most probable cluster for a given point, one can use approximation methods, because they reduce computational work. One of the best approximation methods is to use variational Bayesian inference. Variational Baye Gaussian mixing is an expectation maximization that maximizes the lower bound of the model parameters (including prior probabilities) instead of the probability of the data.

[0024] The principle behind variational methods is the same as expectation maximization (that is, both are iterative algorithms that alternate between finding probabilities for each point that each mixture should generate and fitting the mixture to those designated points) , but variational methods add regularization by integrating information from previous distributions. This avoids the features often found in expectation maximization solutions, but introduces some subtle biases into the model. Inference is often significantly slower, but usually not so much as to make its use impractical.

[0025] Because of its Bayesian nature, the variational algorithm requires more hyperparameters than expectation maximization, the most important of which is the concentration parameter. Setting concentration to a low value will cause the model to assign most of the weight to a few IVS nodes, and the weights of the remaining nodes in the cluster will be very close to zero. High concentration values will allow more nodes to be in the cluster.

[0026] The Dirichlet distribution is used to model the concentration. The Dirichlet preprocess is a prior probability distribution for clustering with an infinite unlimited number of partitions. Variational methods make it possible to incorporate this a priori structure into Gaussian mixture models with virtually no loss of calculation time compared to a finite Gaussian mixture model. A higher concentration value will cause denser clusters to form.

[0027] The Dirichlet preprocess can use an infinite and unlimited number of clusters. The basis of the algorithm is an iterative process of selecting objects and is based on the “Stick-breaking” approach. It starts with the full sample and at each step a part of it is separated. Each time, the nodes from the selection that fall into the cluster are linked. At the end, a connection is made between nodes that do not fall into all other groups. In some problems, this creates a certain disadvantage, which is associated with the fact that all unconnected points (graph nodes) will be combined into one common, garbage cluster. However, this cluster can be interpreted as a “cluster of different nodes”, in which the nodes are physically united into one cluster not because they are similar to each other in terms of the nature of connections, and because they have a sign of similarity to each other in terms of dissimilarity with nodes from other clusters.

[0028] An example of partitioning into clusters of nodes (201) - (206) may look like this: Cluster !: (201, 203) Cluster II: (202) Cluster III: (205, 206) Cluster IV: (204).

[0029] At step (107), based on the results of the completed clustering, the first model of interaction of IVS nodes is created, displaying the definition of nodes in the group in terms of their interaction with each other.

[0030] Next, at step (108), the algorithm iteratively executes steps (101)-(107) through a given time period (for example, a day, a week, etc.), as a result of which a second model of interaction of IVS nodes is formed, which may have the following form of cluster distribution:

Cluster I: (206, 205)

Cluster II: (201, 203, 202)

Cluster III: (204).

[0031] At step (109), the obtained second and first models of interaction between IVS nodes are compared to identify nodes that have changed their placement in the second model, which may indicate an anomalous interaction with other IVS nodes. From the example above it is clear that node (202) is in a cluster with nodes (201), (203).

[0032] An example of this behavior can be considered in the following case. Let nodes (201) and (203) be servers with the Windows operating system, nodes (205) and (206) be servers with the Ubuntu operating system, and nodes (202) and (204) be client computers. In the first model, one cluster included nodes with the Windows operating system, and another cluster included nodes with the Ubuntu operating system. Client computers do not belong to any cluster (in another example, client computers can be combined into one or more common clusters). When building the next model, the client computer (202) got into the cluster with the server nodes. This may indicate that the client computer is infected with a virus and has begun to actively send broadcasts or other messages, which is typical for servers. Using the claimed method, it is possible to quickly respond to this kind of anomaly and generate a signal about the appearance of an anomaly in the IVS for node (202).

[0033] Upon completion of step (109), at step (NO), a signal is generated using a monitoring system notifying about the fact of an anomalous interaction for a specific IVS node. The control system generates a signal, which is usually transmitted to the device of the responsible cybersecurity officer. Additionally, isolation of the identified node can be used, in terms of its disconnection in the IVS network.

[0034] The proposed approach allows us to constantly form a retrospective “portrait” of the normal operation of IVS nodes. This “portrait” will represent the accumulation (integration) of many previous states of the host and reflect its change in history. This characteristic is flexible to customize and can focus attention on the latest states or, conversely, be more conservative. An integral historical portrait will allow you to compare the current, newly acquired state of the host with its previous states, and identify sudden (abnormal) changes in operation. This abnormal operation detection will make it possible to quickly identify unusual changes in the host and conduct appropriate investigations.

[0035] In FIG. 3 shows a general view of a computing system implemented on the basis of a computing device (300) and ensuring the implementation of the claimed method (100). In general, a computing device (300) contains one or more processors (301), memory devices such as RAM (302) and ROM (303), input/output interfaces (304), and input/output devices connected by a common data exchange bus. (305), and a networking device (306).

[0036] The processor (301) (or multiple processors, multi-core processor) may be selected from a variety of devices commonly used today, such as those from Intel™, AMD™, Apple™, Samsung Exynos™, MediaTEK™, Qualcomm Snapdragon™ and etc. By processor it is also necessary to take into account a graphics processor, for example an NVIDIA or ATI GPU, which is also suitable for carrying out the method (100) in whole or in part. In this case, the memory means can be the available memory capacity of the graphics card or graphics processor.

[0037] RAM (302) is a random access memory and is designed to store computer-readable instructions executable by the processor (301) to perform the necessary logical data processing operations. The RAM (302) typically contains executable operating system instructions and associated software components (applications, program modules, etc.).

[0038] ROM (303) is one or more permanent storage devices, such as a hard disk drive (HDD), solid state drive (SSD), flash memory (EEPROM, NAND, etc.), optical storage media (CD-R/RW, DVD-R/RW, BlueRay Disc, MD), etc.

[0039] To organize the operation of device components (300) and organize the operation of external connected devices, various types of I/O interfaces (304) are used. The choice of appropriate interfaces depends on the specific design of the computing device, which can be, but is not limited to: PCI, AGP, PS/2, IrDa, FireWire, LPT, COM, SATA, IDE, Lightning, USB (2.0, 3.0, 3.1, micro, mini, type C), TRS/Audio jack (2.5, 3.5, 6.35), HDMI, DVI, VGA, Display Port, RJ45, RS232, etc.

[0040] To ensure user interaction with the computing device (300), various means (305) of I/O information are used, for example, a keyboard, a display (monitor), a touch display, a touch pad, a joystick, a mouse, a light pen, a stylus, touch panel, trackball, speakers, microphone, augmented reality tools, optical sensors, tablet, light indicators, projector, camera, biometric identification tools (retina scanner, fingerprint scanner, voice recognition module), etc.

[0041] The network communication facility (306) allows the device (300) to transmit data via an internal or external computer network, such as an Intranet, Internet, LAN, or the like. One or more means (306) may be used, but not limited to: Ethernet card, GSM modem, GPRS modem, LTE modem, 5G modem, satellite communication module, NFC module, Bluetooth and/or BLE module, Wi-Fi module and etc.

[0042] Additionally, satellite navigation tools can also be used as part of the device (300), for example, GPS, GLONASS, BeiDou, Galileo.

[0043] The submitted application materials disclose preferred examples of implementation of a technical solution and should not be interpreted as limiting other, particular examples of its implementation that do not go beyond the scope of the requested legal protection, which are obvious to specialists in the relevant field of technology.

Claims

FORMULA 1. A method for detecting anomalous interaction between nodes of an information computer network (ICS), comprising the steps of: a) receiving data exchanged between the nodes of the ICS, wherein the data contains at least information about the number of messages transmitted between the mentioned nodes; b) form a graph based on the received data, in which the vertices are the identifiers of the IVS nodes, and the edges are the fact of message exchange between nodes, and each edge has a weight characterizing the intensity of message exchange between the corresponding nodes; c) using the resulting graph, determine the values of the shortest paths between all nodes of the IVS; d) form a vector representation for each IVS node based on the obtained values of the shortest paths; e) reducing the dimension of the resulting vector representations; f) perform clustering of IVS nodes based on the vector representations obtained at step e); g) form the first model of interaction of IVS nodes, in which the nodes are defined in groups in accordance with the performed clustering; h) form a second model of interaction between IVS nodes using iterative repetition of stages a) - g); i) perform a comparison of the first and second models of interaction between IVS nodes, during which IVS nodes located in different groups are identified; and j) generate a signal characterizing the identifiers of the IVS nodes demonstrating anomalous interaction during the comparison performed at stage i). 2. The method according to claim 1, in which the weight of the edge is the reciprocal of the number of messages between the IVS nodes per unit of time. 3. The method according to claim 1, wherein step e) is performed using a machine learning algorithm. 4. The method according to claim 1, in which the vector representation of the nodes characterizes the accumulated retrospective information about the interaction of the node. 5. A system for detecting anomalous interaction of IVS nodes, containing at least one processor and at least one memory that stores machine-readable instructions, which, when executed by a processor, implement the method according to any one of claims. 1-4.