System and method for detecting network activity of interest

Abstract

A network activity detection system is trained to detect network activities of interest such as threats by malicious computer data. The training involves distilling the characteristics of known network activities of interest (e.g., intrusion by computer viruses, exploits, worms, or the like) into a minimal set of meta-expressions. At run-time, the network activity detection system combines the minimal set of meta-expressions with efficient computer algorithms for evaluating meta-expressions to detect known network activities of interest, as well as their unknown variants, among an unknown set of network activity. The network activity detection system may produce appropriate responses upon the detection of network activities of interest.

What is claimed is: 
     
         1 . A device, comprising:
 a port adapted to obtain a plurality of first data sets from one or more computing devices, wherein the plurality of first data sets correspond to an activity of interest;   a processor connected to the port, wherein the processor is adapted to:
 create a plurality of second data sets from the plurality of first data sets, wherein the plurality of second data sets includes:
 a first set, and 
 a second set different from the first set; 
 
 create a first sequence based on content of at least a portion of the first set; 
 create a second sequence based on content of at least a portion of the second set; 
 determine a similarity metric between the first set and the second set; 
 create a third sequence based on the similarity metric, wherein the third sequence corresponds to the activity of interest; and 
   a memory connected to the processor, wherein the memory is adapted to store the third sequence, wherein the third sequence is configured to be used to detect the presence of the activity of interest.   
     
     
         2 . The device of  claim 1 , wherein a data set in the plurality of first data sets includes data corresponding to activity of a computing device of the one or more computing devices. 
     
     
         3 . The device of  claim 2 , wherein the data set is a network packet. 
     
     
         4 . The device of  claim 1 , wherein the first set includes a combination of two or more data sets from the plurality of first data sets. 
     
     
         5 . The device of  claim 1 , wherein creating the first sequence includes converting content of at least a portion of the first set using a bit-wise operation. 
     
     
         6 . A method, comprising:
 obtaining a plurality of first data sets from one or more computing devices, wherein the plurality of first data sets correspond to an activity of interest;   creating a plurality of second data sets from the plurality of first data sets, wherein the plurality of second data sets includes:
 a first set, and 
 a second set different from the first set; 
   creating a first sequence based on content of at least a portion of the first set;   creating a second sequence based on content of at least a portion of the second set;   determining a similarity metric between the first set and the second set;   creating a third sequence based on the similarity metric, wherein the third sequence corresponds to the activity of interest; and   storing the third sequence, wherein the third sequence is configured to be used to detect the presence of the activity of interest.   
     
     
         7 . The method of  claim 6 , wherein a data set in the plurality of first data sets includes data corresponding to activity of a computing device of the one or more computing devices. 
     
     
         8 . The method of  claim 7 , wherein the data set is a network packet. 
     
     
         9 . The method of  claim 6 , wherein the first set includes a combination of two or more data sets from the plurality of first data sets. 
     
     
         10 . The method of  claim 6 , wherein creating the first sequence includes converting content of at least a portion of the first set using a bit-wise operation. 
     
     
         11 . The method of  claim 6 , the obtaining, the creating the plurality of second data sets, the creating the first sequence, the creating the second sequence, the determining, and the creating the third sequence is performed by a single computing device. 
     
     
         12 . The method of  claim 6 , wherein the storing is performed by the single computing device. 
     
     
         13 . A non-transitory computer-readable storage medium having computer-executable instructions for detecting a network activity of interest, computer-executable instructions comprising instructions for:
 obtaining a plurality of first data sets from one or more computing devices, wherein the plurality of first data sets correspond to an activity of interest;   creating a plurality of second data sets from the plurality of first data sets, wherein the plurality of second data sets includes:
 a first set, and 
 a second set different from the first set; 
   creating a first sequence based on content of at least a portion of the first set;   creating a second sequence based on content of at least a portion of the second set;   determining a similarity metric between the first set and the second set;   creating a third sequence based on the similarity metric, wherein the third sequence corresponds to the activity of interest; and   storing the third sequence, wherein the third sequence is configured to be used to detect the presence of the activity of interest.   
     
     
         14 . The non-transitory computer-readable storage medium of  claim 13 , wherein a data set in the plurality of first data sets includes data corresponding to activity of a computing device of the one or more computing devices. 
     
     
         15 . The non-transitory computer-readable storage medium of  claim 14 , wherein the data set is a network packet. 
     
     
         16 . The non-transitory computer-readable storage medium of  claim 13 , wherein the first set includes a combination of two or more data sets from the plurality of first data sets. 
     
     
         17 . The non-transitory computer-readable storage medium of  claim 13 , wherein creating the first sequence includes converting content of at least a portion of the first set using a bit-wise operation. 
     
     
         18 . The non-transitory computer-readable storage medium of  claim 13 , the obtaining, the creating the plurality of second data sets, the creating the first sequence, the creating the second sequence, the determining, and the creating the third sequence is performed by a single computing device. 
     
     
         19 . The non-transitory computer-readable storage medium of  claim 18 , wherein the storing is performed by the single computing device.