RU2781822C1 - System and method for automatic assessment of quality of network traffic signatures - Google Patents

Abstract

FIELD: information security.

SUBSTANCE: system for automatic assessment of the quality of network traffic signatures, including an event collection module, a crucial signature list, an analyzing module, and a final aggregation module, differs in that it includes a preaggregation module, which is made with the possibility of continuous processing of unprocessed data and resource-intensive calculations, wherein the event collection module is connected to the preaggregation module, which is connected to the analyzing module and/or the final aggregation module, wherein the analyzing module is also connected to the final aggregation module, and the crucial signature list is connected to the event collection module and to the final aggregation module.

EFFECT: increase in the accuracy of detection of malicious activity in a network.

20 cl, 10 dwg

Description

Technical field

[0001] The present invention relates to systems and methods for automatically evaluating the quality of network traffic signatures. The invention is a feedback system for filtering network traffic and groups network traffic according to characteristic signatures, followed by an assessment of the proportion of automated and non-automated activity in each group based on a static analysis of network traffic, which makes it possible to detect the presence of malicious activity in network traffic.

State of the art

[0002] Systems for assessing the quality of network traffic signatures and detecting malicious activity in network traffic often consist of several modules contained on the server, such as a data collection module, a database module, a signature identifier module, and a data aggregation module. Such systems are non-automated, because they do not provide modules that can automatically generate additional signatures based on a statistical analysis of the collected network traffic data.

[0003] Automated ones are also known, including not only the above modules or their analogues, but also additional modules responsible for statistical analysis of the collected data, signature generation and signature repositioning. These additional modules make it possible to make the system automated and thus more efficient in detecting automated activity. Such automated systems are also called feedback systems.

[0004] Patent RU2740027C1 (publ. 12/30/2020; IPC: G06F 21/50; G06F 21/60; H04L 29/06) describes an invention related to a method and system for preventing malicious automated attacks. The technical result is to ensure the prevention of malicious attacks. In the method, the user is evaluated based on the received request to the computer system about the session, collecting numerical and statistical metrics of the request, counting the metrics characterizing the user based on the statistics of his communication with the resource, determining the metrics based on the general statistics on the resource, showing the deviation of the user session from the median and the average session, based on these data, an assessment of the legitimacy of the request is obtained using a statistical model, on the basis of which the user is determined to one of the categories of legitimate, suspicious or bot, for a legitimate user, access to the resource is provided, for the bot, access to the resource is blocked, additional checks are performed in relation to a suspicious user, while based on the analysis of his behavior, they offer him a task using cryptographic algorithms using asymmetric encryption, in the absence of a correct solution to the problem, they classify him as a bot and block t access to the resource, in case of a correct decision, it is categorized as a legitimate user and granted access. The first disadvantage of this system is its non-automation. The system and method detect malicious activity based on predefined signatures and do not provide for additional generation of signatures. Also, the system and method lacks a stage at which statistical analysis of network traffic is performed, which makes it possible to more effectively detect malicious automated activity in network traffic. Another disadvantage of the system and method is the lack of pre-aggregation of raw data and the most resource-intensive calculations and, accordingly, the data pre-aggregation module that implements the pre-aggregation of raw data and the most resource-intensive calculations. The present system and method provides for a stage performed by the pre-aggregation module, at which the pre-aggregation of raw data and the most resource-intensive calculations are continuously performed based on a cascade of materialized views, which leads to a decrease in the need for computing power for the final aggregation of data by 2-3 orders of magnitude, depending on the type aggregation.

[0005] Patent RU2538292C1 (publ. 01/27/2015; IPC: G06F 21/55) describes an invention related to computer technology. The technical result consists in detecting computer attacks of different types, combined simultaneous attacks of different types and determining the types of attacks. A method for detecting computer attacks on a network computer system, including at least one computer connected to the network and having an installed operating system and installed application software, including a traffic analysis system, in which certain parameters are selected to analyze packets received from the network and calculated their values, which are then compared with the reference values, and the fact of the presence of a single or combined simultaneous attack and the definition of types of attacks is determined by a combination of the established conditions for the parameters. To process data packets received from the network, a traffic analysis system is used, which allows calculating traffic parameters in real time. The first disadvantage of this method is that the detection of malicious automated activity is carried out according to predefined signatures, respectively, the system is non-automated and detects malicious automated activity less efficiently than automated counterparts, because can detect only a fixed portion of malicious automated activity in network traffic that falls under predefined signatures. The second disadvantage, related to the first disadvantage, is that the method does not provide for the generation of new signatures. And the last disadvantage is the lack of pre-aggregation of raw data and the most resource-intensive calculations and, accordingly, the data pre-aggregation module that implements the pre-aggregation of raw data and the most resource-intensive ones. The present system and method provides for a stage performed by the pre-aggregation module, at which the raw data and the most resource-intensive calculations are continuously pre-aggregated based on a cascade of materialized views, which leads to a decrease in the need for computing power for the final data aggregation by 2-3 orders of magnitude, depending on the type aggregation.

[0006] Patent RU2722693C1 (published on 06/03/2020; IPC: G06F 21/56) proposes a computer-implemented method for detecting the infrastructure of a malicious program or cyber attacker, in which: a request is received containing an infrastructure element and a tag about the belonging of this element to a malicious program or cyber attacker; extracting from the database a parameter of the acquired infrastructure element, an additional infrastructure element used by the same malware as the received infrastructure element, and a parameter of the additional infrastructure element; analyzing the received infrastructure element and its associated parameter and the additional infrastructure element and its associated parameter; based on the analysis, statistical relationships are identified between the parameter of the received infrastructure element and the parameter of the additional infrastructure element; forming rules for searching for new infrastructure elements based on the identified statistical relationship and extracting new infrastructure elements from the database; assign tags to the new elements corresponding to certain malware or cyber-intruders, and store the results in a database. The technical result consists in increasing the efficiency of detecting computer attacks. The disadvantage of the data of the system and method is the lack of pre-aggregation of raw data and the most resource-intensive calculations and, accordingly, the data pre-aggregation module that implements the pre-aggregation of raw data and the most resource-intensive calculations. The present system and method provides for a stage performed by the pre-aggregation module, at which the raw data and the most resource-intensive calculations are continuously pre-aggregated based on a cascade of materialized views, which leads to a decrease in the need for computing power for the final data aggregation by 2-3 orders of magnitude, depending on the type aggregation.

[0007] US7565693B2 (publ. 21.07.2009; IPC: G06F 11/00) describes an invention related to a network intrusion detection and prevention system. The system includes: a signature-based detection device; abnormal behavior detection device; and a new signature generation and verification device disposed between the signature detection device and the abnormal behavior detection device, wherein if the abnormal behavior detection device detects packets suspected of a network attack, the new signature generation and verification device collects and searches, detects suspicious packets for common information, and then creates a new signature based on the found common information, and at the same time checks whether the created new signature is applicable to the signature-based detection device, and then registers the created new signature to the detection device based on signatures if it is determined that the generated new signature is applicable. The disadvantage of the data of the system and method is the stage of detecting automated activity based on the detection of anomalous behavior in traffic, performed by the corresponding module. It allows the intrusion detection and prevention system to pre-identify information about the normal behavior of a normal user and monitor abnormal network operations to search for network intrusions and the like. in the case where anomalous network activity conflicts with normal behavior. generated based on information about normal behavior. However, the detection method based on anomalous behavior has the disadvantage that a normal user is erroneously identified as a network intrusion. In addition, the abnormal behavior detection method has a disadvantage in that because it takes so long to detect a network intrusion, unlike the signature-based detection method, a network intrusion cannot be protected. In the method under study, using statistical analysis, the boundary values of the characteristic share of traffic for each group of signatures are calculated. Each signature group may occur in multiple subnet-service pairs. The method calculates the share of traffic in each such pair for each group, the 25th and 75th percentiles. This data allows you to calculate the expected share of traffic for each group. And then compare the suspicious activity with the statistically found average user activity. This approach makes it possible to more accurately and quickly detect new automated attacks that were previously not caught by the system and method, since there is no link to previous attacks. The second disadvantage of the system and method data is the lack of pre-aggregation of raw data and the most resource-intensive calculations and, accordingly, the data pre-aggregation module that implements the pre-aggregation of raw data and the most resource-intensive calculations. The present system and method provides for a stage performed by the pre-aggregation module, at which the pre-aggregation of raw data and the most resource-intensive calculations are continuously performed based on a cascade of materialized views, which leads to a decrease in the need for computing power for the final aggregation of data by 2-3 orders of magnitude, depending on the type aggregation.

[0008] The closest analogue is patent RU2634209C1 (publ. 10/24/2017; IPC: G06F 21/35), which describes an invention related to the field of detecting computer attacks. The technical result is to increase the efficiency of detecting computer attacks. A method for auto-generation of decision rules for feedback intrusion detection systems, performed on a server, includes at least the following steps: receive at least one event from an event database formed by data received from at least one sensor ; analyzing the received at least one event for belonging to the class of interaction with malware control centers; extracting from at least one of the above events related to the class of interaction with malware control centers, at least one feature used to generate decision rules; generating decision rules using at least one of the above extracted features; storing the generated decision rules and providing an opportunity to obtain an update of the decision rules for at least one sensor; sensors cyclically check the availability of updates on the central node and, if updates are available, receive them for use; in this case, if updates are received on the sensors, a trigger fires that reloads the decision rules. The difference and disadvantage of the data of the system and method is the lack of pre-aggregation of raw data and the most resource-intensive calculations and, accordingly, the data pre-aggregation module that implements the pre-aggregation of raw data and the most resource-intensive calculations. The present system and method provides for a stage performed by the pre-aggregation module, at which the pre-aggregation of raw data and the most resource-intensive calculations are continuously performed based on a cascade of materialized views, which leads to a decrease in the need for computing power for the final aggregation of data by 2-3 orders of magnitude, depending on the type aggregation.

The essence of the invention

[0009] The objective of the present invention is to create and develop a system and method for automatically assessing the quality of network traffic signatures, providing highly efficient detection of automated activity in network traffic and reducing the need for computing power for the final data aggregation.

[0010] This task is achieved due to such a technical result as a high efficiency of detection of automated activity, the possibility of feedback and reducing the need for computing power for the final aggregation of data. The technical result is achieved including, but not limited to, due to:

• use of statistical analysis for system automation;

• using statistical analysis to detect the presence of malicious automated activity on the network;

• the use of statistical analysis for the formation and updating of decisive signatures;

• use of the raw data pre-aggregation pipeline and the most resource-intensive calculations;

• the presence of a stage of final aggregation of data with grouping and assessment of the proportionality of automated and non-automated activity.

[0011] More fully, the technical result is achieved by a system for automatically assessing the quality of network traffic signatures, including an event collection module, a list of decisive signatures, an analyzing module and a final aggregation module, and characterized in that it includes a pre-aggregation module that is configured to continuously process raw data and the most resource-intensive calculations, moreover, the event collection module is connected to the pre-aggregation module, which is connected to the analyzing module and/or the final aggregation module, and the analyzing module is also connected to the final aggregation module, and the list of decision signatures is connected to the event collection module and to the final aggregation module .

[0012] In this case, the event collection module is needed to collect events in network traffic and group them by signatures. The list of decision signatures is needed to store the decision signatures that are used to detect automated activity in network traffic. The analyzing module is required to calculate the characteristic share of automated and non-automated activity in network traffic, as well as the formation of boundary values and decisive signatures using statistical analysis methods. The final aggregation module is required to evaluate the quality of traffic for each group of parameters, for example, source subnet, destination service, TCP/IP signature, SSL/TLS signature, HTTP signature. The data pre-aggregation module is required to form a continuous raw data pre-aggregation pipeline and the most resource-intensive calculations, which significantly increases the system performance and reduces the need for computing power for the final data aggregation.

[0013] Additionally, the event collection module may be configured to collect events in network traffic sent from at least one network-capable computer, computer system, and/or server.

[0014] The event collection module may also further include a grouping module for grouping events by a set of signatures.

[0015] The analysis module may further include a list of boundary values and a boundary value repository module configured to automatically update the list of boundary values based on continuously new data.

[0016] Also, the analysis module may further include an evaluation module that evaluates the presence of statistical outliers. This allows you to more accurately determine the boundary values for all events, taking into account calculation errors.

[0017] The final aggregation module may include a signature repository module configured to update the decision signature list. This provides the ability to more accurately identify automated malicious activity on the network, as there is a statistical evaluation of unknown and formally legitimate signatures, solving on the basis of constantly updated data.

[0018] Also, the claimed technical result is achieved by a method for automatically assessing the quality of network traffic signatures, implemented programmatically and cyclically on the server, which collects events in network traffic using the event collection module, pre-aggregates raw data and the most resource-intensive calculations using the pre-aggregation module, calculates , based on the collected events, the boundary values of the characteristic share of automated and non-automated activity in network traffic for each of the events using the analyzing module and perform the final aggregation of all events collected in network traffic using the final aggregation module.

[0019] At the same time, the stage at which network traffic events are collected is necessary to form a database of network traffic events, among which they will check for automated malicious activity. The stage at which the raw data and the most resource-intensive calculations are pre-aggregated is necessary to increase the speed of the method, as well as reduce the need for computing power for the final data aggregation stage. The stage at which the boundary values of the characteristic share of automated and non-automated activity in network traffic are calculated is necessary to form the boundary values and determine the share of malicious automated activity in network traffic using statistical analysis methods. The stage at which the final aggregation of all events is performed is necessary for the formation of decisive signatures.

[0020] Additionally, after the step at which events are collected in network traffic, a step may be performed at which events are grouped by signatures. This makes it easier to compare signatures with a list of decision signatures and generate new decision signatures.

[0021] Additionally, after the step of calculating, on the basis of the collected events, the threshold values of the characteristic proportion of automated and manual activity in network traffic, you can automatically update the list of threshold values for each of the events using the boundary value repository module. This makes the system more efficient in detecting and identifying malicious automated activity.

[0022] Additionally, after the step of calculating, based on the collected events, the threshold values of the characteristic proportion of automated and manual activity in network traffic, can evaluate the presence of statistical outliers for each of the events using the estimation module. This makes it possible to more accurately determine the boundary values for each of the events, taking into account the calculation errors.

[0023] At the stage at which raw data is pre-aggregated using the pre-aggregation module, raw data can be additionally recorded and resource-intensive calculations can be performed with the recorded raw data, which increases the speed of the method, and also reduces the need for computing power for the final data aggregation stage.

[0024] At the stage at which the raw data is pre-aggregated, after the stage at which resource-intensive calculations are performed with the recorded raw data, it can additionally be performed using the pre-aggregation module at least sending the pre-processed data to the analyzing module and / or sending the pre-processed data to the final module aggregation, which increases the speed of the method, and also reduces the need for computing power for the stage of the final data aggregation and the stage of statistical analysis.

[0025] Additionally, at the stage at which the final aggregation of all events is performed, the calculated boundary values of the characteristic share of automated and non-automated activity in network traffic can be compared. This allows you to assess the presence of potential malicious activity in network traffic.

[0026] Additionally, at the stage at which the final aggregation of all events is performed, the calculated boundary values of the characteristic share of automated and non-automated activity in network traffic can be compared with the boundary values of the characteristic share of automated and non-automated activity in network traffic calculated for at least one previous cycle. This allows you to compare the new received data with the data obtained in previous cycles, which, in turn,

provides more accurate information about the presence or absence of malicious activity in network traffic.

[0027] Additionally, at the stage at which the final aggregation of all events is performed, an assessment can be made, based on the calculated boundary values of the characteristic share of automated and non-automated activity in network traffic, the ratio of automated and non-automated activity in network traffic. The assessment allows you to understand what is the share of automated activity in network traffic and check if it is out of the norm, which also allows you to track the presence or absence of malicious activity in network traffic.

[0028] Additionally, at the stage at which the final aggregation of all events is performed, the formation of decisive signatures can be performed. This allows you to identify the detected malicious network activity.

[0029] Additionally, at the stage at which the final aggregation of all events is performed, the generated decisive signatures can be saved to the list of decisive signatures, which allows you to remember the found malicious network activity.

[0030] Additionally, at the stage at which the final aggregation of all events is performed, the decision signature list can be updated with the generated decision signatures using the signature repository module included in the final aggregation module. This allows you to automatically delete and save newly generated decisive signatures, which will later be useful for detecting malicious network activity.

[0031] Also, the final aggregation process can be carried out step by step as follows. First, they can compare the calculated boundary values of the characteristic share of automated and manual activity in network traffic, then compare the calculated boundary values of the characteristic share of automated and manual activity in network traffic with the boundary values of the characteristic share of automated and manual activity in network traffic, calculated on at least one previous cycle. After that, an assessment can be made, based on the calculated boundary values of the characteristic share of automated and non-automated activity in network traffic, the ratio of automated and non-automated activity in network traffic. Based on this evaluation, I can generate decision signatures, store decision signatures in the decision signature list, and/or update the decision signature list with generated decision signatures using the signature repository module.

[0032] In addition, any of the above steps can be performed separately for each of the generated groups of events by signatures for the convenience of comparing signatures with a list of decisive signatures and generating new decisive signatures.

Description of drawings

[0033] The subject matter of the present application is described point by point and clearly stated in the claims. The objects, features and advantages of the invention mentioned above are apparent from the following detailed description, in conjunction with the accompanying drawings, which show:

[0034] In FIG. 1A is a schematic view of a system for automatically evaluating the quality of network traffic signatures.

[0035] In FIG. 1B shows a schematic view of a system for automatic evaluation of the quality of network traffic signatures with additional elements.

[0036] In FIG. 2A is a block diagram describing one embodiment of a method for automatically evaluating the quality of network traffic signatures.

[0037] In FIG. 2B is a block diagram describing one of the options for implementing a method for automatically assessing the quality of network traffic signatures with an additional step of grouping events.

[0038] In FIG. 2B is a flowchart describing one embodiment of a method for automatically evaluating the quality of network traffic signatures with an additional step of automatically updating the list of boundary values.

[0039] In FIG. 2D shows a block diagram describing one of the options for implementing a method for automatically assessing the quality of network traffic signatures with an additional step of assessing the presence of statistical outliers.

[0040] In FIG. 2D shows a block diagram describing one of the options for implementing a method for automatically assessing the quality of network traffic signatures with a variant of the raw data pre-aggregation process.

[0041] In FIG. 2E is a flowchart describing one implementation of a method for automatically evaluating the quality of network traffic signatures with an additional data processing sequencing option.

[0042] In FIG. 2Ё shows a block diagram describing one of the options for implementing the method for automatically assessing the quality of network traffic signatures with options for implementing the final aggregation process.

[0043] In FIG. 2G is a flowchart describing one implementation of a method for automatically evaluating the quality of network traffic signatures, combining all of the above options.

Detailed description

[0044] In the following detailed description of the invention, numerous implementation details are provided to provide a clear understanding of the present invention. However, it will be obvious to one skilled in the art how the present invention can be used, both with and without these implementation details. In other cases, well-known methods, procedures and components are not described in detail so as not to obscure the features of the present invention.

[0045] In addition, from the foregoing it is clear that the invention is not limited to the above implementation. Numerous possible modifications, alterations, variations, and substitutions that retain the spirit and form of the present invention will be apparent to those skilled in the art.

[0046] In FIG. 1A is a schematic view of an automatic network traffic quality assessment system. The system for automatic quality assessment of network traffic signatures includes an event collection module 100, a pre-aggregation module 200, an analysis module 300, a final aggregation module 400, and a decision signature list 500. The event collection module 100 is connected to the pre-aggregation module 200, which, in turn, is connected to the analysis module 300 and/or the final aggregation module 400. The analysis module 300 is also connected to the final aggregation module 400, and the final aggregation module 400 is connected to the decision signature list 500. The decision signature list is connected to the event collection module 100. In this case, the data pre-aggregation module 200 is designed to continuously process raw data and the most resource intensive calculations.

[0047] The system operates as follows. Events are collected using the event collection module 100. Next, the collected events are sent to the pre-aggregation module 200 to perform the raw data pre-aggregation process and the most resource-intensive calculations. After that, the preprocessed data is sent to the analyzing module 300 and/or to the final aggregation module 400. If the preprocessed data was sent to the analyzing module 300, in the analyzing module 300, the boundary values of the characteristic share of automated and non-automated activity in the network are calculated with them. traffic. And then, the pre-processed resource-intensive data, together with the calculated boundary values, is sent to the final aggregation module 400, which, in turn, performs the final data aggregation process with them. If the pre-aggregation module 200 sent the preprocessed data immediately to the final aggregation module 400, then the final aggregation process is carried out with them without preliminary calculation of the boundary values of the characteristic share of automated and non-automated activity in network traffic. After the pre-processed data goes through the final aggregation process, decision signatures are generated and stored in the decision signature list 500, which is further used in the event collection process by the event collection module 100.

[0048] The system for automatically evaluating the quality of network traffic signatures may also include additional submodules, hereinafter referred to as modules, shown in FIG. 1B.

[0049] The event collection module 100 of the system for automatically evaluating the quality of network traffic signatures can additionally be connected to the remote device 600 and be configured to collect events in network traffic from at least the remote device 600. The remote device 600 can be a computer, computer system and/or server configured to connect to a network

[0050] Also, the event collection module 100 may further include a grouping module 101 for grouping collected events by signature.

[0051] The parsing module 300 may further include a threshold value list 301 and a threshold value repository module 302. The threshold list is for storing threshold values calculated by the parsing module 300 of a characteristic proportion of automated and non-automated activity in network traffic. The threshold repository module 302 is designed to update the list of thresholds 301 in case new thresholds have been calculated by the parsing module 300 for a characteristic proportion of automated and unauthorized activity in network traffic.

[0052] Also, the analysis module 300 may further include an evaluation module 303 for evaluating the presence of statistical outliers.

[0053] The final aggregation module 400 may further include a signature repository module 401 configured to update the decision signature list 500 in case new decision signatures were generated in the final aggregation step.

[0054] The above-described additional modules and lists, included in any of the main modules and lists, can be integrated into the system as a whole or separately, depending on the needs of the system. One of the images of the system operation will be described below, which includes each of the above additional modules and lists, however, it is obvious that some of the points described below can be replaced and / or excluded from the system without significant losses for the technical result.

[0055] A system for automatically evaluating the quality of network traffic signatures, according to the diagram in FIG. 1B works as follows. Using the event collection module 100, events are collected in network traffic from the remote device 600. The collected events are grouped by signatures using the grouping module 101 included in the event collection module 100. The events grouped by signatures are sent to the pre-aggregation module 200, where the raw data pre-aggregation process takes place and the most resource-intensive calculations by groups of signatures. After that, the preprocessed data is sent to the analyzing module 300 and/or to the final aggregation module 400. If the preprocessed data was sent to the analyzing module 300, in the analyzing module 300, the boundary values of the characteristic share of automated and non-automated activity in the network are calculated with them. traffic. If the limit values have been calculated for the first time, the calculated limit values are stored in the limit value list 301. And if new limit values have been calculated that are different from those already stored in the limit value list 301, then the limit value list is updated. 301 with new breakpoints using the breakpoint repository module 302. Statistical outliers are also estimated using the estimator 303 included in the parsing module 300. And then, the preprocessed data, together with the calculated breakpoints, is sent to the final aggregation module 400, which in turn turn, performs the process of final data aggregation with them. If the pre-aggregation module 200 sent the preprocessed data immediately to the final aggregation module 400, then the final aggregation process is carried out with them without preliminary calculation of the boundary values of the characteristic share of automated and non-automated activity in network traffic. After the pre-processed data goes through the final aggregation process, the decision signatures are generated and stored in the decision signature list 500, which is further used in the event collection process by the event collection module 100. In the event that the decision signature list 500 has already stored previously generated decision signatures update the decision signature list 500 with the decision signature repository module 401 included in the final aggregation module 400.

[0056] In FIG. 2A is a flowchart illustrating a method for automatically evaluating the quality of network traffic signatures. According to the proposed method, first, events are collected in network traffic using the event collection module 100. Then, with the collected events, the raw data is pre-aggregated using the pre-aggregation module 200. After that, the boundary values of the characteristic share of automated and non-automated activity in network traffic are calculated, based on collected events, using the analyzing module 300. Then, the final aggregation of all events collected in the network traffic is performed using the final aggregation module 400. The above sequence is performed programmatically and cyclically.

[0057] In FIG. 2B is a flowchart illustrating a method for automatically evaluating the quality of network traffic signatures, with an additional step in which, after the step in which events in network traffic are collected using the event collection module 100, events are grouped by signatures using the grouping module 101 included in event collection module 100.

[0058] In FIG. 2B is a flowchart illustrating a method for automatically evaluating the quality of network traffic signatures, with an additional step in which, after the step in which, based on the collected events, the boundary values of the characteristic proportion of automated and manual activity in network traffic are calculated, the list of boundary values is automatically updated. values 301 using the boundary value repository module 302.

[0059] In FIG. 2D is a flowchart illustrating a method for automatically estimating the quality of network traffic signatures, with an additional step in which, after the step in which, based on the collected events, the boundary values of the characteristic share of automated and manual activity in network traffic are estimated, the presence of statistical outliers is estimated using evaluation module 303 included in the analysis module 300.

[0060] The step in which the data is pre-aggregated can be implemented in many ways, but the preferred one is the one depicted in FIG. 2D. Here is a flowchart illustrating a method for automatically evaluating the quality of network traffic signatures, with a possible implementation of a step that pre-aggregates the raw data, writes the raw data collected from events, and then performs resource-intensive calculations with the recorded raw data collected from events. This step can also be performed without recording raw data. Raw data before performing resource-intensive calculations with them can be stored on a remote computer, the network traffic of which is being monitored at that time, can be stored in temporary memory, in a third-party database, etc., i.e. in any place where the pre-aggregation module can perform resource-intensive calculations with them.

[0061] In FIG. 2E is a flowchart illustrating a method for automatically evaluating the quality of network traffic signatures, with the additional step of sending the preprocessed data to the parsing module 300 or to the module final aggregation 400.

[0062] In FIG. 2E shows a block diagram illustrating a method for automatically assessing the quality of network traffic signatures, with possible implementation options for the stage at which the final data aggregation is performed. According to the first option, at the final aggregation stage, the calculated boundary values of the characteristic share of automated and non-automated activity in network traffic are compared using the final aggregation module 400. traffic with boundary values of the characteristic share of automated and non-automated activity in network traffic calculated for at least one previous cycle. According to the third implementation option, at the stage of final aggregation, based on the calculated boundary values of the characteristic share of automated and non-automated activity in network traffic, the ratio of automated and non-automated activity in network traffic is estimated. According to the fourth embodiment, at the final aggregation step, decision signatures are generated, the generated decision signatures are stored in the decision signature list 500, or the decision signature list 500 is updated with the generated decision signatures using the signature repository module 401. The above-described implementations of the final aggregation step can be performed either separately or and in any combination.

[0063] In FIG. 2G is a flowchart illustrating a method for automatically evaluating the quality of network traffic signatures, integrating all of the above steps, both basic and optional.

[0064] Also, each of the steps of the method for automatically estimating the quality of network traffic signatures following the step of grouping the collected events by signatures using the grouping module 101 included in the event collecting module 100 can be performed separately for each of the signature groups.

[0065] In the materials of the present application for the disclosure of the invention, terms such as: “assessment of the quality of network traffic signatures”, implying an assessment of the shares of automated and non-automated activity in network traffic,

[0066] "automated activity", meaning traffic created by "non-human means", that is, using an automated script, software or algorithm,

[0067] "Manual activity", meaning an activity performed by a user, i.e. man,

[0068] "characteristic shares", meaning "normal" traffic shares that are not caused by malicious or prohibited bot activity,

[0069] "boundary values", meaning the limits of the range of the proportion of automated activity that will not be perceived as malicious activity, and

[0070] "statistical outliers", meaning the result of the collection of events that stands out from the total sample.

[0071] The present application materials provide a preferred disclosure of the implementation of the claimed technical solution, which should not be used as limiting other, private embodiments of its implementation that do not go beyond the requested scope of legal protection and are obvious to specialists in the relevant field of technology.

Claims (33)

1. A system for automatically assessing the quality of network traffic signatures, including an event collection module, a list of decisive signatures, an analyzing module and a final aggregation module, characterized in that it includes a pre-aggregation module, which is configured to continuously process raw data and resource-intensive calculations, moreover, the event collection module connected to the pre-aggregation module, which is connected to the analyzing module and/or the final aggregation module, the analyzing module is also connected to the final aggregation module, and the decision signature list is connected to the event collection module and to the final aggregation module. 2. The system for automatically assessing the quality of network traffic signatures according to claim 1, characterized in that the event collection module is configured to collect events in network traffic from at least one computer, computer system and/or server configured to connect to the network. 3. The system for automatic assessment of the quality of network traffic signatures according to paragraphs. 1 and 2, characterized in that the event collection module includes a grouping module. 4. The system for automatic assessment of the quality of network traffic signatures according to claim 1, characterized in that the analyzing module includes a list of boundary values and a repository module of boundary values, which is configured to update the list of boundary values. 5. The system for automatic evaluation of the quality of network traffic signatures according to claim 1, characterized in that the analyzing module includes an evaluation module, which is configured to evaluate the presence of statistical outliers. 6. The system for automatic quality assessment of network traffic signatures according to claim 1, characterized in that the final aggregation module includes a signature repository module configured to update the list of decisive signatures. 7. A method for automatically assessing the quality of network traffic signatures, according to which cyclically: - collect events in network traffic using the event collection module; - perform pre-aggregation of raw data using the pre-aggregation module; - calculate, on the basis of the collected events, the boundary values of the characteristic share of automated and non-automated activity in network traffic using the analyzing module; - perform the final aggregation of all events collected in the network traffic using the final aggregation module. 8. The method for automatically assessing the quality of network traffic signatures according to claim 7, characterized in that after the stage at which events in network traffic are collected using the event collection module, events are grouped by signatures using the grouping module included in the event collection module. 9. A method for automatically assessing the quality of network traffic signatures according to paragraphs. 7 and 8, characterized in that after the stage at which, based on the collected events, the boundary values of the characteristic share of automated and non-automated activity in network traffic are calculated, the list of boundary values is automatically updated using the boundary values repository module. 10. A method for automatically assessing the quality of network traffic signatures according to paragraphs. 7 and 8, characterized in that after the stage at which, based on the collected events, the boundary values of the characteristic share of automated and non-automated activity in network traffic are calculated, the presence of statistical outliers is estimated using the evaluation module. 11. The method for automatically assessing the quality of network traffic signatures according to claim 7, characterized in that the stage at which raw data is pre-aggregated using the pre-aggregation module is carried out as follows: - record raw resource-intensive data collected from events; - perform resource-intensive calculations with recorded raw data collected from events. 12. A method for automatically assessing the quality of network traffic signatures according to paragraphs. 7 and 10, characterized in that at the stage at which the raw data is pre-aggregated, after the stage at which resource-intensive calculations are performed with the recorded raw data, at least one of the following is performed using the pre-aggregation module: - send the preprocessed data to the analyzing module; - send the preprocessed data to the final aggregation module. 13. A method for automatically assessing the quality of network traffic signatures according to claim 7, characterized in that the final aggregation of all events using the final aggregation module is carried out by comparing the calculated boundary values of the characteristic share of automated and non-automated activity in network traffic. 14. A method for automatically assessing the quality of network traffic signatures according to claim 7, characterized in that the final aggregation of all events using the final aggregation module is carried out by comparing the calculated boundary values of the characteristic share of automated and non-automated activity in network traffic with the boundary values of the characteristic share of automated and non-automated activity in network traffic calculated for at least one previous cycle. 15. A method for automatically assessing the quality of network traffic signatures according to claim 7, characterized in that the final aggregation of all events using the final aggregation module is carried out by evaluating, based on the calculated boundary values of the characteristic share of automated and non-automated activity in network traffic, the ratio of automated and non-automated activity in network traffic. 16. A method for automatically assessing the quality of network traffic signatures according to paragraphs. 14 and 15, characterized in that the final aggregation of all events using the final aggregation module, the decisive signatures are formed based on the evaluation. 17. The method for automatically assessing the quality of network traffic signatures according to claim 16, characterized in that for the final aggregation of all events, the final aggregation module saves the generated decisive signatures to the list of decisive signatures. 18. A method for automatically assessing the quality of network traffic signatures according to paragraphs. 16 and 17, characterized in that for the final aggregation of all events using the final aggregation module, the list of decisive signatures is updated with the generated decisive signatures using the signature repository module included in the final aggregation module. 19. The method for automatically assessing the quality of network traffic signatures according to claim 7, characterized in that the final aggregation of all events using the final aggregation module is carried out as follows: - compare the calculated boundary values of the characteristic share of automated and non-automated activity in network traffic with the boundary values of the characteristic share of automated and non-automated activity in network traffic calculated for at least one previous cycle; - evaluate, based on the calculated boundary values of the characteristic share of automated and non-automated activity in network traffic, the ratio of automated and non-automated activity in network traffic; - form, on the basis of the evaluation, the decisive signatures; - save generated decisive signatures in the list of decisive signatures; - updating the list of decision signatures with the generated decision signatures using the signature repository module included in the final aggregation module. 20. A method for automatically assessing the quality of network traffic signatures according to any one of paragraphs. 7-19, characterized in that each of the stages is performed separately for each of the event groups formed using the grouping module, according to signatures.

Images