RISK IDENTIFICATION FOR UNLABELED THREATS IN NETWORK TRAFFIC

摘要

A processing system including at least one processor may obtain network traffic data of a network, including a first set of flow data associated with a first node, determine an anomaly factor of the first node from the network traffic data quantifying a deviation of the first set of flow data from a normal flow data associated with the first node, generate an exposure score of the first node in accordance with a measured influence of the first node in the network and the anomaly factor, generate a persistence score of the first node in accordance with a reputation measure of the first node and a measure of a recurrence of anomalous flow data associated with the first node, calculate a threat level of the first node from the exposure score and the persistence score, and reconfigure at least one aspect of the network in response to the threat level.