Systems and methods for detecting anomalies in internet traffic using benford's …

Description (excerpt)

CROSS REFERENCE TO RELATED APPLICATIONS This patent application claims the benefit of U.S. Prov. Ser. No. 63/647,267 filed May 14, 2024, which is hereby incorporated by reference in its entirety. RIGHTS OF THE GOVERNMENT The technology described herein may be manufactured and used by or for the Government of the United States for all governmental purposes without the payment of any royalty. FIELD OF THE TECHNOLOGY The present technology relates generally to systems and methods for detecting anomalies in internet traffic and, more particularly, to systems and methods for detecting anomalies in internet traffic using Benford's Law and Poisson Processes. BACKGROUND OF THE TECHNOLOGY Internet traffic analysis is crucial for detecting and mitigating security threats in modern networks. Anomaly detection techniques play an increasingly critical role as cyber threats evolve. As cyberattacks become more sophisticated, early warning signs of an attack, such as code execution, persistence stealth, command control, and lateral movement within a network, are essential for defenders to identify. Contextual and behavioral analysis, delivered in real-time through machine learning and artificial intelligence, effectively detect and prevent attacks that conventional “defense-in-depth” technologies struggle to address. A key challenge for defenders is to reduce the complexity of packet analysis. Reducing the complexity is vital as “breakout time” represents the speed with which an adversary can accomplish lateral movements in a victim's environment after an initial compromise. Rapid detection and response are crucial to containing or remediating an intrusion before it spreads widely, thereby minimizing the impact and escalation of the attack. A previously-proposed rule, namely, the “1-10-60 rule,” establishes specific timeframes for detecting, investigating, and eradicating intrusions to combat sophisticated cyber threats effectively. The rule recommends that detection should be conducted under one minute, investigation in 10 minutes, and eradication within 60 minutes. Although detecting intrusions in under a minute poses significant challenges, leveraging Benford's Law can significantly shorten the average time-to-detect, time-to-investigate, and time-to-remediate metrics, moving closer to this benchmark. The systems and methods described herein may enable the achievement of one or more aspects of the “1-10-60 rule,” and may enable detecting intrusions as rapidly as possible. SUMMARY OF THE TECHNOLOGY The present technology overcomes the foregoing problems and other shortcomings, drawbacks, and challenges of identifying malicious network traffic. While the technology will be described in connection with certain embodiments, it will be understood that the technology is not limited to these embodiments. To the contrary, this technology includes all alternatives, modifications, and equivalents as may be included within the spirit and scope of the present technology. According to one embodiment of the present disclosure, a method of determining anomalous Internet traffic using Benford's Law includes: defining a time window across which to apply a Poisson distribution; modeling expected Internet traffic including, at least, an average rate of requests per unit time, using the Poisson distribution based on historical traffic data for one or more multiples of the time window; recording data related to real time Internet traffic for, at least, one multiple of the time window; analyzing the data related to the real time Internet traffic to include extracting lead digits from one or more parameters of the data related to real time Internet traffic including: calculating a frequency distribution of the extracted lead digits; comparing the calculated frequency distribution of the extracted lead digits to a Benford's Curve distribution; comparing the calculated frequency distribution of the extracted lead digits to the modeled expected Internet traffic; and identifying deviations of the compared frequency distribution to the Benford's Curve and the modeled expected Internet traffic. According to another embodiment of the present disclosure, a method of differentiating benign and malicious internet traffic using Benford's Law and Poisson process includes: defining a time window across which to apply a Poisson distribution; modeling expected Internet traffic including, at least, an average rate of requests per unit time, using the Poisson distribution based on historical traffic data for one or more multiples of the time window; recording data related to real time Internet traffic for, at least, one multiple of the time window;