Heterogeneous sensors for network defense

Abstract

Heterogeneous sensors simultaneously inspect network traffic for attacks. A signature-based sensor detects known attacks but has a blind spot, and a machine-learning based sensor that has been trained to detect attacks in the blind spot detects attacks that fail to conform to normal network traffic. False positive rates of the machine-learning based sensor are reduced by iterative testing using statistical techniques.

What is claimed is: 
     
         1 . A system, comprising:
 a network of computers;   a signature-based sensor and a machine-learning based sensor deployed in said network to simultaneously inspect network traffic for malicious data;   wherein said machine-learning based sensor recognizes as malicious data any network traffic that fails to conform to models of normal network traffic that have been iteratively tested to reduce false positives; and   wherein said signature-based sensor recognizes as malicious data any network traffic that matches signatures provided to said signature-based sensor.