3D File Event Representation for Network Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional network file system anomaly detection techniques fail to detect complex attacks as they only analyze individual file events without considering the larger context, making it difficult to identify anomalies that may be disguised as legitimate operations.
Innovation Solution
A three-dimensional file event representation is generated, incorporating dimensions for location, event type, and time, which is then processed using a convolutional neural network (CNN) to identify patterns and detect anomalies, allowing for real-time anomaly detection and remediation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional systems logs are used to track file events, then individual file access can be recorded, but comprehensive anomaly detection is insufficient
Solution Approach 1:
The patent transforms traditional two-dimensional file event tracking (file path and event type) into a three-dimensional representation by adding the time dimension. This creates a spatiotemporal cube where file paths form the x-axis, event types form the y-axis, and time intervals form the z-axis. This dimensional expansion enables comprehensive anomaly detection by capturing the temporal sequences and patterns of file operations that traditional logging cannot detect, while maintaining manageable complexity through structured data organization.
2Loss of information
If hundreds or thousands of file operations are tracked individually, then detailed event data is collected, but contextual analysis becomes difficult
Solution Approach 1:
The patent merges numerous individual file operation records into a unified three-dimensional spatiotemporal representation. By combining file path information, event type classifications, and temporal sequencing into a single structured cube, the system preserves all contextual information while enabling efficient pattern recognition. This consolidation allows anomaly detection algorithms to analyze relationships between multiple file operations in context, rather than treating each event in isolation.
Solution Approach 2:
The three-dimensional spatiotemporal cube serves as an intermediary data structure between raw file operation logs and anomaly detection algorithms. This intermediate representation transforms unstructured or semi-structured log data into a standardized format that captures temporal sequences and spatial relationships, making it easier for detection systems to identify anomalous patterns without losing contextual information from the original events.
3Productivity
If real-time anomaly detection is implemented, then rapid threat response is achieved, but computational processing requirements increase
Solution Approach 1:
The patent segments the file monitoring system into distinct functional components: event collection, three-dimensional cube construction, pattern matching, and anomaly detection. This segmentation allows each component to operate independently and efficiently, processing data in discrete time intervals rather than continuously. By dividing the computational workload into manageable segments that operate on structured data, the system achieves real-time detection capability while reducing overall computational energy requirements compared to analyzing raw log data continuously.
Data Source
AI summary
Systems and techniques for three-dimensional file event representation are described herein. File event data may be obtained for a file for a time segment. The file event data may include a file system hierarchy for the file. A spatial file operation map may be generated for the file system hierarchy including a file operation map for the file for the time segment. The file operation map for the file may include a plurality of layers with each layer of the plurality of layers representing a file operation class available for the file. It may be determined that a file operation was performed on the file during the time segment based on the file event data. An indication may be generated on a layer of the plurality layers of the file operation map that the file operation was performed. The layer corresponds to a file operation class of the file operation.