Abnormal Communication Detection Using FQDN Verification

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional network state analysis techniques struggle to accurately distinguish abnormal communication, leading to excessive detection of normal communication as abnormal, inefficient resource utilization, and increased risk of omission or delay in identifying true abnormal communication, particularly in environments using Content Delivery Networks (CDNs) where IP addresses frequently change.

Innovation Solution

An information processing device that includes an acquisition unit to gather communication data, a judgment unit to compare this data against stored normal communication information, and a notification unit to output relevant information when a match is found, thereby distinguishing abnormal communication with high accuracy.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If conventional network state analysis technique is used to distinguish abnormal communication, then abnormal communication can be detected, but excessive detection of normal communication occurs leading to low accuracy

Engineering Contradiction:

Improveaccuracy of abnormal communication detectionVSAvoidfalse positive rate

Core Design Contradiction:

Measurement precisionVSReliability

Solution Approach 1:

The patent segments the detection process into multiple stages: first detecting potential abnormal communication based on IP address changes, then verifying whether the communication target (FQDN) actually changed. This segmentation allows the system to filter out false positives by checking both IP address and FQDN changes together, thereby improving detection accuracy while reducing false alarms.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces FQDN (Fully Qualified Domain_name) as an intermediary verification mechanism. When an IP address change is detected, the system uses FQDN resolution as an intermediary step to verify whether the communication target actually changed. This intermediary check prevents false detection of normal CDN-based IP changes as abnormal communication.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If conventional technique detects all communication different from usual as abnormal, then abnormal communication can be identified, but excessive resources are required to distinguish truly abnormal communication

Engineering Contradiction:

Improveabnormal communication identificationVSAvoidresource consumption

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The patent performs preliminary verification by checking FQDN changes before finalizing abnormal communication detection. This preliminary action filters out false positives early in the process, reducing the number of communications that require extensive resource allocation for further analysis, thereby optimizing resource usage while maintaining reliable abnormal communication identification.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent applies partial verification by only performing FQDN checks on communications that initially appear abnormal based on IP address changes. Rather than verifying all communications or using excessive verification methods for all cases, the system selectively applies additional verification only where needed, optimizing resource allocation while maintaining detection reliability.

Inventive Principle:

Principle #16Partial or excessive action

3Productivity

If conventional technique relies on IP address matching, then communication can be monitored, but IP address changes in CDN environments cause false detection

Engineering Contradiction:

Improvecommunication monitoring efficiencyVSAvoidfalse detection rate

Core Design Contradiction:

ProductivityVSMeasurement precision

Solution Approach 1:

The patent changes the detection parameters from relying solely on IP address matching to a dual-parameter approach that considers both IP address changes and FQDN changes. This parameter change allows the system to maintain efficient communication monitoring while reducing false detection rates in CDN environments where IP addresses frequently change but FQDNs remain stable.

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentEP4651446A1Information processing device, information processing method, and information processing program

Publication Date: 2025.11.19 NT T INC

Figure 1
Figure 2
Figure 3

AI summary

An information processing device (100) includes an acquisition unit (121) configured to acquire information related to abnormal communication from an external device, a judgement unit (122) configured to judge whether the information related to the abnormal communication acquired by the acquisition unit (121) corresponds to information related to normal communication stored in a storage unit (130), and a notification unit (124) configured to output and notify the information related to the abnormal communication acquired by the acquisition unit (121) and the information related to the normal communication stored in the storage unit (130) when the judgement unit (122) judges to correspond.