Abnormality Detection Device Dynamic Time Range Prediction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network-based intrusion detection systems are less effective in low-load networks and processing environments, leading to lower abnormality detection rates and increased false positive detections due to fixed communication interval settings that fail to adapt to varying network and processing loads.
Innovation Solution
An abnormality detection device comprising a receiver, a frame information storage, a reception predictor, and an abnormality determiner that calculates a predicted time range for communication frames, allowing for dynamic adjustment of the detection criteria based on network and processing loads to minimize false detections and enhance detection rates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a fixed communication interval setting is used to maximize tolerance range, then the system can accommodate network and processing load variations, but the abnormality detection rate decreases in low-load networks
Solution Approach 1:
The patent applies dynamics by transitioning from a fixed communication interval setting to a dynamic predicted time range calculation. The system calculates predicted time ranges based on actual reception times of communication frames, allowing the tolerance range to adapt automatically to current network and processing load conditions. This resolves the contradiction by making the system both adaptable (through dynamic adjustment) and reliable (through accurate anomaly detection based on actual patterns).
Solution Approach 2:
The patent changes the parameter from a fixed communication interval to a dynamically calculated predicted time range. By using the actual reception time of communication frames to calculate the predicted time range for the next frame, the system adjusts the tolerance parameter based on real-time conditions. This parameter change enables the system to maintain high detection rates while accommodating load variations.
2Adaptability or versatility
If a fixed communication interval setting is used to maximize tolerance range, then the system can accommodate network and processing load variations, but false abnormality detections increase under high load conditions
Solution Approach 1:
The system dynamically adjusts the predicted time range based on actual reception patterns, allowing the tolerance range to expand or contract according to current load conditions. This dynamic adjustment prevents false detections by adapting to legitimate variations in communication timing caused by network or processing loads, while still detecting actual abnormalities.
Solution Approach 2:
The system uses feedback from actual communication frame reception times to continuously refine the predicted time range. By comparing expected versus actual reception times and adjusting the predicted range accordingly, the system learns the actual communication patterns under current load conditions, thereby reducing false detections while maintaining adaptability.
3Ease of operation
If a standardized reference range is established for communication intervals, then the system can operate with a single configuration, but the detection accuracy decreases when load conditions change
Solution Approach 1:
The system performs self-service by automatically calculating and adjusting its own predicted time range based on actual communication frame reception times. No manual reconfiguration is needed when load conditions change; the system adapts autonomously by using its observed communication patterns to update the predicted range, thereby maintaining both operational simplicity and detection accuracy.
Solution Approach 2:
The system transitions from a static reference range to a dynamic predicted time range that automatically adjusts to changing conditions. This dynamic approach maintains configuration simplicity while improving detection accuracy, as the range adapts to actual communication patterns without requiring manual intervention or multiple configurations.
Data Source
AI summary
An abnormality detection device includes: a receiver, a reception predictor, frame information storage, and an abnormality determiner. The receiver receives a communication frame via a communication network. The frame information storage stores information regarding the communication frame. The reception predictor calculates and sets a predicted time range including a scheduled reception time of the communication frame of a target frame type from among a plurality of frame types received by the receiver by referencing the frame information storage and the reception time of the communication frame when the communication frame is received. The abnormality determiner determines the target communication frame is an abnormal frame when the target communication frame is received at a time outside the predicted reception range.