Anomaly Detection via Access Data Probability Differences
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current intrusion detection systems face challenges in effectively identifying and responding to sophisticated attacks on computer systems, as they often rely on static patterns and may not adapt well to changing access data probabilities.
Innovation Solution
A method that involves logging access data, performing anomaly analysis by identifying combinations of access parameters with significant probability differences within specific time intervals, and monitoring these parameters to detect new attacks, utilizing predefined probability differences to trigger countermeasures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If static patterns are used for attack detection, then the detection system is simple to implement, but it cannot adapt to changing access data probabilities and sophisticated attacks
Solution Approach 1:
The patent implements dynamic anomaly detection by continuously calculating probability differences of access parameter combinations compared to learned normal behavior patterns. Instead of using fixed static thresholds, the system dynamically adapts to changing access patterns by comparing current access probabilities against historically learned probabilities, enabling the system to adapt to sophisticated and evolving attacks while maintaining reasonable computational complexity through focused probability analysis.
Solution Approach 2:
The system changes the detection parameter from static pattern matching to dynamic probability difference analysis. By monitoring how probability distributions of access parameter combinations change over time and comparing them against learned baselines, the system can detect deviations indicating attacks without requiring complex adaptive algorithms, thus resolving the contradiction between adaptability and complexity.
2Measurement precision
If comprehensive access data analysis is performed to detect sophisticated attacks, then detection accuracy improves, but analysis time and computational resources increase
Solution Approach 1:
The patent extracts and focuses analysis on specific probability difference metrics rather than performing comprehensive analysis of all access parameters. By identifying and monitoring key probability differences between normal and anomalous access patterns, the system achieves high detection accuracy while significantly reducing computational overhead and analysis time compared to analyzing all possible access data combinations.
Solution Approach 2:
The system performs partial analysis by focusing on probability differences of specific access parameter combinations rather than analyzing all access data comprehensively. This selective approach to probability monitoring enables timely detection of sophisticated attacks by concentrating computational resources on the most indicative probability deviations, thus balancing accuracy with analysis speed.
3Loss of time
If probability difference thresholds are set to be sensitive for early detection, then detection timing improves, but false positive rate increases
Solution Approach 1:
The system employs feedback mechanisms by continuously comparing current access probability differences against learned baseline probabilities and adjusting detection decisions based on cumulative evidence. This feedback loop allows the system to maintain sensitive detection thresholds for early attack detection while using historical probability patterns to filter out anomalies that deviate from typical attack signatures, thereby reducing false positives through adaptive threshold adjustment based on observed probability distributions.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to a method for detecting an attack (110) on a computer system (100, 130, 160, 198) to be protected using logged access data (122, 152, 182) of accesses to the computer system (100, 130, 160, 198) to be protected. The procedure includes logging access data (122, 152, 182), performing an anomaly analysis for the occurrence of an attack on the computer system to be protected (100, 130, 160, 198), identifying those access parameters (112) whose values are encompassed by one or more specific anomalies, and monitoring the values logged in the access data records for the identified access parameters (112), the monitoring including the detection of a renewed attack (110).