Adaptive Anomaly Detection Using Corrected Prediction Values
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network anomaly detection methods often incorrectly identify fluctuations in traffic volume due to changes in business seasons or work styles, leading to unnecessary anomaly detections and masking actual anomalies.
Innovation Solution
The method involves calculating corrected prediction values based on actual measured values from the previous day, using a correction coefficient to adjust prediction values and set wider normal ranges, allowing for more accurate anomaly detection by accounting for trend deviations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a threshold value indicating fluctuation tolerance is predicted based on past traffic data, then anomaly detection capability is improved, but unnecessary anomaly detections occur due to changes in business seasons or work styles
Solution Approach 1:
The patent applies dynamics by making the threshold value adaptive rather than static. The system dynamically adjusts the threshold based on predicted traffic patterns that account for temporal variations such as business seasons and work style changes. This allows the anomaly detection system to adapt to changing conditions while maintaining reliable detection capability.
Solution Approach 2:
The patent changes the parameter of the threshold value from a fixed historical average to a dynamically predicted value that incorporates temporal patterns. By modifying how the threshold parameter is calculated (using prediction models that consider business seasons and work styles), the system reduces false positives while maintaining detection accuracy.
2Device complexity
If a fixed threshold range is used for anomaly detection, then the detection method is simple, but actual anomalies may be masked by unpredictable fluctuations in traffic volume
Solution Approach 1:
The system transitions from a static threshold range to a dynamic one that adapts to predicted traffic patterns. This dynamic adjustment maintains relatively simple detection logic while improving precision by accounting for predictable variations in traffic volume due to business seasons and work style changes.
Solution Approach 2:
The system performs preliminary prediction of traffic patterns before setting the threshold range. By anticipating normal fluctuations in advance based on historical patterns and predicted values, the system prepares an appropriate threshold range that prevents masking of actual anomalies while maintaining detection simplicity.
Data Source
AI summary
An anomaly detection method executed by a computer, the anomaly detection method includes identifying, for each of target periods, a prediction value to be a reference for determining whether an anomaly occurs in the target period; identifying a corrected prediction value acquired by correcting the prediction value of a first target period based on the prediction value and a measured values of a second target period before the first target period; setting one of the prediction value and the corrected prediction value corresponding to the first target period as an upper limit value and the other as a lower limit value; and determining whether the anomaly occurs in the first target period by using a reference defined by the upper limit value and the lower limit value.