AI Anomaly Detection for Network Configuration Threats

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing systems for detecting distributed malicious activity in computer networks face challenges in accurately identifying threats due to false positives from non-standard configurations and the difficulty in correlating configuration changes across diverse systems and services.

Innovation Solution

A machine-learning-based threat detection system that creates a baseline of configuration-related activity patterns, monitors corporate networks for system configurations and events, and classifies distributed activity using a cascade of machine-learning models to predict abnormal behavior.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If universal detection rules are used in EDR and XDR systems, then detection coverage is improved, but false positives increase due to non-standard network configurations

Engineering Contradiction:

Improvedetection accuracyVSAvoidadaptability to non-standard configurations

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The system performs preliminary baselining of configuration-related activity patterns during a training phase before actual threat detection begins. This preliminary action creates a reference model of normal behavior for each specific network environment, enabling the system to later distinguish between legitimate configuration variations and actual threats without generating false positives

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system changes the detection parameters from fixed universal rules to dynamic baseline-derived parameters. By continuously learning and adapting detection thresholds and patterns based on the specific network's configuration behavior, the system maintains high detection accuracy while accommodating non-standard configurations

Inventive Principle:

Principle #35Parameter changes

2Measurement precision

If correlation of all events from all systems is performed, then detection accuracy is improved, but resource consumption and human resources required increase significantly

Engineering Contradiction:

Improvedetection accuracyVSAvoidsystem complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The system extracts only the relevant configuration-related events and parameters from the vast amount of system data, rather than correlating all events from all systems. This extraction focuses computational resources on the specific configuration changes that indicate threats, maintaining detection accuracy while reducing resource consumption

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The system segments the detection process into distinct phases: baseline creation, event collection, configuration correlation, and anomaly detection. This segmentation allows each component to operate independently and efficiently, reducing overall system complexity while maintaining comprehensive detection capabilities

Inventive Principle:

Principle #1Segmentation

3Reliability

If configuration changes are monitored for threat detection, then detection capability is improved, but false positives increase in networks with non-standard configurations

Engineering Contradiction:

Improvethreat detection capabilityVSAvoiddetection precision

Core Design Contradiction:

ReliabilityVSMeasurement precision

Solution Approach 1:

The system implements feedback mechanisms where detection results and false positive cases are continuously fed back into the baseline model. This allows the system to learn from its mistakes and continuously refine its understanding of what constitutes normal versus abnormal configuration changes in each specific network environment

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The system transitions from static detection rules to dynamic, adaptive detection parameters. The baseline configuration patterns are continuously updated and adjusted based on observed network behavior, allowing the system to dynamically adapt to legitimate configuration changes while maintaining sensitivity to actual threats

Inventive Principle:

Principle #15Dynamics

4Loss of information

If configuration information is collected from multiple systems and services, then detection completeness is improved, but difficulty in obtaining consistent configuration data increases

Engineering Contradiction:

Improveconfiguration information completenessVSAvoiddata collection difficulty

Core Design Contradiction:

Loss of informationVSDifficulty of detecting and measuring

Solution Approach 1:

The system implements a universal configuration collection interface that can extract configuration data from multiple different systems and services through a common methodology. This multi-functional approach allows the system to gather comprehensive configuration information from diverse sources while using consistent data collection and normalization processes

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS12328323B2System and method of anomalous configuration-related activity

Publication Date: 2025.06.10 ACRONIS INT

AI summary

An anomaly detection system uses an AI engine to analyze configurations of endpoints using backup archives and system events on shared network assets to detect and verify anomalies. Cascade of machine-learning models consist of a behavior analysis model and a system configuration model that are trained to detect anomalous configurations of endpoints and behavioral anomalies on shared network assets and configuration-behavior analysis model that is trained to detect threat with great accuracy using a combination of configurations and system events as input.