Importance-Level Calculation for Network Alert Classification

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current communication monitoring systems require visual inspection by operators to determine the risk level of alerts, especially for atypical elements like payload in packets, and rely insufficiently on matching event data with past alerts, leading to potential false detection classifications.

Innovation Solution

An importance-level calculation device computes an importance level for alerts based on characteristics unique to the communication information causing the alert, not present in previous alerts, and outputs this level along with alert information for operator identification.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Extent of automation

If communication monitoring systems rely on matching event data with past alerts to determine risk levels, then automation is improved, but measurement precision deteriorates for atypical patterns

Engineering Contradiction:

Improveautomation of alert classificationVSAvoidaccuracy of risk level determination

Core Design Contradiction:

Extent of automationVSMeasurement precision

Solution Approach 1:

The patent segments alert analysis into two distinct pathways: typical alerts are processed automatically through pattern matching with historical data, while atypical alerts are routed for manual operator review. This segmentation allows the system to achieve high automation for common cases while maintaining precision through human judgment for novel threats.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces an intermediary mechanism that identifies and flags atypical alerts based on their deviation from established patterns. This intermediary layer acts as a bridge between automated processing and manual review, ensuring that only alerts requiring human expertise are escalated, thereby optimizing both automation and precision.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Measurement precision

If operators perform visual inspection of all alert elements including payload, then measurement precision is improved, but productivity deteriorates

Engineering Contradiction:

Improveaccuracy of risk level determinationVSAvoidefficiency of alert classification

Core Design Contradiction:

Measurement precisionVSProductivity

Solution Approach 1:

The patent segments the review process by identifying only atypical alerts that require manual inspection, while typical alerts are processed automatically. This segmentation dramatically reduces the volume of alerts requiring operator attention while maintaining precision for critical cases.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Instead of requiring complete visual inspection of all alert elements, the patent applies partial action by performing automated analysis on typical features and reserving manual inspection only for atypical characteristics. This partial approach maintains sufficient precision while significantly improving productivity.

Inventive Principle:

Principle #16Partial or excessive action

3Productivity

If communication monitoring systems focus on typical alert patterns, then productivity is improved, but measurement precision deteriorates for novel threats

Engineering Contradiction:

Improveefficiency of alert classificationVSAvoiddetection accuracy of atypical patterns

Core Design Contradiction:

ProductivityVSMeasurement precision

Solution Approach 1:

The patent implements feedback mechanisms where manually reviewed atypical alerts are fed back into the system to update the knowledge base of known threat patterns. This continuous feedback loop enables the system to learn from novel threats and improve its automated detection capabilities over time, balancing productivity with precision for emerging threats.

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS10454959B2Importance-level calculation device, output device, and recording medium in which computer program is stored

Publication Date: 2019.10.22 NEC CORP

AI summary

The present invention provides an importance-level calculation device, etc., with which it is possible to present an alert indicating network abnormality to an operator so as to enable the operator to determine the alert more efficiently. An importance-level calculation device is provided with an importance-level calculation unit which, when a first alert is notified in response to detection of an abnormality in a communication network to be monitored, computes an importance level of the first alert, based on a characteristic that is included in communication information that has caused the first alert but is not included in communication information related to one or more second alerts having been notified prior to the first alert.