Anomalous Behavior Model for Infected Network Node Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anomaly detection methods in computer networks often result in a high number of false positives due to the inability to precisely identify malicious network activities, as not all anomalous behaviors are malicious, leading to inefficient detection of infected network nodes.
Innovation Solution
A method that generates an anomalous behavior model based on identified infected network nodes, allowing for the comparison of network data from other nodes to determine similarities exceeding a predefined threshold, thereby accurately identifying infected nodes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If current anomaly detection methods are used to identify infected network nodes, then detection coverage is achieved, but false positive rate increases due to inability to precisely identify malicious activities
Solution Approach 1:
The patent segments the anomaly detection process into distinct phases: generating behavior models from confirmed infected nodes, comparing these models against network node data, and making identification decisions based on similarity thresholds. This segmentation allows each phase to be optimized independently, improving overall precision while maintaining reliability.
Solution Approach 2:
The system performs preliminary action by first identifying confirmed infected nodes and generating their behavior models before using these models to detect other infected nodes. This preliminary establishment of accurate reference models enables more precise subsequent detections, reducing false positives.
2Measurement precision
If comprehensive network data collection is performed to improve detection accuracy, then identification precision increases, but system complexity and resource consumption increase
Solution Approach 1:
The behavior model serves multiple functions: it characterizes infected node patterns, provides a basis for comparison, and enables identification decisions. This multi-functionality reduces the need for separate detection mechanisms, simplifying the overall system while maintaining high precision through comprehensive data analysis.
3Measurement precision
If behavior models are generated from confirmed infected nodes to improve detection precision, then false positives are reduced, but detection time increases due to model generation and comparison processes
Solution Approach 1:
The system creates behavioral copies or models of confirmed infected nodes, which can then be rapidly compared against other nodes. This copying approach allows the system to leverage learned patterns without repeatedly analyzing raw data, significantly reducing detection time while maintaining high precision through the use of established behavioral templates.
Data Source
AI summary
The present disclosure is directed to a method of identifying an infected network node. The method includes identifying a first network node as infected. The method includes collecting a first set of network data from the first network node including anomalous activities performed by the first network node. The method includes generating an anomalous behavior model using the first set of network data. The method includes collecting a second set of network data from a second network node including anomalous activities performed by the second network node. The method includes comparing the second set of data to the generated anomalous behavior model. The method includes determining, from the comparison, that a similarity between first characteristics and second characteristics exceeds a predefined threshold. The method includes ascertaining, based on the determination, the second network node as an infected network node.