Anomalous Network Session Identification via Hierarchical Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network communication technologies fail to identify anomalous network sessions in real time, leading to the disruption of entire networks when an anomalous session is detected, wasting resources and not addressing security concerns effectively.
Innovation Solution
A system and method that collect network traffic data, parse metadata, perform hierarchical clustering, and apply cluster analysis to identify anomalous sessions, allowing for targeted mitigation actions without disrupting other sessions, using components like data collectors, typification, clustering, and prohibition analysis components.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional network security systems take down the entire network when an anomalous session is detected, then network security is improved, but network availability and resource utilization deteriorate
Solution Approach 1:
The system segments the network traffic into individual sessions and applies security analysis and mitigation actions to each session independently. Instead of taking down the entire network, the system identifies and isolates only the anomalous sessions through cluster analysis and outlier detection, allowing normal sessions to continue operating without disruption.
Solution Approach 2:
The system applies different treatment to different sessions based on their characteristics. Normal sessions receive standard processing while anomalous sessions identified through clustering and outlier detection receive targeted mitigation actions. This localized approach ensures that security measures are applied only where needed, preserving network availability for legitimate traffic.
2Reliability
If real-time identification of anomalous sessions is implemented, then network security response time is improved, but system complexity increases
Solution Approach 1:
The system performs self-service through automated cluster analysis and outlier detection algorithms that automatically identify anomalous sessions without requiring manual intervention. The hierarchical clustering and anomaly detection components continuously analyze network traffic patterns and autonomously determine which sessions require mitigation actions, reducing the need for complex manual security operations.
Solution Approach 2:
The system implements continuous feedback loops where cluster analysis results inform real-time mitigation decisions. The system monitors network sessions, identifies outliers through clustering, applies mitigation actions, and continues monitoring to verify effectiveness. This feedback mechanism enables real-time security response while maintaining manageable system complexity through automated decision-making.
3Measurement precision
If comprehensive network monitoring is performed to identify all sessions, then detection accuracy is improved, but processing time and resource consumption increase
Solution Approach 1:
The system performs preliminary clustering of network sessions to group similar traffic patterns together before conducting detailed anomaly analysis. By pre-organizing sessions into clusters based on hierarchical clustering, the system reduces the search space for anomaly detection, enabling faster identification of outliers without sacrificing detection accuracy.
Solution Approach 2:
The system applies partial action by focusing computational resources on analyzing only the clustered sessions and identified outliers rather than processing every single session in detail. The hierarchical clustering approach allows the system to efficiently identify potential anomalies by comparing sessions against cluster centroids, reducing overall processing time while maintaining detection precision.
Data Source
AI summary
A system for identifying one or more anomalous network sessions in a network environment includes a memory and a processor coupled to the memory. The processor collects network traffic data based on a plurality of network sessions between a source and a destination in the network environment. The processor parses the network traffic data to identify a plurality of parameters associated with the network traffic data at different network layers. The processor clusters the network traffic data into baseline network traffic data based on one or more specific parameters of the plurality of parameters. The processor identifies unknown network traffic based upon the clustered network traffic data and analyzes the unknown network traffic with respect to the baseline network traffic data to identify the one or more anomalous network sessions. The processor determines and performs one or more mitigation actions for the identified one or more anomalous network sessions.