Anomaly Classification via Feature Importance Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network anomaly detection methods using forest algorithms struggle to provide clear interpretations of anomaly scores and feature importance, making it difficult to understand the causes of anomalies in network data traffic, which hinders efficient analysis and automated decision-making.
Innovation Solution
A computer-implemented method that determines feature-associated anomaly scores and calculates feature importance for each anomaly, enabling the classification of anomalies in network data traffic by sorting features based on their contribution to the anomaly score, thereby facilitating automated analysis and decision-making.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If forest algorithms are used for anomaly detection, then anomaly detection capability is improved, but interpretability of anomaly scores and feature importance deteriorates
Solution Approach 1:
The patent introduces an intermediary interpretation layer that translates the complex output of forest algorithms into human-understandable feature importance scores. This intermediary component analyzes the path lengths and feature contributions across multiple trees, then aggregates this information into interpretable metrics that explain which features drove anomaly detections, thus resolving the contradiction between detection capability and interpretability
Solution Approach 2:
The patent replaces the opaque mechanical operation of forest algorithms with a transparent scoring mechanism. Instead of directly using the complex tree evaluation process as the final output, the system substitutes it with a derived feature importance calculation that maintains the detection accuracy while providing clear explanations of which network features contributed most to anomaly scores
2Adaptability or versatility
If comprehensive network behavior detection is implemented, then detection coverage is improved, but system complexity increases
Solution Approach 1:
The patent segments the complex network traffic analysis into multiple independent detection trees, each focusing on specific feature patterns. By dividing the comprehensive detection task into smaller tree units that can be independently constructed and evaluated, the system achieves broad detection coverage while managing complexity through modular architecture. Each tree handles a subset of features, and their collective results provide comprehensive coverage
3Measurement precision
If manual inspection of anomalies is performed, then analysis accuracy is improved, but time consumption increases
Solution Approach 1:
The patent implements self-service anomaly classification by automatically generating feature importance scores and sorted feature lists that explain anomaly causes. This self-service mechanism eliminates the need for manual inspection while maintaining high accuracy, as the system autonomously identifies and ranks the most significant features contributing to each anomaly, providing actionable insights without human intervention
Data Source
AI summary
The present disclosure relates to a computer-implemented method and an apparatus for classifying anomalies of one or more feature-associated anomalies in network data traffic between devices in a first part of a network and devices in a second part of the network. The method comprises retrieving at least one network data traffic sample and determining one or more feature-associated anomaly scores for the retrieved at least one network data traffic sample. The method further comprises determining feature importance of each feature of a feature-associated anomaly score and classifying one or more anomalies based on the determined one or more feature-associated anomaly scores and the determined feature importance.