Anomaly Detection via Characteristic Type Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional systems for detecting anomalous interactions rely heavily on historical data to identify patterns, which limits their effectiveness in detecting new or evolving malicious behavior that does not match previous patterns.
Innovation Solution
The approach involves determining characteristic types associated with potentially anomalous historical interactions and using these types to identify potentially anomalous future interactions, even if the specific characteristic values have not occurred previously.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional systems use historical data to identify patterns of anomalous interactions, then detection accuracy for known patterns is improved, but the system fails to detect new or evolving malicious behavior that does not match previous patterns
Solution Approach 1:
The patent changes the detection parameters from specific characteristic values (e.g., specific IP addresses, email addresses) to characteristic types (e.g., IP address format, email domain structure). This parameter transformation allows the system to maintain detection accuracy for known patterns while adapting to new malicious behaviors by analyzing the structural characteristics rather than fixed values.
Solution Approach 2:
Instead of asking 'which specific values have been seen before?', the system inverts the approach by asking 'which characteristic types exhibit anomalous patterns?'. This inversion allows detection of new malicious behaviors by identifying unusual patterns in characteristic type distributions, rather than requiring exact matches to historical values.
2Reliability
If the system focuses on matching specific characteristic values from historical data, then false positives are reduced, but new anomalous interactions with different values are missed
Solution Approach 1:
The system transforms detection from value-specific to type-based analysis. By analyzing the distribution and patterns of characteristic types (e.g., geographic regions, device categories, time patterns) rather than specific values, the system maintains reliability through consistent type-based criteria while detecting new anomalies that exhibit unusual type combinations or distributions.
Solution Approach 2:
The characteristic type-based approach serves multiple functions simultaneously: it detects known patterns through established type criteria, detects new patterns through unusual type combinations, and adapts to evolving threats without requiring retraining on specific values. This universal approach handles both reliability and adaptability requirements.
3Object-affected harmful factors
If malicious actors change their characteristics to evade detection, then the effectiveness of value-based detection decreases, but type-based detection can identify the anomalous patterns
Solution Approach 1:
By changing from value-based to type-based parameters, the system becomes insensitive to value changes while remaining sensitive to pattern changes. When malicious actors change their characteristics (values), the system detects the anomaly through changes in characteristic type distributions, maintaining detection effectiveness despite value variations.
Solution Approach 2:
Characteristic types serve as an intermediary layer between specific values and detection logic. This intermediary abstraction allows the system to ignore value changes (e.g., different IP addresses) while detecting the underlying anomalous pattern through the type classification, effectively neutralizing evasion attempts.
Data Source
AI summary
Anomalous interactions with a website or other system may be detected based on the types of characteristics associated with previous anomalous interactions, independent of the values associated with those characteristics. Historical data is used to determine characteristics of interactions, each characteristic having a type and a value. For historical interactions in which a set of characteristic values are associated with a potentially anomalous interaction, the characteristic types are analyzed in subsequent interactions. If values for those characteristic types occur at a frequency greater than a threshold frequency for a set of subsequent interactions, this may indicate that the interactions are anomalous. Use of the characteristic types for this purpose, rather than historical characteristic values, enables anomalous interactions to be detected independent of the characteristic values associated with the interactions.