Anomaly Detection System for Coordinated Attack Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anomaly detection systems in computing systems are ineffective in detecting coordinated attacks, as individual requests may not appear anomalous, allowing malicious actors to execute attacks through multiple non-suspicious actions.
Innovation Solution
A computer-implemented method and system that calculates anomaly scores for accounts based on account identifiers and transaction amounts, generates aggregated anomaly scores, normalizes them using historical data, and identifies potential targets of anomalous activity to block malicious transactions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If anomaly detection systems examine individual request properties, then detection precision for obvious malicious activity is improved, but coordinated attacks using multiple individual actions remain undetected
Solution Approach 1:
The patent merges multiple individual anomaly scores into an aggregated anomaly score that represents the collective behavior of multiple requests. This aggregation allows the system to detect coordinated attacks by combining information from individual requests that would otherwise appear normal when examined in isolation.
Solution Approach 2:
The patent introduces a new dimension of analysis by aggregating anomaly scores across multiple requests and accounts. Instead of analyzing single requests in one dimension, the system creates an aggregated view that captures patterns across multiple dimensions (multiple requests, multiple accounts, multiple time points), enabling detection of coordinated attack patterns.
2Measurement precision
If anomaly scores are calculated for each individual account and request, then false positives for normal activity are reduced, but coordinated attacks across multiple accounts go undetected
Solution Approach 1:
The patent segments the anomaly detection process into distinct components: individual account anomaly scores, aggregated anomaly scores across multiple accounts, and normalized scores for comparison. This segmentation allows the system to maintain precise individual scoring while adding aggregation layers to detect coordinated patterns without overwhelming complexity.
3Reliability
If aggregated anomaly scores are generated across multiple accounts, then coordinated attacks are detected, but processing time and computational resources increase
Solution Approach 1:
The patent performs preliminary actions by pre-calculating and storing baseline anomaly scores for individual accounts during normal operation. When a coordinated attack occurs, the system can quickly aggregate these pre-computed scores rather than calculating everything from scratch, significantly reducing detection time while maintaining reliability.
4Measurement precision
If normalization based on historical data is applied, then false alarms are reduced, but the system becomes more complex and requires more historical data storage
Solution Approach 1:
The patent applies parameter changes by normalizing anomaly scores using historical minimum and maximum values to transform them into a standardized range. This parameter transformation allows different accounts and time periods to be compared fairly, reducing false alarms while requiring manageable historical data storage for establishing baselines.
Data Source
AI summary
Certain embodiments of the present disclosure provide techniques for identifying and blocking anomalous transactions within a computing system. An example method generally includes selecting a set of accounts for analysis. For each respective account, an anomaly score is calculated based on an account number associated with the respective account and transaction amounts associated with the respective account. An aggregated anomaly score is generated for each respective account provider of a plurality of account providers based on the anomaly score associated with each respective account. The aggregated anomaly score for each respective account provider is normalized based on a historical minimum and historical maximum anomaly score for the respective account provider. One or more account providers that are potential targets of anomalous activity are identified. One or more actions are taken to block completion of transactions requested by one or more accounts associated with the identified one or more account providers.