Anomaly Detection Device Using Data Amplification for Limited Communication Features

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Anomaly-based abnormality detection techniques face challenges in accurately detecting abnormalities due to the need for pre-collected communication data during normal operations, especially when the quantity is small or communication patterns are biased, leading to reduced detection accuracy.

Innovation Solution

An abnormality detection device that acquires communication features, amplifies data counts using predetermined schemes, creates reference value information through learning, determines detection accuracy using anomaly scores, and selects the most accurate reference values for monitoring.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If a fixed quantity of communication information is collected in advance during normal operation to create reference value information, then the accuracy of abnormality detection is improved, but the time required before monitoring can begin increases

Engineering Contradiction:

Improveabnormality detection accuracyVSAvoidtime to start monitoring

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The system performs preliminary actions by collecting communication information during a connection establishment period before formal monitoring begins. This preliminary data collection enables the creation of reference value information in advance, so when monitoring starts, accurate anomaly detection can immediately occur without delaying the monitoring startup.

Inventive Principle:

Principle #10Preliminary action

2Loss of time

If a small quantity of communication information is used to create reference value information, then the time to start monitoring is reduced, but the accuracy of abnormality detection deteriorates

Engineering Contradiction:

Improvetime to start monitoringVSAvoidabnormality detection accuracy

Core Design Contradiction:

Loss of timeVSMeasurement precision

Solution Approach 1:

The system changes the parameter of data quantity by collecting communication information for a predetermined period during connection establishment. This ensures sufficient data quantity is available to create accurate reference value information, improving abnormality detection accuracy without significantly delaying monitoring startup.

Inventive Principle:

Principle #35Parameter changes

3Measurement precision

If communication information is collected during normal operation before monitoring starts, then reference value information can be created, but communication equipment cannot be connected to the network immediately

Engineering Contradiction:

Improvereference value information qualityVSAvoidnetwork connection speed

Core Design Contradiction:

Measurement precisionVSEase of operation

Solution Approach 1:

The system performs preliminary data collection during the connection establishment period, which is a natural waiting phase before monitoring begins. This preliminary action of collecting communication information does not delay the overall connection process, as it occurs concurrently with the establishment phase, and enables accurate reference value creation without impacting network connection speed.

Inventive Principle:

Principle #10Preliminary action

4Device complexity

If a single piece of reference value information is used for all communication equipment, then the system complexity is reduced, but the accuracy of abnormality detection deteriorates due to different communication patterns

Engineering Contradiction:

Improvereference value information managementVSAvoidabnormality detection accuracy

Core Design Contradiction:

Device complexityVSMeasurement precision

Solution Approach 1:

The system segments reference value information by creating separate reference values for different communication equipment based on their unique communication patterns. This segmentation ensures that each piece of equipment has customized reference value information tailored to its specific patterns, significantly improving abnormality detection accuracy while the automated process keeps management complexity acceptable.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS12113816B2Anomaly detection device, anomaly detection method and anomaly detection program

Publication Date: 2024.10.08 NIPPON TELEGRAPH & TELEPHONE CORP

AI summary

An acquisition unit acquires a communication feature for normal communication of communication equipment. If a data count or a data acquisition period for the acquired communication feature exceeds a predetermined value, an amplification unit amplifies the data count for the communication feature by a plurality of predetermined schemes in accordance with data counts for respective groups, each group sharing a same 5-tuple. A creation unit creates, for each of the predetermined schemes, reference value information for normal communication of the communication equipment through learning using the amplified communication feature. A determination unit determines accuracy of abnormality detection for each of the predetermined schemes using an anomaly score representing a deviation of test data representing a communication feature for abnormal communication from the reference value information. A selection unit selects the reference value information created by one of the schemes, the determined accuracy for which is highest.