Anomaly Detection Using Local Density and Frequency Measurements
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cyber security systems face challenges in detecting insider threats, which are often difficult to identify and mitigate, as they can result in significant damage to organizations without being publicly noticeable.
Innovation Solution
The implementation of a computer-implemented method that acquires records with attributes, determines outliers using local density measurements and normally distributed attribute value frequencies, and classifies anomalies using probabilistic classifiers, enabling effective threat detection and mitigation within computer networks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional security monitoring methods are used, then system simplicity is maintained, but detection precision of insider threats deteriorates
Solution Approach 1:
The patent segments the anomaly detection process into distinct modules: local density measurement for numeric attributes, normally distributed attribute value frequency measurement for categorical attributes, and probabilistic classification. Each module handles specific aspects of the detection task, improving precision while organizing complexity into manageable segments.
Solution Approach 2:
The patent introduces multiple measurement dimensions by analyzing both numeric data (via local density) and categorical data (via frequency distribution) simultaneously. This multi-dimensional approach enhances detection precision by capturing anomalies across different data types and characteristics.
2Reliability
If comprehensive anomaly detection is implemented, then detection coverage is improved, but false positive rate increases
Solution Approach 1:
The patent implements feedback mechanisms where the probabilistic classifier uses outputs from both local density measurements and frequency distribution measurements to make informed anomaly decisions. This feedback loop allows the system to cross-validate findings and reduce false positives while maintaining comprehensive coverage.
Solution Approach 2:
The patent changes parameters by using different statistical measures for different data types (local density for numeric, frequency distribution for categorical) and combining them through probabilistic classification. This parameter differentiation allows comprehensive detection while maintaining accuracy by applying appropriate measures to appropriate data.
3Measurement precision
If multiple measurement methods are combined, then detection accuracy is improved, but computational complexity increases
Solution Approach 1:
The patent segments computational tasks by assigning specific algorithms to specific data types: local density computation for numeric attributes and frequency distribution analysis for categorical attributes. This segmentation allows efficient use of computational resources while achieving high detection accuracy through specialized processing.
Solution Approach 2:
The system performs self-service by automatically selecting appropriate measurement methods based on data type characteristics. Numeric attributes automatically receive local density measurement while categorical attributes receive frequency distribution measurement, eliminating the need for manual configuration and reducing overall computational overhead.
Data Source
AI summary
A technique includes acquiring a plurality of records, each record having a corresponding number of attributes determining, based on local density measurements for numeric and normally distributed attribute value frequency measure for categorical attributes tags in the training portion of the plurality of records which is then used in probabilistic classifier for anomaly detection. A second set of implementations is proposed using ensemble method of combining deep learning algorithms for the same.