Anomaly Detection Apparatus Reducing False Positives via Historical Scoreboard
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for identifying malicious network traffic anomalies often result in false positives, leading to unnecessary mitigation actions, as they fail to accurately distinguish between actual attacks and benign traffic patterns.
Innovation Solution
An anomaly detection apparatus that monitors network traffic and server health, utilizing a historical scoreboard database to differentiate between malicious anomalies and false positives by comparing current data to historical patterns, thereby reducing false positives and improving attack detection accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If current traffic management computing devices use traditional anomaly detection methods, then network traffic anomalies can be identified, but false positives occur resulting in unnecessary mitigation actions on benign traffic
Solution Approach 1:
The system performs preliminary actions by monitoring and recording network traffic patterns and server health metrics in advance, building a historical scoreboard database before actual attacks occur. This allows the system to distinguish between benign periodic patterns and actual malicious attacks based on pre-established baselines.
Solution Approach 2:
The system implements feedback mechanisms by continuously comparing current network traffic anomalies against historical data from the scoreboard database. When anomalies match historical benign patterns, the feedback loop prevents false positive mitigation actions. When anomalies deviate from historical patterns, the system confirms malicious activity and applies mitigation.
2Object-affected harmful factors
If traffic management computing devices implement mitigation techniques for detected anomalies, then actual attacks are blocked, but benign traffic is also affected due to false positives
Solution Approach 1:
The system builds a historical scoreboard database in advance that records benign network traffic patterns and server health states. This preliminary data accumulation enables the system to make informed decisions about whether to apply mitigation, ensuring that legitimate traffic patterns are recognized and protected from unnecessary blocking.
Solution Approach 2:
The feedback mechanism compares current traffic characteristics against the historical scoreboard to determine whether mitigation should be applied. This feedback loop ensures that mitigation actions are only taken when truly necessary, preserving legitimate traffic throughput while blocking actual attacks.
3Reliability
If the system monitors and compares network traffic to historical data, then false positives are reduced, but system complexity increases due to the historical scoreboard database
Solution Approach 1:
The system segments the anomaly detection process into distinct components: traffic monitoring, server health monitoring, historical data storage (scoreboard database), and decision-making logic. This segmentation makes the complex system more manageable and maintainable by dividing it into independent functional modules.
Solution Approach 2:
The historical scoreboard database serves as an intermediary between raw network traffic data and mitigation decisions. It stores and organizes historical patterns, allowing the decision-making process to compare current anomalies against established baselines without directly analyzing all raw data, thus reducing computational complexity.
4Measurement precision
If the system uses multiple signal types (client-side and server-side signals), then detection accuracy improves, but data processing requirements increase
Solution Approach 1:
The system segments signal collection into distinct client-side signals (network traffic characteristics) and server-side signals (server health metrics). This segmentation allows for targeted data collection and processing, focusing computational resources on the most relevant indicators for each detection objective.
Solution Approach 2:
The system merges client-side and server-side signal data into a unified detection framework that uses both perspectives to make anomaly determination. By combining multiple signal types and cross-referencing them against the historical scoreboard, the system achieves higher precision while managing data processing through efficient integration.
Data Source
AI summary
A method, non-transitory computer readable medium, and anomaly detection apparatus that monitors network traffic exchanged with a plurality of client devices and a plurality of server devices to obtain client-side signal data for a plurality of client-side signals and server-side signal data for a plurality of server-side signals. A determination is made when a server health anomaly or a network traffic anomaly is a false positive based at least in part on a comparison of at least a portion of the client-side signal data or at least a portion of the server-side signal data to a historical scoreboard database comprising historical data regarding one or more historical network traffic or server health anomalies. A mitigation action is initiated when the determining indicates that one or more of the server health anomaly or network traffic anomaly is not a false positive.