Anomaly Detection via Statistical Distance Ranking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anomaly detection systems in computer networks face challenges in identifying anomalous behavior, especially in dynamic systems where 'normal' behavior is unclear and changes rapidly, requiring manual expert knowledge and being unsuitable for categorical data.
Innovation Solution
The system employs automatic anomaly detection using cumulative statistical analysis to calculate statistical distances between entities, ranking abnormal behavior without pre-defined baselines, and utilizing a probability engine, distance calculator, and abnormality rank generator to identify anomalies in both static and dynamic systems with categorical and numerical features.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual expert knowledge is used to define normal behavior baselines, then anomaly detection can be performed in static systems, but the system cannot adapt to dynamic environments where normal behavior changes rapidly
Solution Approach 1:
The patent implements dynamics by automatically adapting the baseline of normal behavior based on observed system behavior over time. Instead of using static manually-defined baselines, the system continuously learns and updates what constitutes normal behavior, allowing it to adapt to rapidly changing dynamic environments while maintaining anomaly detection accuracy.
Solution Approach 2:
The system performs self-service by automatically defining its own baseline for normal behavior without requiring manual expert knowledge. The anomaly detection system autonomously observes system behavior, identifies patterns, and establishes baselines independently, enabling it to function effectively in dynamic environments where predefined baselines would become obsolete.
2Ease of manufacture
If pre-defined baselines are used for anomaly detection, then the detection process is simple to implement, but the system cannot handle systems without prior knowledge of normal behavior
Solution Approach 1:
The system defines its own baseline for normal behavior automatically without requiring manual expert knowledge or pre-defined parameters. This self-service approach allows the anomaly detection system to be applied to any system regardless of whether prior knowledge of normal behavior exists, while maintaining ease of implementation through automated baseline definition.
Solution Approach 2:
The patent implements universality by creating an anomaly detection system that can be applied to any system type without requiring system-specific customization. The automatic baseline definition capability makes the system universally applicable to both systems with and without prior knowledge, eliminating the need for manual adaptation to different system types.
3Measurement precision
If traditional anomaly detection methods are used, then they work for numerical data, but they are unsuitable for categorical data which is common in network systems
Solution Approach 1:
The patent applies parameter changes by transforming the approach to handle different data types. Instead of using methods optimized for numerical data, the system adapts its parameters and measurement approaches to effectively process categorical data from network systems, maintaining detection precision across both numerical and categorical data types through automatic baseline definition that is type-agnostic.
Data Source
AI summary
The present disclosure provides a method, system and non-transient computer readable medium for evaluating system behaviour by deriving a statistical distance between each entity in a multi-entity system, and summing the statistical distance to each other entity to create a ranked abnormality score for each entity in the system.