Anomaly Detector Using Time-Decayed Residuals for Network Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting security events in computer networks are inefficient due to the complexity and time required to analyze large volumes of data, often resulting in delayed identification of security incidents.
Innovation Solution
A computer system comprising a data collector and an anomaly detector that processes network traffic and event logs in real-time, using a category configurator, data preparer, data miner, and event analyzer to generate processed values, predict expectation values with a time decay factor, and apply security rules to detect anomalies and security events.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional methods are used to analyze logged events, then comprehensive security analysis can be performed, but the analysis takes a long time and is complex
Solution Approach 1:
The patent segments the security analysis process into multiple independent components: a data collector that gathers events, an anomaly detector that processes data in real-time using time-decayed residual values, and a rule-based detector that applies security rules. This segmentation allows parallel processing and reduces the time required for comprehensive security analysis while maintaining detection accuracy.
Solution Approach 2:
The system performs preliminary actions by pre-calculating and storing time-decayed residual values for each event category. When analyzing security events, the system retrieves these pre-computed values instead of processing raw data from scratch, significantly reducing analysis time while maintaining comprehensive detection capabilities.
2Reliability
If comprehensive event analysis is performed on large volumes of data, then security events can be detected, but the complexity of analysis increases
Solution Approach 1:
The analysis system is divided into separate modules: a data collector for gathering events, an anomaly detector for real-time processing using simplified time-decayed residual calculations, and a rule-based detector for applying security rules. Each module handles a specific aspect of analysis, reducing overall system complexity while maintaining comprehensive detection reliability.
Solution Approach 2:
The patent extracts and separates the time-consuming analysis component from the real-time detection component. The anomaly detector extracts key features using pre-computed time-decayed residual values, leaving the rule-based detector to handle security rule applications. This extraction reduces the complexity of real-time analysis while preserving detection reliability.
3Speed
If real-time processing is implemented, then detection speed improves, but computational requirements increase
Solution Approach 1:
The system performs preliminary computations by pre-calculating time-decayed residual values for each event category and storing them for later retrieval. During real-time detection, the system only needs to retrieve these pre-computed values and compare them against current events, significantly reducing real-time computational energy consumption while maintaining high detection speed.
Data Source
AI summary
A computer system includes a data collector and an anomaly detector. The data collector monitors network traffic/event log and sends monitoring data to the anomaly detector. The anomaly detector extracts values for a category of measure from the monitoring data and processes the values to generate a processed value. The anomaly detector predicts an expectation value of the category of measure based at least on time decayed residual processed values. The anomaly detector determines a deviation of the processed value from the expectation value to detect an anomaly event, and applies a security rule to the anomaly event to detect a security event.