Anomaly Explanation Framework for Web Applications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anomaly detection methods in network security struggle to provide timely and computationally efficient explanations for anomalous network traffic, often relying on costly computations and limited scopes, failing to adequately explain deviations from normal behavior to network administrators.
Innovation Solution
A system and method that combines univariate and multivariate policies, including statistical models and historical data tests, to characterize anomalous network traffic by selecting and generating anomaly explanations based on predefined rules and thresholds, ensuring timely and efficient reporting.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If sub-space partitioning is used to identify anomaly patterns in multivariate domain, then the scope of anomaly detection is improved, but the computational cost becomes prohibitively expensive
Solution Approach 1:
The patent segments the anomaly detection process into two distinct stages: univariate analysis (examining each feature independently against predefined rules and thresholds) and multivariate analysis (examining combinations of features). This segmentation allows the system to handle complex multivariate patterns while avoiding the computational expense of examining all possible feature combinations, as only anomalies detected in the univariate stage are further analyzed multivariately.
2Measurement precision
If comprehensive anomaly analysis is performed to provide precise explanations, then the precision of anomaly explanation is improved, but the timeliness of reporting deteriorates
Solution Approach 1:
The patent performs preliminary univariate analysis on all network traffic features using predefined rules and thresholds before conducting more comprehensive multivariate analysis. This preliminary action quickly filters out normal traffic and identifies potential anomalies, allowing the system to provide timely initial anomaly explanations while reserving computationally intensive multivariate analysis for cases where higher precision is needed and computational resources are available.
3Loss of information
If detailed anomaly characterization is performed to provide meaningful explanations, then the quality of anomaly explanation is improved, but the computational efficiency deteriorates
Solution Approach 1:
The patent applies different levels of analysis quality to different types of traffic and anomaly scenarios. Univariate rules with predefined thresholds provide quick, efficient anomaly detection for common patterns, while multivariate analysis provides more detailed and comprehensive explanations only when needed. This local quality approach ensures meaningful anomaly explanations are provided where necessary while maintaining high computational efficiency for the majority of traffic analysis.
Data Source
AI summary
The present disclosure is directed towards systems and methods for characterizing anomalous network traffic. The system includes a device intermediary to clients and servers. The device includes a network traffic engine to receive network traffic including an anomaly. The device includes a univariate policy manager to determine whether the network traffic satisfies at least one of the rules of a univariate policy based on a respective single independent network traffic feature. The device includes a multivariate policy manager to determine, responsive to determining that the network traffic does not satisfy the rules of the univariate policy, that the network satisfies a multivariate policy including a plurality of anomaly explanation tests. The device includes an anomaly explanation selector to select, responsive to determining that the network traffic satisfies the multivariate policy, an anomaly explanation. The device includes a message generator to generate an anomaly explanation output including the selected anomaly explanation.