Network Anomaly Explanation via Minimal Feature Mapping
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Intrusion detection systems face challenges in providing explanations for detected network anomalies due to their complex algorithms and multi-layered processing, making it difficult to determine the causes of suspicious patterns in network traffic without knowing the algorithms and rules employed.
Innovation Solution
A security analysis system generates explanations for network anomalies by identifying a minimal set of features that distinguish anomalies from normal traffic patterns, creating mappings between anomalies and features, and developing explanation rules to explain the causes of anomalies without relying on the IDS's algorithms or rules.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If intrusion detection systems use complex algorithms and multi-layered processing to detect anomalies, then anomaly detection capability is improved, but explanation generation becomes difficult
Solution Approach 1:
The patent segments the complex IDS system into multiple processing layers (feature extraction layer, anomaly detection layer, explanation generation layer). Each layer handles specific tasks independently, allowing the system to maintain high detection capability while simplifying explanation generation by focusing on minimal distinguishing features at each layer.
Solution Approach 2:
The patent introduces an intermediary explanation generation component that sits between the anomaly detection system and the user. This intermediary translates complex detection results into human-readable explanations by identifying minimal feature sets that distinguish anomalies, without requiring users to understand the underlying complex algorithms.
2Ease of operation
If intrusion detection systems evaluate individual features to identify suspicious patterns, then feature analysis simplicity is improved, but detection accuracy deteriorates
Solution Approach 1:
The patent merges individual feature evaluations with combination analysis by automatically identifying and evaluating feature combinations that distinguish suspicious patterns. The system starts with individual feature analysis for simplicity, then combines features when needed to achieve accurate detection, balancing both simplicity and precision.
3Reliability
If intrusion detection systems use multiple processing layers with multiple anomaly detectors, then detection comprehensiveness is improved, but output analysis difficulty increases
Solution Approach 1:
The patent extracts only the essential and minimal features from each processing layer's output that are necessary for generating explanations. Instead of analyzing all outputs from multiple detectors and layers, the system identifies and extracts the minimal distinguishing feature sets, significantly reducing output analysis difficulty while maintaining detection comprehensiveness.
Data Source
AI summary
In an embodiment, the method comprises receiving network performance data for a computer network; receiving, from an intrusion detection system, network anomaly data indicating a plurality of anomalies that have occurred in the computer network; based, at least in part, on the network performance data and the network anomaly data, generating feature data; for each anomaly of the plurality of anomalies, using the feature data to determine a minimal set of features that distinguishes the anomaly from non-anomalies in the plurality of anomalies, and creating a mapping of the anomaly to the minimal set of features; based at least in part on the mapping, generating explanation rules for the plurality of anomalies; for a particular anomaly, identifying a particular rule of the explanation rules that is associated with the particular anomaly, and generating explanation data for the particular anomaly based upon the particular rule.