Anomaly Flow Detection via Unsupervised IP Header Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anomaly detection methods in network traffic, such as DPI and flow-based features, face challenges in complexity and detection time due to the need to inspect packet payloads or wait for entire data streams, especially with encrypted packets and high data volumes.
Innovation Solution
Anomaly flow detection device and method using machine learning trained with packet IP header information to identify abnormal network flows by constructing a flow recognition model with unsupervised learning, preprocessing packet headers to extract feature vectors, and determining abnormality through an abnormal index.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If DPI inspects packet payloads to detect network abnormalities, then detection accuracy is improved, but detection time increases and privacy issues arise
Solution Approach 1:
The patent extracts only the IP header information from packet data for analysis, completely avoiding inspection of packet payloads. This extraction approach enables anomaly detection based solely on header features (source/destination IPs, ports, protocols) which are sufficient for detecting abnormal network flows without the time cost and privacy issues of payload inspection
Solution Approach 2:
The patent segments the packet data into two parts: IP header information (which is analyzed) and packet payload (which is ignored). This segmentation allows the system to focus computational resources only on the necessary header fields for anomaly detection, eliminating the need to process entire payloads and thus reducing detection time
2Measurement precision
If flow-based features collect large numbers of packets to calculate statistical features, then detection accuracy is improved, but complexity increases and detection time is dragged down
Solution Approach 1:
The patent applies partial action by analyzing only a subset of packet characteristics (IP header fields) rather than collecting all packet data for statistical analysis. This partial approach uses a limited set of features (source IP, destination IP, source port, destination port, protocol) that are sufficient for anomaly detection without requiring the complex statistical calculations that would need to process entire packet streams
Solution Approach 2:
The patent changes the parameters used for analysis from comprehensive packet data to specific IP header fields. By transforming the analysis focus from all packet contents to only header parameters, the system achieves anomaly detection with significantly reduced computational complexity and without requiring large packet collections for statistical feature calculation
3Measurement precision
If flow-based features waits for end of stream to compute statistical features, then detection accuracy is improved, but productivity decreases
Solution Approach 1:
The patent implements preliminary action by pre-defining abnormal flow patterns and thresholds before actual detection occurs. The system maintains a database of normal network behavior patterns and can immediately compare incoming packet data against these pre-established criteria, enabling real-time anomaly detection without waiting for stream completion
Solution Approach 2:
The patent replaces the mechanical approach of collecting and storing entire packet streams for later statistical analysis with a more efficient pattern-matching system. Instead of mechanically processing complete streams, the system uses predefined anomaly patterns to immediately identify abnormal flows, substituting complex post-processing with immediate pattern recognition
Data Source
AI summary
An anomaly flow detection device and an anomaly flow detection method thereof are provided. The device can retrieve a plurality of training data transmitted between a monitored network and an external network, preprocess a plurality of packet headers of the pluralities of training data to obtain a plurality of training feature vectors, construct a flow recognition model with an unsupervised learning method, input the pluralities of training feature vectors to the flow recognition model to train the flow recognition model, retrieve a plurality of testing data transmitted between the monitored network and the external network, preprocess a plurality of packet headers of the pluralities of testing data to obtain a plurality of testing feature vectors, input the pluralities of testing feature vectors to the flow recognition model to identify whether the pluralities of packet headers of the pluralities of testing data are normal or abnormal, and determine the flow of the monitored network is abnormal according to the recognition result of the flow recognition model.