Anomaly Graphs Aggregate Network Traffic Records
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Anomaly detection systems in computer networks generate a large number of anomalous records during network attacks or events, making it cumbersome for users to assess and identify meaningful anomalies from the data.
Innovation Solution
A device in the network uses anomaly graphs to match and order traffic records, aggregating them into consistent anomaly messages by representing hosts as vertices and communications as edges, applying specific ordering rules to associate each record with an anomaly and sending notifications based on these associations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If anomaly detection systems collect and analyze traffic records at different granularities, then detection accuracy is improved, but the quantity of records increases making assessment cumbersome
Solution Approach 1:
The patent merges multiple anomalous traffic records into consolidated anomaly messages by identifying common characteristics and grouping related records. This aggregation process combines individual record details into unified messages that represent clusters of similar anomalies, reducing the total number of records while preserving detection accuracy through maintained characteristic analysis.
Solution Approach 2:
The patent segments the large set of anomaly records into meaningful groups based on shared characteristics such as source/destination hosts, anomaly types, and temporal patterns. By dividing the comprehensive record set into segmented categories, the system maintains detailed detection capabilities while organizing records into manageable segments for assessment.
2Reliability
If detailed traffic records are generated for each anomaly, then detection completeness is improved, but ease of operation deteriorates due to cumbersome assessment
Solution Approach 1:
The patent introduces anomaly messages as intermediary representations between detailed traffic records and user assessment. These messages serve as mediators that condense complex record information into standardized formats with key characteristics highlighted, making the data more accessible and easier to evaluate while maintaining complete anomaly detection coverage.
Solution Approach 2:
Instead of presenting raw detailed records directly to users, the patent inverts the presentation approach by generating summarized anomaly messages that contain essential information in a user-friendly format. This inversion transforms the data presentation from detailed-and-complex to condensed-and-accessible while preserving detection completeness.
3Loss of information
If multiple anomaly records are reported individually, then information completeness is improved, but bandwidth requirements increase
Solution Approach 1:
The patent merges multiple individual anomaly records into consolidated anomaly messages that convey the same information complete set in fewer transmissions. By combining records with similar characteristics into single messages, the system maintains information completeness while significantly reducing the total number of data transmissions required.
Data Source
AI summary
In one embodiment, a device in a network identifies a plurality of traffic records as anomalous. The device matches each of the plurality of traffic records to one or more anomalies using one or more anomaly graphs. A particular anomaly graph represents hosts in the network as vertices in the graph and communications between hosts as edges in the graph. The device applies one or more ordering rules to the traffic records, to uniquely associate each traffic record to an anomaly in the one or more anomalies. The device sends an anomaly notification for a particular anomaly that is based on the traffic records associated with the particular anomaly.