Anomaly Graph for Coordinated Network Attack Detection

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current network anomaly detection systems fail to effectively identify coordinated group attacks on internal computer networks, particularly those involving multiple attackers, as they do not account for overlap in connectivity and behavior, leading to missed detections and increased false positives.

Innovation Solution

A computer-implemented method and system that generates an anomaly graph to identify nodes with no incoming connections and common connections, designating them as potentially compromised, and detecting coordinated attacks by monitoring network behavior over time to identify overlapping or correlated activity among these nodes.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If conventional intrusion detection systems monitor network traffic using traditional methods, then they can detect single-attacker threats, but they fail to detect coordinated group attacks involving multiple attackers

Engineering Contradiction:
Improvedetection accuracyVSAvoidability to detect coordinated attacks
Core Design Contradiction:
ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent combines multiple independent intrusion detection systems into a collaborative network that shares alerts and correlates information across different networks. This merging enables the detection of coordinated attacks by aggregating data from multiple sources, allowing the system to identify patterns that single systems would miss.

Inventive Principle:
Principle #5Merging (Combining)

Solution Approach 2:

The patent introduces an intermediary correlation system that receives alerts from multiple intrusion detection systems, processes them through statistical tests, and generates coordinated attack detections. This intermediary layer enables information sharing and correlation without requiring direct integration between all detection systems.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Measurement precision

If alert correlation systems use statistical tests to cluster alerts from multiple intrusion detection systems, then they can reduce false positives, but they do not specifically look for overlap in connectivity patterns

Engineering Contradiction:
Improvefalse positive reductionVSAvoidconnectivity overlap detection
Core Design Contradiction:
Measurement precisionVSDifficulty of detecting and measuring

Solution Approach 1:

The patent adds a new dimension of analysis by examining connectivity patterns and network relationships in addition to temporal and statistical characteristics of alerts. This multi-dimensional approach enables the system to detect coordinated attacks by identifying overlapping connectivity patterns that statistical tests alone would miss.

Inventive Principle:
Principle #17Another dimension (Dimensionality change)

3Reliability

If edge-based monitoring is used to detect hosts sharing similar external connections, then it can identify botnets, but it cannot detect coordinated attacks on internal networks

Engineering Contradiction:
Improvebotnet detectionVSAvoidinternal network attack detection
Core Design Contradiction:
ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent creates a universal detection framework that can identify both external botnets and internal coordinated attacks by analyzing connectivity patterns across different network boundaries. The system adapts to detect various attack types by examining relationships between hosts and their connections, whether internal or external.

Inventive Principle:
Principle #6Universality (Multi-functionality)

Data Source

PatentEP2828753B1Anomaly detection to identify coordinated group attacks in computer networks
Publication Date: 2019.05.08 IP2IPO INNOVATIONS LTD
  • EP2828753B1 patent drawingFigure 1A
  • EP2828753B1 patent drawingFigure 1B
  • EP2828753B1 patent drawingFigure 2

AI summary

Systems, apparatuses, methods, and computer programs for detecting anomalies to identify coordinated group attacks on computer networks are provided. An anomaly graph of a network including nodes, edges, and an indegree of the nodes in the anomaly graph may be determined. Nodes with an indegree of at least two may be designated as potential targets. Nodes with no incoming connections may be designated as potentially compromised nodes. The designated potentially compromised nodes may be outputted as potentially associated with a coordinated attack on the network when the potentially compromised nodes connect to one or more of the same potential target nodes.