Anomaly Graph for Coordinated Network Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network anomaly detection systems fail to effectively identify coordinated group attacks on internal computer networks, particularly those involving multiple attackers, as they do not account for overlap in connectivity and behavior, leading to missed detections and increased false positives.
Innovation Solution
A computer-implemented method and system that generates an anomaly graph to identify nodes with no incoming connections and common connections, designating them as potentially compromised, and detecting coordinated attacks by monitoring network behavior over time to identify overlapping or correlated activity among these nodes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional intrusion detection systems monitor network traffic using traditional methods, then they can detect single-attacker threats, but they fail to detect coordinated group attacks involving multiple attackers
Solution Approach 1:
The patent combines multiple independent intrusion detection systems into a collaborative network that shares alerts and correlates information across different networks. This merging enables the detection of coordinated attacks by aggregating data from multiple sources, allowing the system to identify patterns that single systems would miss.
Solution Approach 2:
The patent introduces an intermediary correlation system that receives alerts from multiple intrusion detection systems, processes them through statistical tests, and generates coordinated attack detections. This intermediary layer enables information sharing and correlation without requiring direct integration between all detection systems.
2Measurement precision
If alert correlation systems use statistical tests to cluster alerts from multiple intrusion detection systems, then they can reduce false positives, but they do not specifically look for overlap in connectivity patterns
Solution Approach 1:
The patent adds a new dimension of analysis by examining connectivity patterns and network relationships in addition to temporal and statistical characteristics of alerts. This multi-dimensional approach enables the system to detect coordinated attacks by identifying overlapping connectivity patterns that statistical tests alone would miss.
3Reliability
If edge-based monitoring is used to detect hosts sharing similar external connections, then it can identify botnets, but it cannot detect coordinated attacks on internal networks
Solution Approach 1:
The patent creates a universal detection framework that can identify both external botnets and internal coordinated attacks by analyzing connectivity patterns across different network boundaries. The system adapts to detect various attack types by examining relationships between hosts and their connections, whether internal or external.
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
Systems, apparatuses, methods, and computer programs for detecting anomalies to identify coordinated group attacks on computer networks are provided. An anomaly graph of a network including nodes, edges, and an indegree of the nodes in the anomaly graph may be determined. Nodes with an indegree of at least two may be designated as potential targets. Nodes with no incoming connections may be designated as potentially compromised nodes. The designated potentially compromised nodes may be outputted as potentially associated with a coordinated attack on the network when the potentially compromised nodes connect to one or more of the same potential target nodes.