AnomalyLookup Framework Reducing False Positives in Network Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anomaly detection methods in computer networks often result in high false positive rates, leading to alert fatigue and inefficiencies in identifying actual security threats, especially in large-scale systems where the volume of data and complexity of attacks overwhelm traditional detection methods.
Innovation Solution
The AnomalyLookup (AL) framework focuses on investigating alerts by applying anomaly detection algorithms to specific entities within a defined time window, reducing false positives by filtering out non-malicious anomalies and identifying patterns indicative of malicious behavior, thereby streamlining the investigation process and improving detection accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional anomaly detection methods are used to monitor network security, then coverage of security threats is improved, but false positive rate increases leading to alert fatigue
Solution Approach 1:
The patent segments the anomaly detection process into two distinct phases: (1) a screening phase using statistical methods to identify potential anomalies, and (2) an investigation phase using the AnomalyLookup framework to verify suspicious entities. This segmentation allows broad coverage in the first phase while applying precise verification in the second phase, thereby reducing false positives while maintaining high detection coverage.
Solution Approach 2:
The patent introduces an intermediary verification mechanism between initial anomaly detection and final threat confirmation. The AnomalyLookup framework acts as this intermediary by performing targeted investigations on entities associated with alerts, using techniques such as entity resolution and pattern matching to filter out false positives before they reach the final detection stage.
2Measurement precision
If comprehensive anomaly detection is applied to all data sources, then detection accuracy is improved, but investigation time and resources increase
Solution Approach 1:
The patent applies local quality by concentrating detailed investigation resources only on localities (specific entities) that are associated with alerts, rather than uniformly investigating all data sources. The AnomalyLookup framework identifies and focuses computational resources on suspicious IPs, users, or processes mentioned in alerts, applying sophisticated analysis only where needed while skipping clean entities.
Solution Approach 2:
The patent implements partial action by performing comprehensive anomaly detection only on a subset of data sources that are relevant to specific alerts, rather than exhaustively analyzing all available data. The system selectively applies investigation techniques to entities that appear in alert contexts, thereby achieving high detection accuracy for critical cases while minimizing overall investigation time and resource consumption.
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
An indication of a security alert and a context for the security alert is received. The context includes one or more entities related to the context and a timestamp for the security alert. Data sources for the one or more entities are searched during a time window around the timestamp. One or more anomaly detection models are executed to identify anomalies that are related to the security alert based on the context. Identified anomalies for investigation of the security alert are output.