Automatic Baseline Creation for Anomaly Detection in Time Series Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems management technologies rely on manual or generic rules to establish baselines for detecting anomalies in time series data, which is inefficient and requires human input, limiting their ability to detect anomalous activity without prior user intervention.
Innovation Solution
A method that automatically determines a baseline pattern for computing systems by using statistical thresholds, allowing for the detection of anomalous activity without user input, and includes an anti-gaming mechanism to prevent malicious activity by randomly determining the start time of monitoring periods.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Extent of automation
If manual or generic rules are used to establish baselines for anomaly detection, then human input is required to create baseline patterns, but this reduces automation efficiency and increases time consumption
Solution Approach 1:
The system automatically creates baseline patterns by analyzing historical time series data without requiring human intervention. The computer system serves itself by autonomously establishing what constitutes normal behavior patterns, eliminating the need for manual baseline creation while maintaining detection accuracy
Solution Approach 2:
The system performs preliminary analysis of historical data to establish baseline patterns before actual anomaly detection begins. By pre-processing and pre-establishing baseline behavior patterns from historical time series data, the system prepares detection frameworks in advance, reducing real-time processing requirements
2Reliability
If fixed monitoring periods are used for anomaly detection, then detection consistency is maintained, but attackers can exploit knowledge of these patterns to evade detection
Solution Approach 1:
The system dynamically adjusts monitoring period start times based on randomly determined offsets from baseline patterns. Instead of fixed periodic monitoring, the system varies the timing of monitoring windows while maintaining their duration and analytical rigor, preventing attackers from predicting when anomalies will be detected
Solution Approach 2:
The system changes the temporal parameters of monitoring by introducing random offsets to monitoring period start times. This parameter variation maintains the integrity of baseline comparisons while eliminating predictable patterns that attackers could exploit to time their malicious activities
3Measurement precision
If statistical thresholds are established for anomaly detection, then anomalous activity can be identified, but attackers may attempt to stay within these thresholds to avoid detection
Solution Approach 1:
The system dynamically varies the timing and duration of monitoring periods while maintaining statistical threshold integrity. By changing when measurements occur rather than altering the thresholds themselves, the system prevents attackers from optimizing their behavior to consistently stay within static threshold boundaries
Solution Approach 2:
The system employs periodic monitoring with randomly determined offsets from established baseline patterns. This periodic yet variable approach ensures comprehensive coverage of system behavior over time while preventing attackers from identifying and exploiting specific monitoring cycles or intervals
Data Source
AI summary
Software that automatically detects anomalous attributes indicative of a potential intrusion in a computing system. The software performs the following operations: (i) determining a baseline pattern for one or more attributes of a computing system, based on a first set of statistical thresholds determined for received values of the one or more attributes, wherein the received values correspond to one or more time periods, and on a second set of statistical thresholds determined for a first subset of values of the received values of the one or more attributes, wherein each value of the first subset exceeds the first set of statistical thresholds; and (ii) in response to identifying, based on the determined baseline pattern, anomalous values in monitored additional values of the one or more attributes, sending an alert to a user of the computing system indicating that a potential intrusion in the computing system has occurred.