Anomaly Detection in Network Communications Using Bayesian Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network-security monitoring platforms (NSMPs) face challenges in detecting anomalies in single communications within a computer network, as they often rely on aggregate features and models that fail to identify specific anomalous connections, and are not designed to learn individual behavior patterns of sources and devices.
Innovation Solution
A method and system that utilize Bayesian networks to analyze metadata from communications, generating feature sets for sources and devices, and classify connections as anomalous based on likelihood thresholds, with support from SVM classifiers to verify classifications, allowing for the identification of anomalous behavior in individual connections.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If aggregate features and models are used for anomaly detection, then computational complexity is reduced, but the ability to detect specific anomalous connections is lost
Solution Approach 1:
The patent segments the anomaly detection process into two distinct phases: an offline training phase where Bayesian networks are constructed from historical data, and an online detection phase where pre-compiled feature templates are applied to new connections. This segmentation allows complex statistical modeling to be performed only once offline, while online detection uses simplified template matching, thus reducing computational complexity during runtime while maintaining the ability to detect specific anomalous connections through connection-specific feature analysis.
2Measurement precision
If connection-specific features are analyzed, then anomaly detection accuracy is improved, but the system complexity increases
Solution Approach 1:
The patent performs preliminary action by pre-compiling feature templates during an offline training phase. Connection-specific features and their statistical characteristics are analyzed and stored as templates before actual anomaly detection begins. During online operation, the system only needs to match new connections against these pre-computed templates rather than performing complex statistical analysis in real-time, thus achieving high detection accuracy without proportionally increasing system complexity.
3Measurement precision
If individual behavior patterns are learned for each source, then anomaly detection precision is improved, but data processing time increases
Solution Approach 1:
The patent implements periodic action by separating data processing into periodic offline training sessions and rapid online detection operations. During periodic offline training, the system learns individual behavior patterns for each source and constructs Bayesian networks or compiles feature templates. Between these periodic training sessions, the system performs rapid anomaly detection using the pre-learned models, thus achieving both high precision in pattern recognition and minimal data processing time for actual anomaly detection.
Data Source
AI summary
Techniques for detecting anomalies in communication networks are provided. Bayesian networks (first and second) are trained for each feature in first and second lists of features. Third and fourth lists of features are generated and then the first and second Bayesian networks are used to classify each value of the third list of features and of the fourth list of features, respectively, as normal or anomalous. In some examples, a Support Vector Machine can be used for the classification.