Bidirectional RNN for Low-Frequency Abnormal Traffic Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting abnormal network traffic patterns, such as white list rules and unidirectional recurrent neural networks, face challenges in accurately identifying low-frequency abnormal traffic and suffer from high false positive rates due to temporary network failures.
Innovation Solution
A bidirectional recurrent neural network (BRNN) is used to learn network traffic patterns, transforming extracted field data into reduced-dimensional vectors for training a traffic prediction model that predicts abnormal traffic and outputs warnings based on threshold comparisons.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If a white list rule is used to detect abnormal network traffic, then the detection method is simple and easy to implement, but the false positive rate becomes high when temporary network failures occur and the detection stops after abnormal traffic is detected
Solution Approach 1:
The detection system is divided into multiple independent components: a pattern learning module that learns normal traffic patterns, a pattern matching module that compares new traffic against learned patterns, and a anomaly detection module that identifies deviations. This segmentation allows each component to specialize in one function, improving overall reliability while maintaining implementation simplicity.
Solution Approach 2:
The system performs preliminary learning of normal traffic patterns before actual anomaly detection begins. By pre-establishing a baseline of normal behavior through the pattern learning module, the system can quickly and reliably detect deviations without requiring complex real-time analysis, thus improving detection reliability while keeping the implementation straightforward.
2Duration of action of stationary object
If a unidirectional recurrent neural network is used to detect abnormal traffic, then the system can continuously detect traffic patterns, but it is difficult to accurately predict very rarely observed traffic patterns
Solution Approach 1:
Instead of using a unidirectional RNN that processes traffic sequences in one direction (past to future), the patent employs a bidirectional RNN that processes sequences in both forward and backward directions. This allows the model to leverage future context information along with past information, significantly improving the accuracy of predicting rare traffic patterns while maintaining continuous detection capability.
Solution Approach 2:
The bidirectional RNN adds a temporal dimension by processing sequences in both forward and backward time directions, effectively creating a two-dimensional view of traffic patterns. This dimensional enhancement allows the model to capture rare patterns more accurately by considering contextual information from both past and future traffic flows.
3Productivity
If the white list rule detects abnormal traffic, then the detection process stops, but this prevents continuous monitoring and accurate detection of subsequent low frequency abnormal traffic
Solution Approach 1:
The detection system operates continuously without stopping when abnormal traffic is detected. The bidirectional RNN processes traffic sequences in real-time, maintaining continuous monitoring of network traffic patterns. This ensures that both high-frequency and low-frequency abnormal traffic patterns can be detected reliably over time, while the efficient pattern matching keeps productivity high.
Data Source
AI summary
An operating method of a computing device operated by at least one processor includes collecting traffic packets; extracting particular field data from the traffic packets, transforming the extracted particular field data to a vector with a reduced dimension for each traffic packet, and creating training data with the vector for each traffic packet; training a traffic prediction model with the training data, the traffic prediction model predicting from an input traffic packet a next input traffic packet and whether the next input traffic packet is abnormal; and predicting with the trained traffic prediction model a frequency of abnormal traffic packets to be input, and outputting an abnormal traffic warning by comparing the predicted frequency and a threshold.