BLSTM Anomaly Detection in Computer Operation Sequences
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computer systems compromised by attackers often exhibit anomalous sequences of operations that are difficult to detect within legitimate workflows, as existing methods fail to effectively distinguish between normal and anomalous operation sequences.
Innovation Solution
A method utilizing a bidirectional long short-term memory recurrent neural network (BLSTM) to determine probabilities of consecutive computer-executed operations, identifying reference sequences based on predefined thresholds for forward and backward execution probabilities, and designating anomalous sequences for security actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional detection methods are used to identify anomalous sequences, then the system can detect some malicious activities, but the detection precision is insufficient and cannot effectively distinguish between normal and anomalous operation sequences within legitimate workflows
Solution Approach 1:
The patent replaces traditional mechanical detection methods with a neural network-based system. Specifically, it employs bidirectional long short-term memory (LSTM) networks to analyze sequences of computer operations, substituting rule-based or statistical detection mechanisms with deep learning models that can capture complex temporal dependencies and distinguish anomalous sequences with higher precision
Solution Approach 2:
The patent changes the parameters used for detection by incorporating bidirectional probability assessments. Instead of using single-directional sequence analysis, the system calculates forward probabilities (Pforward) and backward probabilities (Pbackward) for each operation sequence, and uses threshold comparisons on these probability parameters to identify anomalous sequences, thereby improving detection precision
2Measurement precision
If a bidirectional LSTM network is trained to determine probabilities of consecutive operations, then the detection precision improves, but the computational complexity and processing time increase
Solution Approach 1:
The patent segments the sequence analysis into two independent directional passes: forward analysis computing Pforward probabilities and backward analysis computing Pbackward probabilities. This segmentation allows the complex bidirectional LSTM computation to be divided into manageable stages, processing sequences in forward direction (t-1, t-2, ..., t-n) and backward direction separately, then combining results for final anomaly detection
Solution Approach 2:
The patent applies partial action by using threshold-based filtering to identify only the most probable anomalous sequences. Instead of analyzing all possible sequences with equal depth, the system focuses computational resources on sequences that meet specific probability threshold criteria (comparing Pforward and Pbackward against predefined thresholds), thereby reducing overall computational burden while maintaining detection precision
3Reliability
If real-time detection of anomalous sequences is implemented, then security response time improves, but the processing speed and system performance may be degraded
Solution Approach 1:
The patent implements preliminary action by pre-training the bidirectional LSTM network on extensive training data consisting of normal and anomalous operation sequences before deployment. The model learns to recognize patterns and compute probability distributions in advance, so that during real-time operation, it can quickly evaluate new sequences by comparing them against pre-learned probability thresholds without requiring complex runtime training or reanalysis
Solution Approach 2:
The system implements feedback mechanisms where detection results (anomalous vs. normal classifications) are fed back into the system for continuous monitoring and potential model retraining. The bidirectional probability assessment provides feedback signals that help refine the anomaly detection thresholds and improve the model's ability to distinguish malicious activities while maintaining system performance
Data Source
AI summary
Detecting sequences of computer-executed operations, including training a BLSTM to determine forward and backward probabilities of encountering each computer-executed operations within a training set of consecutive computer-executed operations in forward and backward execution directions of the operations, and identifying reference sequences of operations within the training set where for each given one of the sequences the forward probability of encountering a first computer-executed operation in the given sequence is below a predefined lower threshold, the forward probability of encountering a last computer-executed operation in the given sequence is above a predefined upper threshold, the backward probability of encountering the last computer-executed operation in the given sequence is below the predefined lower threshold, and the backward probability of encountering the first computer-executed operation in the given sequence is above the predefined upper threshold, and where the predefined lower threshold is below the predefined upper threshold.