Network Anomaly Detection via Burst Graph Convolutional Neural Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network anomaly detection models are ineffective in capturing real-time traffic interactions on dynamic networks, particularly failing to distinguish between legitimate and malicious activities in complex attacks like Cross Site Scripting (XSS), often resulting in false positives.
Innovation Solution
A machine learning-based system utilizing a graph convolutional neural network to analyze network traffic patterns, determining burst scores for external and internal resources and creating a burst graph to identify anomalous traffic by comparing interaction patterns against a probability density function, without requiring prior knowledge of attack signatures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing detection models are used to identify network anomalies, then the system can detect some malicious traffic, but the models cannot capture real traffic interactions on dynamic networks resulting in poor performance on complex attacks and high false positives
Solution Approach 1:
The patent applies dynamics by transitioning from static signature-based detection to dynamic interaction pattern analysis. The system continuously learns and adapts to evolving traffic patterns through neural networks that process sequential traffic data, enabling the detection model to adapt to dynamic network environments and complex attacks like XSS that exhibit evolving behavioral patterns rather than fixed signatures.
Solution Approach 2:
The patent replaces traditional mechanical rule-based detection systems with neural network-based intelligent systems. Instead of relying on predefined rules and signatures that require manual updates, the system uses machine learning models that automatically learn detection patterns from traffic data, substituting the mechanical approach with an adaptive intelligent approach that reduces false positives while maintaining detection accuracy.
2Adaptability or versatility
If traditional detection methods are used, then the system operates with simple rules, but it cannot distinguish between legitimate and malicious activities in complex attacks
Solution Approach 1:
The patent introduces neural networks as intermediary components between raw traffic data and detection decisions. These neural networks serve as intelligent mediators that process complex traffic interactions, extract meaningful patterns, and generate detection outcomes. This intermediary layer enables the system to handle complex attacks like XSS by transforming raw traffic data into actionable insights without requiring explicit rules for every attack scenario.
Solution Approach 2:
The patent changes the detection parameters from simple signature matching to multi-dimensional interaction pattern analysis. The system analyzes multiple parameters simultaneously including traffic source, destination, timing patterns, data volume, and interaction sequences. This parameter transformation enables the system to detect complex attacks by evaluating multiple dimensions of traffic behavior rather than relying on single-parameter rule matching.
3Reliability
If signature-based detection is used, then the system can identify known threats, but it requires prior knowledge of attack signatures which limits detection of unknown attack types
Solution Approach 1:
The patent applies preliminary action by training neural networks on extensive traffic data before deployment to establish baseline interaction patterns. The system performs preliminary learning during a training phase where it ingests labeled traffic data and learns normal and malicious patterns. This preliminary action enables the system to detect both known and unknown threats by comparing actual traffic against learned baselines, rather than requiring explicit signatures for each threat type.
Solution Approach 2:
The patent implements self-service through automated machine learning models that continuously learn and update detection patterns without manual intervention. The neural networks automatically adapt to new attack types by learning from incoming traffic data, eliminating the need for manual signature updates. This self-service capability enables the system to detect unknown attack types by autonomously identifying new patterns in the traffic data.
Data Source
AI summary
Systems and methods for detecting network anomalies are described. These may include determining burst scores for external network resources, determining burst scores for internal network resources, and using the burst scores to construct a burst graph where the edges are weighted by the number of connections between each resource. The graph is then analyzed by a graph convolutional neural network to identify patterns from which anomalous network traffic can be detected and from which corrective action can be taken. These techniques can allow for better detection and mitigation of abusive network traffic, improve computer network security, and provide more robust access to networked computer resources.