Communication Amount Predictor for Network Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for predicting communication amounts in networks face challenges when the number of devices increases, as they assume no communication between new devices, leading to inaccurate predictions and longer learning periods for anomaly detection models.
Innovation Solution
An information processing apparatus that predicts communication amounts in a second environment by acquiring relation data from first environments with varying device numbers, using a communication amount predictor to adjust packet numbers based on function types and device configurations, allowing for accurate prediction and anomaly detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If the number of devices in the target network increases, then the communication amount between devices may increase, but the existing prediction method assumes no communication between new devices, leading to prediction inaccuracy
Solution Approach 1:
The patent segments the communication amount into two distinct components: communication involving increased devices and communication between existing devices. This segmentation allows the prediction method to separately calculate and sum these components, thereby accurately capturing the increased communication between existing devices that was previously overlooked.
Solution Approach 2:
The patent introduces a new dimensional consideration by adding the communication amount between existing devices as a separate calculation dimension. Instead of only predicting communication involving new devices, the method now operates in an expanded dimension that includes both new device communications and enhanced communications between existing devices, enabling accurate prediction even as device numbers increase.
2Loss of time
If data is collected less frequently, then data collection time is reduced, but the learning period becomes longer
Solution Approach 1:
The patent performs preliminary action by pre-calculating the communication amount between existing devices based on historical patterns and device characteristics. This preliminary calculation is done before the actual learning process, allowing the system to start with more accurate initial data and reduce the overall learning period without requiring frequent data collection.
Solution Approach 2:
The patent uses copying by replicating communication patterns from existing devices to predict communications in the expanded network. Instead of collecting actual data from every new device configuration, the method copies and adapts established communication patterns, reducing data collection requirements while maintaining prediction accuracy.
Data Source
AI summary
According to one embodiment, an information processing apparatus includes a communication amount predictor. The communication amount predictor acquires relation data in which a variation of a communication amount in a first environment including first devices of a plurality of function types is associated with a varied number of the first devices for each of the plurality of function types in a case where a number of first devices for each of the plurality of function types varies in the first environment. The communication amount predictor predicts a communication amount in a second environment including second devices of the plurality of function types on a basis of the relation data and a number of the second devices for each of the plurality of function types in the second environment.