Correlation-Based Anomaly Detection for Malicious Network Connections
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional security services fail to effectively distinguish between malicious and benign network connections, often relying on ad-hoc rules based on human intuition rather than data-driven correlation, leading to high levels of false negatives and false positives.
Innovation Solution
Implementing correlation-based anomaly detection systems that monitor computing activity across multiple time periods, analyze telemetry data from various security products, and identify features indicative of malicious activity to differentiate between malicious and benign connections, thereby enabling precise security actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional security services use ad-hoc rules based on human intuition to detect malicious network connections, then the system is simple to implement, but the detection accuracy is low with high false positives and false negatives
Solution Approach 1:
The system collects telemetry data from multiple security products and uses it to train anomaly detection models that continuously improve detection accuracy. The models learn from historical data and provide feedback to refine detection rules, reducing false positives and negatives while maintaining manageable system complexity through automated learning processes.
Solution Approach 2:
The system integrates telemetry data from multiple different security products into a unified anomaly detection framework. By combining data sources and correlation techniques, the system creates a composite detection approach that achieves higher accuracy than individual products alone, while the modular architecture keeps implementation complexity manageable.
2Reliability
If correlation-based anomaly detection is implemented to distinguish malicious from benign connections, then false positives and negatives are reduced, but the computational resources and system complexity increase
Solution Approach 1:
The system segments the anomaly detection process into distinct modules: telemetry data collection from multiple security products, feature extraction and correlation analysis, model training, and detection execution. This segmentation allows each component to be optimized independently and managed separately, reducing overall system complexity while maintaining high detection reliability through comprehensive correlation analysis.
Solution Approach 2:
The system introduces anomaly detection models as intermediaries between raw telemetry data and security decisions. These models correlate features from multiple security products and translate complex multi-source data into reliable detection outcomes, reducing the complexity of direct analysis while improving detection reliability through learned patterns.
3Adaptability or versatility
If multiple security products are integrated for telemetry data collection, then detection coverage is improved, but integration complexity and data processing requirements increase
Solution Approach 1:
The system implements a universal telemetry data collection framework that can interface with multiple different security products through standardized methods. This multi-functional approach allows the same anomaly detection infrastructure to work with various security products, improving detection coverage across different security domains while reducing integration complexity through a unified data collection interface.
Data Source
AI summary
The disclosed computer-implemented method may include (i) monitoring computing activity, (ii) detecting, during a specific time period, at least one malicious network connection that involves a computing device within a network, (iii) determining that no malicious network connections involving the computing device were detected during another time period, (iv) identifying a feature of the computing activity that (a) occurred during the specific time period and (b) did not occur during the other time period, (v) determining that the feature is likely indicative of malicious network activity due at least in part to the feature having occurred during the specific time period and not having occurred during the other time period, and in response to detecting the feature at a subsequent point in time, (vi) performing a security action on a subsequent network connection attempted around the subsequent point in time. Various other methods, systems, and computer-readable media are also disclosed.