Data Aggregation Apparatus for Suspicious Activity Identification

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

It is unclear which data aggregation method is appropriate for identifying suspicious activities in communication data, as different methods produce varying results, making it difficult to grasp their characteristics and efficiently narrow down candidate data for in-packet analysis.

Innovation Solution

A data aggregation apparatus and method that allows users to select from multiple data aggregation methods to perform data aggregation based on user operation, displaying aggregated values to facilitate the identification of suspicious activities by narrowing down candidate data for in-packet analysis.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If multiple data aggregation methods are provided to narrow down candidate data, then the ability to identify suspicious activities improves, but it becomes difficult to determine which method is appropriate and grasp their characteristics

Engineering Contradiction:

Improveidentification accuracy of suspicious activitiesVSAvoidcomplexity of selecting appropriate aggregation method

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The system changes the parameter of aggregation method selection by allowing users to specify different aggregation methods (e.g., aggregation by time, aggregation by source IP, aggregation by destination IP) rather than using a fixed method. This enables flexible adaptation to different analysis needs while maintaining clarity through structured parameter specification.

Inventive Principle:

Principle #35Parameter changes

Solution Approach 2:

The system makes the aggregation method dynamic by allowing users to select and switch between different aggregation methods based on their specific analysis requirements. The aggregation method is not fixed but can be changed according to the situation, enabling the system to adapt to various suspicious activity detection scenarios.

Inventive Principle:

Principle #15Dynamics

2Measurement precision

If micro analysis is performed on all packets to judge whether communication relates to an attack, then detection accuracy improves, but the time required becomes enormous and is not realistic

Engineering Contradiction:

Improvedetection accuracy of malicious communicationVSAvoidtime required for analyzing all packets

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The system segments the analysis process into two stages: first, data aggregation to narrow down candidate packets using macro-level statistics; second, micro analysis applied only to the narrowed-down candidates. This segmentation reduces the total number of packets requiring detailed analysis while maintaining detection accuracy for suspicious activities.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Instead of performing micro analysis on all packets (excessive action), the system performs micro analysis only on a partial subset of packets that are identified as candidates through data aggregation. This partial action approach maintains sufficient detection accuracy while dramatically reducing the time and computational resources required.

Inventive Principle:

Principle #16Partial or excessive action

3Productivity

If data aggregation is performed using a predetermined aggregation policy, then the range for micro analysis is narrowed down, but it is unclear which aggregation method is appropriate for finding suspicious activities

Engineering Contradiction:

Improveefficiency of narrowing down candidate dataVSAvoidflexibility in selecting aggregation method

Core Design Contradiction:

ProductivityVSAdaptability or versatility

Solution Approach 1:

The system implements multi-functionality by supporting multiple aggregation methods (aggregation by time, by source IP, by destination IP, etc.) within a single data aggregation apparatus. Each aggregation method serves different analysis needs, making the system versatile and adaptable to various suspicious activity detection scenarios while maintaining efficient candidate narrowing.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS12192219B2Data aggregation apparatus, data aggregation method, and program

Publication Date: 2025.01.07 NEC CORP

AI summary

In order to perform data aggregation using an appropriate data aggregation method among a plurality of data aggregation methods used to narrow down candidate data for in-packet analysis from communication data, a data aggregation apparatus 100 includes: an obtaining unit 101 configured to obtain communication data via a communication network; a selecting unit 103 configured to select one or more first data aggregation methods based on user operation, from a plurality of data aggregation methods used to narrow down candidate data for in-packet analysis from the communication data; an aggregating unit 107 configured to perform data aggregation of the communication data, based on the one or more first data aggregation methods; and a display processing unit 109 configured to display, on a screen, an aggregated value related to the data aggregation.