Network Anomaly Detection from Data Store Changes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network analysis components (NACs) rely heavily on Time Series Database Data (TSDBD) for network event analysis, which consumes significant memory and compute power, making large-scale deployment challenging due to resource requirements.
Innovation Solution
Perform analytics on centralized network data stores like Open vSwitch Database (OVSDB) to detect anomalies, reducing reliance on TSDBD and minimizing memory/compute power needs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Time Series Database Data (TSDBD) is used for network event analysis, then network anomaly detection capability is improved, but memory and compute power consumption increases significantly
Solution Approach 1:
The patent extracts only the essential change information from the data store (insertions, deletions, updates) rather than processing entire time series datasets. This selective extraction of critical data elements reduces the volume of data requiring memory storage and computational analysis while preserving the ability to detect network anomalies through monitoring data store state changes.
Solution Approach 2:
The system performs preliminary monitoring and detection of data store changes at the source before generating comprehensive time series data. By detecting anomalies through change monitoring in advance, the system avoids the need to store and process large volumes of TSDBD, thereby reducing memory and compute power requirements while maintaining detection effectiveness.
2Reliability
If Time Series Database Data (TSDBD) is used for network event analysis, then network anomaly detection capability is improved, but resource requirements make large-scale deployment challenging
Solution Approach 1:
The patent extracts only the essential change information from the data store (insertions, deletions, updates) rather than processing entire time series datasets. This selective extraction of critical data elements reduces the volume of data requiring memory storage and computational analysis while preserving the ability to detect network anomalies through monitoring data store state changes.
Solution Approach 2:
The system leverages the existing data store infrastructure to monitor its own changes, eliminating the need for separate, resource-intensive TSDBD storage and processing systems. By using the data store's native change tracking capabilities, the system achieves anomaly detection with minimal additional resources, enabling large-scale deployment.
3Use of energy by moving object
If analytics are performed on centralized network data stores, then memory and compute power requirements are reduced, but reliance on data store change monitoring increases
Solution Approach 1:
The system uses the data store's native change monitoring functionality to serve multiple purposes: both data persistence and anomaly detection. This multi-functionality eliminates the need for separate monitoring infrastructure, reducing overall system complexity despite the increased reliance on data store change tracking capabilities.
Data Source
AI summary
Systems and methods are provided for collecting data related to changes to a data store table, which may be used for analyzing problems that occur in the network. The information monitored may include types of changes made to a data store/table, such as insertions and deletions of data store elements. When an anomaly occurs in the statistical data store/table data, an alert is issued. This statistical data of the types of changes to a data store may be suggestive of similar changes in a network. For example, the uptime, inactive time, and stable time of rows of a data store table may be used for estimating or inferring the uptime, inactive time, and stable time for nodes, data paths, or other elements of a network. The system may include a web UI or a command line interface, which may aid in diagnosing problems in the network, and taking corrective action.