Deep Learning Abnormal Behavior Analysis via Data Imaging
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for analyzing abnormal behavior in systems fail to utilize past information of time-series data and perform comprehensive multivariate analysis of multi-channel signals, especially when protocol areas with unpublicized specifications are involved.
Innovation Solution
Converting multi-channel packet data into image data, either grayscale or Fourier-transformed, and using a deep learning-based neural network for classification and prediction, allowing for the analysis of encrypted data and utilization of temporal data sequences.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If statistical machine learning techniques are used for analyzing abnormal behavior, then analysis can be performed on system data, but comprehensive multivariate analysis and prediction of multi-channel signals is impossible
Solution Approach 1:
The patent introduces image data as an intermediary representation that bridges the gap between encrypted multi-channel packet data and deep learning analysis. The data processing unit converts encrypted protocols into image formats (grayscale or color images), which then serve as input for the neural network. This intermediary transformation enables comprehensive multivariate analysis without requiring decryption of the original protocols.
Solution Approach 2:
The patent applies parameter changes by transforming the data representation format from multi-channel packet data to image data with different parameters (pixels, color channels, intensity values). This parameter transformation allows the neural network to process encrypted protocols using image recognition algorithms, achieving comprehensive analysis capability that was impossible with traditional statistical methods.
2Measurement precision
If row-wise clustering with K-NN method is used, then multi-channel static analysis is possible, but past information of time-series data cannot be utilized
Solution Approach 1:
The patent applies dimensionality change by converting time-series multi-channel data into a two-dimensional image representation. The temporal dimension and multiple channels are transformed into spatial dimensions (x, y coordinates) and color channels respectively. This allows the neural network to simultaneously analyze multi-channel relationships and temporal patterns in a single comprehensive image analysis operation.
3Loss of information
If column-wise long short term memory (LSTM) anomaly detection is used, then past information can be utilized in the analysis, but comprehensive multivariate analysis and prediction are impossible
Solution Approach 1:
The patent merges the advantages of both K-NN clustering and LSTM approaches by combining multi-channel static analysis capability with temporal sequence analysis into a unified deep learning framework. The neural network simultaneously processes multiple channels and temporal patterns through image data, achieving comprehensive multivariate analysis and prediction that neither method could achieve alone.
Data Source
AI summary
Disclosed is a method of analyzing abnormal behavior by using data imaging, including: receiving data to be analyzed as an input, wherein the data to be analyzed is related to a state of a system to be analyzed; converting the inputted data to be analyzed into image data; training a neural network unit with the converted image data as an input; and detecting or predicting abnormal behavior in the system to be analyzed, at the neural network unit, which has received the image data converted from the data to be analyzed as the input and completed training.