Diffusion-Based Network Anomaly Detection With Explainable Scoring

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current intrusion detection systems (IDS) face challenges in accurately detecting network anomalies while providing explainability, leading to high false positives and negatives, and inefficient resource utilization due to rule-based and machine learning approaches.

Innovation Solution

A modified denoising diffusion probabilistic model (DDPM) combined with a multilayer perceptron and an outlier detection algorithm is used to analyze network traffic events, adding noise to reconstruct data and score anomalies, providing explainable results through normalized losses and feature distance analysis.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If rule-based intrusion detection systems are used, then detection coverage is improved, but false positive and false negative rates increase

Engineering Contradiction:

Improveanomaly detection accuracyVSAvoidfalse positive and false negative rates

Core Design Contradiction:

ReliabilityVSMeasurement precision

Solution Approach 1:

The patent replaces rule-based detection mechanisms with machine learning models that automatically learn patterns from data. The system uses trained models to predict normal behavior and identify anomalies, substituting manual rule creation with automated statistical learning, thereby reducing false positives and negatives while maintaining detection coverage

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The patent transforms the detection approach by changing from fixed rule parameters to dynamic statistical parameters learned from training data. The system adjusts detection thresholds and patterns based on learned behavior distributions, enabling adaptive detection that reduces false indications while maintaining reliability

Inventive Principle:

Principle #35Parameter changes

2Reliability

If complex machine learning models are used for anomaly detection, then detection accuracy is improved, but explainability decreases

Engineering Contradiction:

Improveanomaly detection accuracyVSAvoidexplainability for security analysts

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The patent introduces interpretable intermediaries between the complex machine learning models and security analysts. The system provides feature importance scores, anomaly probability distributions, and behavioral pattern explanations that bridge the gap between complex model outputs and human-understandable security insights, maintaining both accuracy and explainability

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS12627691B2Automated detection of computing system and network activity anomalies using denoising diffusion probabilistic models

Publication Date: 2026.05.12 MOTOROLA SOLUTIONS INC

AI summary

Systems and methods for detecting security anomalies in a computing environment. One example system includes an electronic processor configured to receive, via the communication interface, security data for the computing environment and parse the security data to extract a feature set. The electronic processor is configured to apply noise to the feature set to produce a noised feature set and to produce a reduced noise feature set by processing the noised feature set using a neural network trained to remove noise. The electronic processor is configured to compare the reduced noise feature set to the feature set to determine a success score, select a threshold based on the security data, and determine whether the success score exceeds the threshold. The electronic processor is configured to, responsive to determining that the success score does not exceed the threshold, generate a security event based on the security data.