Digital Linear Recursive Filter for Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security systems face challenges in dynamically adapting to the ever-changing patterns of computer network traffic, making it difficult to effectively detect anomalous activity due to their reliance on static rules or limited statistical learning capabilities.
Innovation Solution
A method utilizing a digital linear recursive filter that combines and filters statistical data based on cyclical functions and a decay function, allowing for the estimation of user interaction statistics and identification of anomalous activity by tracking user interactions over sampling intervals, incorporating daily and weekly cyclical patterns and a half-life time constant.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If rule-based systems with extensive signatures and security rules are used to detect malicious activity, then detection capability for specific malicious scenarios is improved, but system complexity and difficulty of maintenance increase
Solution Approach 1:
The patent introduces statistical models as an intermediary layer between network traffic and detection rules. Instead of directly applying extensive signature rules to all traffic, the system uses statistical baselines to identify anomalies that then trigger rule-based analysis, reducing the complexity of direct rule application while maintaining detection reliability
Solution Approach 2:
The detection system is segmented into multiple components: statistical learning module for baseline establishment, anomaly detection module for identifying deviations, and rule-based analysis module for specific malicious scenario detection. This segmentation allows each component to specialize, improving overall detection capability while managing system complexity through modular design
2Adaptability or versatility
If statistical-based systems learn network traffic patterns to establish baselines, then adaptability to dynamic network conditions is improved, but measurement precision of normal patterns deteriorates due to network diversity
Solution Approach 1:
The statistical baseline is designed to be dynamic rather than static, continuously adapting to changing network conditions through ongoing learning. The system adjusts its understanding of normal patterns over time, allowing it to accommodate network diversity and dynamic conditions while maintaining precision through continuous refinement of the baseline model
Solution Approach 2:
The system performs preliminary statistical learning during a baseline establishment phase before full detection begins. This preliminary action allows the system to pre-characterize normal network patterns for each specific network, creating a customized baseline that accounts for network diversity and improves measurement precision before actual anomaly detection starts
3Reliability
If extensive manual rule configuration by domain experts is performed, then detection accuracy for specific scenarios is improved, but ease of operation and system deployment deteriorates
Solution Approach 1:
The system incorporates automated statistical learning capabilities that allow it to self-configure baseline patterns without requiring extensive manual input from domain experts. The statistical models automatically learn normal traffic patterns and detect anomalies, reducing the operational burden while maintaining detection accuracy through data-driven insights
Data Source
AI summary
A method is provided to estimate statistics of user interaction with a computing system. For example, the method includes tracking the interaction of a plurality of users with the computing system to collect statistical data associated with the user interaction, wherein the statistical data is collected in each of a plurality of sampling intervals. The collected statistical data is applied to a digital linear recursive filter that is configured to combine and filter the collected statistical data based on at least one cyclical function. The filtered statistical data generated by the digital linear recursive filter is then utilized to compute final statistics indicative of the user interaction with the computing system. The final statistics are utilized to identify anomalous activity involving the computing system.