Adaptive Threshold DNS Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting aberrant behavior in time-series data, such as botnet activity, struggle to accurately differentiate between legitimate and illegitimate internet use patterns, particularly in DNS traffic, due to the periodic nature of user activity and the clandestine registration of domain names by botnet masters.
Innovation Solution
A computer-implemented method and system that utilize a round-robin database to select data layers associated with seasonal periods, determine predicted trends, calculate time-series deviation data, and establish an adaptive threshold based on standard deviation to detect aberrant behavior in DNS lookup data, thereby identifying potential botnet activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If statistical methods are used to detect aberrant behavior in DNS traffic, then detection capability is improved, but false positives increase due to the periodic nature of legitimate user activity
Solution Approach 1:
The patent implements dynamic threshold adjustment by calculating rolling standard deviations over different time windows (e.g., 5-minute, 15-minute, 1-hour periods). The threshold adapts to changing traffic patterns by continuously updating statistical parameters based on recent observations, allowing the system to distinguish between periodic legitimate traffic and genuine anomalies without fixed rigid thresholds
Solution Approach 2:
The system performs preliminary learning phase where it collects and analyzes baseline traffic patterns before正式开始 detection. During this phase, the system establishes expected behavior profiles for different time periods (business hours, weekends, holidays) and uses these pre-established profiles to reduce false positives during actual detection operations
2Productivity
If simple anomaly detection methods are used, then processing speed is improved, but detection accuracy deteriorates when differentiating between legitimate and illegitimate traffic patterns
Solution Approach 1:
The patent segments DNS traffic analysis into multiple independent dimensions: query type distribution, domain name characteristics, response code patterns, and temporal patterns. Each dimension is analyzed separately using simple statistical methods, then results are combined to make final detection decisions. This segmentation allows use of computationally efficient methods while maintaining high detection accuracy through multi-factor analysis
Solution Approach 2:
The system transforms single-dimensional traffic volume analysis into multi-dimensional analysis by examining multiple attributes simultaneously: number of queries, query types, domain names involved, response codes, and temporal patterns. This dimensional expansion enables simple per-dimension analysis to achieve complex detection accuracy by considering the joint distribution of multiple features
3Reliability
If adaptive threshold adjustment is implemented to reduce false positives, then system complexity increases, but detection reliability improves
Solution Approach 1:
The system implements self-adjusting thresholds that automatically adapt to changing traffic conditions without manual intervention. The thresholds are computed autonomously using rolling statistical calculations (mean, standard deviation) over observed traffic patterns, allowing the system to serve itself by continuously recalibrating detection parameters based on actual operational data
Solution Approach 2:
The patent incorporates feedback mechanisms where detection results and traffic pattern changes feed back into threshold adjustment. The system monitors detection outcomes and uses this feedback to refine threshold parameters, creating a closed-loop system that continuously improves detection reliability while maintaining manageable complexity through automated adaptation
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods and systems for detecting aberrant behavior in time-series observation data, such as non-existent domain data, are disclosed. The methods and systems analyze the time-series observation data to determine time-series prediction data. The time-series observation data and time-series prediction data are used to determine a threshold that is based on the standard deviation of deviation values between the time-series observation data and time-series prediction data. The threshold may be used to detect aberrant behavior in subsequently obtained time-series observation data.