Encoder-Decoder Neural Network for DNS Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for detecting anomalous network traffic patterns struggle due to the rarity and uniqueness of malicious events within heterogeneous internet traffic, leading to over-fitting with irrelevant features, false alarms, and difficulty in distinguishing between benign and malicious traffic, especially as attack patterns evolve.
Innovation Solution
The use of an encoder-decoder neural network to generate reconstructed vectors from input aggregate vectors of DNS traffic records, calculating distances to identify anomalies, and normalized distance-based clustering to classify network traffic data into normal and anomalous clusters without prior knowledge of cluster sizes or types.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional fixed signatures are used for attack detection, then detection accuracy for known attacks is improved, but adaptability to evolving attack patterns deteriorates
Solution Approach 1:
The patent implements dynamic anomaly detection by continuously learning from incoming network traffic data, allowing the system to adapt to evolving attack patterns in real-time. The unsupervised learning model updates its understanding of normal behavior dynamically, enabling detection of novel attacks without requiring pre-defined signatures.
Solution Approach 2:
The system changes the parameter representation of network traffic by transforming raw traffic data into aggregated feature vectors that capture essential patterns. This parameter transformation enables the detection model to focus on meaningful characteristics rather than raw data, improving both accuracy and adaptability.
2Reliability
If volumetric based approach with numerous measurements and features is used, then detection capability is improved, but false alarms increase due to over-fitting with irrelevant features
Solution Approach 1:
The patent extracts only the most relevant features from the volumetric traffic data by aggregating measurements into meaningful feature vectors. The unsupervised learning model automatically identifies and extracts significant patterns while filtering out irrelevant features, reducing false alarms while maintaining detection capability.
Solution Approach 2:
The system uses partial action by selecting a subset of the most informative features rather than processing all available measurements. This selective approach reduces computational overhead and minimizes the impact of irrelevant features, thereby reducing false alarms while preserving essential detection capabilities.
3Measurement precision
If anomalous behavior is described using many features, then characterization accuracy is improved, but human interpretability deteriorates
Solution Approach 1:
The patent transforms high-dimensional feature data into a different dimensional representation through unsupervised learning. The model projects complex multi-feature anomaly descriptions into a lower-dimensional latent space that preserves essential characteristics while enabling more compact and interpretable representations for human analysis.
4Device complexity
If conventional detection methods are used, then implementation simplicity is maintained, but detection accuracy for rare anomalous events deteriorates
Solution Approach 1:
The patent implements self-service detection by using unsupervised learning that automatically learns normal behavior patterns from data without requiring manual labeling or configuration. The system serves itself by autonomously adapting to new traffic patterns and attack types, improving detection accuracy for rare events while maintaining reasonable implementation complexity through automated feature learning.
Data Source
AI summary
A method may include a processing system having at least one processor obtaining a first plurality of domain name system traffic records, generating an input aggregate vector from the first plurality of domain name system traffic records, where the input aggregate vector comprises a plurality of features derived from the first plurality of domain name system traffic records, and applying an encoder-decoder neural network to the input aggregate vector to generate a reconstructed vector, where the encoder-decoder neural network is trained with a plurality of aggregate vectors generated from a second plurality of domain name system traffic records. In one example, the processing system may then calculate a distance between the input aggregate vector and the reconstructed vector, and apply at least one remedial action associated with the first plurality of domain name system traffic records when the distance is greater than a threshold distance.