Edge Anomaly Detection via Graph Feature Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Enterprise networks face challenges in detecting new and unexpected flows due to the increasing volume of critical and non-critical traffic, where traditional methods struggle to differentiate between normal and anomalous behavior, especially in highly dimensional spaces with dynamic network behaviors and encrypted traffic.
Innovation Solution
A device in the network identifies new interactions between nodes, forms a feature vector using contextual information, and generates an anomaly detection model to determine if the interaction is anomalous, employing machine learning techniques and graph-based models to detect anomalies at the edge of the network.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional anomaly detection methods are used in enterprise networks, then they can detect known threats using static signatures, but they fail to detect new and unexpected flows due to high false positive rates and inability to handle high-dimensional dynamic network behaviors
Solution Approach 1:
The patent segments the anomaly detection task into multiple components: (1) flow representation using graphs where nodes are network entities and edges are interactions, (2) feature extraction from graph structures including degree centrality, betweenness centrality, and clustering coefficients, (3) machine learning classification to distinguish anomalous from normal flows. This segmentation transforms the complex high-dimensional detection problem into manageable modular components, reducing system complexity while maintaining detection precision.
Solution Approach 2:
The patent transforms network flow data from traditional packet-level dimensions to graph-theoretical dimensions. By representing network entities as nodes and interactions as edges, the system extracts topological features (centrality measures, path lengths, community structures) that provide new dimensional perspectives on network behavior. This dimensional transformation enables detection of anomalies based on structural patterns rather than just traffic volume or protocol characteristics, improving precision for new and unexpected flows.
2Measurement precision
If machine learning techniques are applied to detect new interactions, then detection precision improves, but the computational complexity and data processing requirements increase
Solution Approach 1:
The patent extracts only the most discriminative features from network flows for machine learning analysis. Instead of processing complete packet captures or all flow attributes, the system extracts graph-theoretical features such as degree centrality, betweenness centrality, and clustering coefficients that specifically capture the topological essence of new interactions. This feature extraction reduces computational load by focusing on the most informative dimensions while maintaining detection precision.
Solution Approach 2:
The patent performs preliminary graph construction and feature extraction before applying machine learning classification. By pre-computing graph structures and extracting topological features in advance, the system prepares optimized input data for the classification stage. This preliminary processing reduces the computational burden during real-time anomaly detection, as the machine learning model receives pre-processed feature vectors rather than raw network data.
3Adaptability or versatility
If graph-based models are used to represent network entities and interactions, then the ability to detect new and unexpected flows improves, but the complexity of analyzing high-dimensional network data increases
Solution Approach 1:
The patent employs graph-based representations that provide universal applicability across different network types and anomaly scenarios. The same graph model (nodes as network entities, edges as interactions) and the same set of graph-theoretical features (centrality measures, path lengths, clustering coefficients) can detect various anomalies including new flows, lateral movement, and data exfiltration. This universal framework reduces analysis difficulty by providing consistent methodology regardless of the specific anomaly type or network configuration.
Solution Approach 2:
The patent creates simplified graph abstractions that copy only the essential topological relationships from complex network data. Instead of analyzing complete high-dimensional packet captures, the system constructs graph representations that capture the essential interaction patterns between network entities. This copying approach reduces analysis difficulty by working with compressed topological summaries rather than full network state data, while retaining the information needed to detect new and unexpected flows.
Data Source
AI summary
In one embodiment, a device in a network identifies a new interaction between two or more nodes in the network. The device forms a feature vector using contextual information associated with the new interaction between the two or more nodes. The device causes generation of an anomaly detection model for new node interactions using the feature vector. The device uses the anomaly detection model to determine whether a particular node interaction in the network is anomalous.