Entropy-Based Network Traffic Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Web-based service providers face challenges in detecting and mitigating anomalous network traffic events, such as DDOS attacks, in a timely manner due to the unpredictable nature of network traffic, leading to potential performance degradation.
Innovation Solution
A method and system for generating a signature of anomalous network traffic events using entropy information, which involves parsing network traffic data, calculating entropy values, detecting changes over time, and correlating these changes to identify anomalies, allowing for automated mitigation measures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of time
If traditional network traffic monitoring methods are used, then detection capability is maintained, but detection speed is too slow to prevent anomalies from affecting service performance
Solution Approach 1:
The system performs preliminary actions by continuously calculating entropy values for network traffic parameters and establishing baseline patterns before anomalies occur. This allows the system to detect deviations from normal patterns in near real-time, enabling early intervention before service performance is degraded by DDOS attacks or other anomalies.
2Measurement precision
If comprehensive network traffic analysis is performed to improve anomaly detection accuracy, then detection precision improves, but system complexity increases
Solution Approach 1:
The system changes parameters by focusing entropy calculations on specific network traffic parameters (packet size, inter-arrival time, source IP distribution, destination port distribution) rather than analyzing all traffic characteristics. This selective parameter approach maintains high detection accuracy while reducing computational complexity compared to comprehensive traffic analysis.
Solution Approach 2:
The system extracts only the most relevant features from network traffic data for entropy calculation, such as source IP addresses, destination ports, and timing patterns. By extracting and analyzing only these critical parameters, the system achieves accurate anomaly detection without the complexity of processing complete packet payloads or all traffic metadata.
3Speed
If automated mitigation measures are implemented based on entropy-based signatures, then response speed improves, but false positive rate may increase
Solution Approach 1:
The system implements feedback mechanisms where detected anomalies are continuously monitored and verified against established entropy baselines. When an anomaly is detected, the system can adjust its response based on the confidence level of the detection, allowing automated mitigation for high-confidence cases while reducing false positives through iterative verification and adaptive threshold adjustment.
Data Source
AI summary
Systems and methods are disclosed herein for generating a signature of an anomalous network event capable of adversely affecting the performance of a computing resource service provider. A signature computing workflow service receives network traffic information received at the computing resources service provider, and parses the network traffic information into a set of entries. The set of entries may include data for a set of parameters useable for communicating over a network. Entropy values may be calculated for the data and anomalies for the set of parameters may be detected based on changes in entropy for the set of parameters. A signature of an anomalous network traffic event may be generated based on characteristic entropy changes in the parameters associated with the anomalies. The signature may be useable to detect the presence of the network event.