Communication Device Flow Volume Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing communication systems fail to detect communication anomalies, particularly when the output destination is erroneous, as the number of input frames matches the number of output frames, preventing anomaly detection.
Innovation Solution
A communication device with flow condition information, input and output flow counter processing units, and a counter comparison unit that compares input and output flow volumes to identify communication anomalies by updating flow counter information based on packet attributes and destination information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If the number of input frames is compared to the number of output frames for anomaly detection, then simple anomaly detection is achieved, but anomalies with erroneous output destinations cannot be detected
Solution Approach 1:
The patent segments the anomaly detection process by introducing flow identification that divides traffic into distinct flows based on communication partners. Instead of treating all traffic uniformly, the system segments it by source and destination addresses, allowing separate monitoring of each flow's input and output volumes. This segmentation enables detection of erroneous output destinations by comparing volumes within specific flows rather than across all traffic.
Solution Approach 2:
The patent introduces flow identification information (source address and destination address) as an intermediary element that mediates between raw frame counting and anomaly detection. This intermediary layer processes frame data to associate frames with specific communication flows, enabling more nuanced comparison that can detect destination errors while maintaining systematic monitoring.
2Reliability
If flow identification is introduced to detect erroneous output destinations, then anomaly detection accuracy is improved, but system complexity increases
Solution Approach 1:
The patent applies universality by using the same flow identification mechanism (source and destination addresses) that is already inherent in network communication protocols. These address fields serve multiple functions: routing packets and simultaneously enabling anomaly detection when compared across input and output frames. This multi-functionality reduces additional complexity since the identification data already exists in the frame structure.
Solution Approach 2:
The patent changes the monitoring parameter from simple frame count to frame count per flow, utilizing existing address parameters in network frames. By repurposing the source and destination address fields that already exist in every frame for the additional function of flow identification, the system achieves improved detection without adding substantial new parameters or data structures.
Data Source
AI summary
A communication device: stores flow condition information for identifying a flow and flow counter information that indicates, for each flow, an input flow volume of a flow inputted to the communication device, and an output flow volume of a flow outputted by the communication device; identifies a flow to which data inputted to the communication device belongs, with reference to the flow condition information; updates the input flow volume of the flow in the flow counter information; identifies a flow to which data outputted by the communication device belongs, with reference to the flow condition information; updates the output flow volume of the flow in the flow counter information; and identifies a flow in which a communication anomaly has occurred on the basis of results of a comparison process for comparing the input flow volume to the output flow volume with reference to the flow counter information.