Frequency Analysis for Intrusion Detection in Computer Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional intrusion detection systems struggle to detect malicious activities that occur at regular intervals or mimic authorized job behaviors, as they often rely on login behavior analysis and may fail to identify background jobs that are difficult to distinguish from normal operations.
Innovation Solution
The implementation of frequency analysis on time domain activity data using methods like Fourier Transform to convert data into frequency domain, allowing for the detection of periodic patterns and changes in periodicities, which are displayed in an animated format to facilitate identification of potential security threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional intrusion detection systems rely on login behavior analysis, then they can detect some malicious activities, but they fail to identify background jobs that mimic normal operations
Solution Approach 1:
The patent transforms the detection approach from time domain (login behavior analysis) to frequency domain analysis. By converting activity data using Fourier Transform, the system analyzes periodic patterns and frequency characteristics of background jobs, enabling detection of malicious activities that mimic normal operations but exhibit abnormal periodicity patterns
Solution Approach 2:
The system changes the analytical parameters from temporal sequences of login events to frequency spectrum characteristics. By computing frequency domain representations of activity data and analyzing periodicities, the system can distinguish between legitimate background jobs and malicious activities based on their frequency signatures
2Measurement precision
If frequency analysis is applied to detect periodic patterns, then malicious activities can be distinguished from normal operations, but the complexity of data processing increases
Solution Approach 1:
The patent extracts only the essential frequency characteristics from the raw activity data using Fourier Transform. Instead of analyzing entire time series data, the system focuses on computing and analyzing the frequency spectrum, which isolates the periodic patterns that indicate malicious activity while discarding redundant information
Solution Approach 2:
The system replaces complex manual analysis of time domain data with automated frequency domain computation. The Fourier Transform algorithm automatically converts and analyzes the activity patterns, reducing the need for complex manual detection rules and enabling systematic analysis of periodic behaviors
3Reliability
If the system analyzes large sets of log data using conventional methods, then it can identify suspicious behavior, but it struggles with malicious activities occurring at regular intervals
Solution Approach 1:
The patent addresses the difficulty of detecting periodic malicious activities by transforming the data from time domain to frequency domain. This dimensional change converts the problem of detecting regular intervals into the simpler task of identifying peak frequencies in the spectrum, making periodic patterns immediately visible and distinguishable from random noise
Solution Approach 2:
The system leverages the periodic nature of both legitimate background jobs and malicious activities by analyzing frequency characteristics. By computing the frequency spectrum and identifying dominant periodicities, the system can detect anomalies in the expected periodic patterns, thereby reliably identifying malicious activities that occur at regular intervals
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
This approach effectively distinguishes malicious activities from normal operations by highlighting unusual patterns and changes in frequency domain data, enhancing the ability to detect and identify security risks within computer systems.
Implementation Method 1
computing, by a hardware processor, frequency domain activity data based on the time domain activity data. In an implementation, the frequency domain activity data are computed using Fourier Transform.
Data Source
AI summary
The present disclosure describes methods, systems, and computer program products for performing a frequency domain analysis of activity data for a computer system. One computer-implemented method receiving time domain activity data for a computer system, wherein the time domain activity data comprise activity records associated with the computer system in a time domain; computing, by a hardware processor, frequency domain activity data based on the time domain activity data; and displaying the frequency domain activity data.