Graph-Based Network Anomaly Detection Engine
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Enterprise networks face challenges in real-time detection of abnormal connections due to the complexity of network structures, high data volumes, and the difficulty in obtaining and labeling training data, which hinders effective intrusion detection and response.
Innovation Solution
A Graph-based Security Monitoring Engine (GSME) utilizing a blueprint graph model that dynamically constructs and maintains topology and port graphs to detect abnormal connections in real-time without prior knowledge or training datasets, providing explanations for abnormal events.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If traditional intrusion detection methods are used, then detection accuracy may be maintained, but real-time processing capability deteriorates due to high computational costs and complex model requirements
Solution Approach 1:
The patent segments the network connection detection task into two distinct graph structures: topology graph (capturing host-to-host connection patterns) and port graph (capturing process-to-port relationships). This segmentation allows independent optimization of each graph's computation, reducing overall computational complexity while maintaining detection accuracy through the combined analysis of both graphs.
Solution Approach 2:
The patent transforms the traditional single-dimension detection approach into a two-dimensional graph-based framework. By representing network connections as nodes and edges in topology and port graphs, the system adds structural dimensionality to the detection process, enabling more efficient real-time processing through graph traversal algorithms while preserving detection reliability.
2Reliability
If pre-defined models and training datasets are used, then detection reliability may be improved, but system complexity and deployment difficulty increase
Solution Approach 1:
The patent implements self-service by enabling the system to automatically construct and update topology and port graphs from live network traffic without requiring external training datasets or pre-defined models. The graphs are dynamically built and maintained by the system itself using observed connection patterns, eliminating the need for complex offline training pipelines and reducing deployment complexity.
Solution Approach 2:
The patent employs dynamic graph structures that continuously adapt to changing network conditions. The topology and port graphs are updated in real-time as new connection patterns emerge, allowing the system to maintain detection reliability without requiring retraining or manual model updates, thus reducing system complexity compared to static model-based approaches.
3Reliability
If comprehensive network monitoring is implemented, then detection coverage is improved, but data processing volume and computational burden increase
Solution Approach 1:
The patent extracts only the essential structural information from network traffic into graph representations. Instead of processing raw packet data or full connection logs, the system extracts topology relationships (host connections) and port relationships (process-port mappings) into compact graph structures, dramatically reducing data processing volume while maintaining comprehensive detection coverage through graph-based pattern matching.
Data Source
AI summary
A computer-implemented method for real-time detecting of abnormal network connections is presented. The computer-implemented method includes collecting network connection events from at least one agent connected to a network, recording, via a topology graph, normal states of network connections among hosts in the network, and recording, via a port graph, relationships established between host and destination ports of all network connections.