Graph-Based Network Anomaly Detection via Connection Probability
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing approaches to real-time threat detection in enterprise networks face challenges such as high data volumes, complex network structures, and the lack of accurate training data, leading to inefficiencies and inaccuracies in detecting anomalous network activity.
Innovation Solution
The method employs graph-based security monitoring using a blueprint graph model that includes a topology graph and a port graph, constructed via streamed big data, to calculate connection probabilities and identify abnormal network events based on node stability, diversity, and similarity, without requiring pre-collected training datasets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional anomaly detection methods are used, then detection can be performed with available tools, but accuracy is low and the system is inflexible to changing attack patterns
Solution Approach 1:
The patent implements dynamic graph structures that automatically adapt to changing network conditions and attack patterns. The topology graph and port graph are continuously updated in real-time as new network events are observed, allowing the detection system to evolve with the network environment without manual reconfiguration or retraining.
Solution Approach 2:
The system performs self-learning by automatically building and updating its knowledge base of normal network behavior through observed network events. The anomaly detection mechanism uses these self-learned patterns to identify deviations, eliminating the need for external training data or manual model updates while maintaining high accuracy and adaptability.
2Reliability
If comprehensive network monitoring is implemented to track all hosts and connections, then detection coverage is improved, but data volume reaches terabyte scales requiring excessive processing resources
Solution Approach 1:
The patent extracts only the essential structural elements of network data into graph representations (topology graph capturing host relationships, port graph capturing service relationships). This extraction transforms terabyte-scale raw network data into compact graph structures that retain all necessary information for anomaly detection while requiring minimal processing resources.
Solution Approach 2:
The network monitoring system is segmented into specialized graph structures (topology graph and port graph) that organize different aspects of network data separately. This segmentation allows efficient querying and analysis of specific network relationships without processing the entire dataset, reducing computational overhead while maintaining comprehensive coverage.
3Measurement precision
If the system maintains accurate models of complex evolving network structures, then detection accuracy is improved, but the system complexity increases significantly
Solution Approach 1:
The graph-based representation serves multiple functions simultaneously: it models network topology, tracks host relationships, monitors port usage, and enables anomaly detection. This universal representation approach maintains high model accuracy for complex network structures while avoiding the complexity of multiple separate modeling systems.
Solution Approach 2:
The topology graph and port graph act as intermediary structures between raw network data and anomaly detection algorithms. These graphs simplify complex network relationships into standardized formats that are easier to process and analyze, reducing system complexity while preserving measurement precision.
4Adaptability or versatility
If real-time detection is implemented without pre-collected training data, then system flexibility is improved, but traditional supervised learning approaches cannot recognize attacks not present in training corpus
Solution Approach 1:
Instead of training the system on known attacks and hoping it generalizes, the patent inverts the approach by learning what normal network behavior looks like and detecting anything that deviates from this baseline. This unsupervised approach using graph-based anomaly detection enables the system to identify previously unseen attacks while maintaining high flexibility and accuracy.
Data Source
AI summary
Methods and systems for detecting anomalous network activity include determining whether a network event exists within an existing topology graph and port graph. A connection probability for the network event is determined if the network does not exist within the existing topology graph and port graph. The network event is identified as abnormal if the connection probability is below a threshold.