Histogram Bin Segmentation for Network Anomaly Detection

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Conventional User Behavior Analytics (UBA) systems face high computational burdens due to the use of histograms with a large number of bins, which can lead to inefficiencies and accuracy issues when detecting anomalous behavior on electronic networks.

Innovation Solution

The approach involves iteratively combining groups of adjacent bins in histograms to minimize error, reducing the number of bins in areas of low data variability while preserving accuracy in areas of high variability, thereby reducing computational loads without sacrificing accuracy.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If histograms with a large number of bins are used to accurately represent user behavior, then measurement precision is improved, but device complexity and computational burden increase

Engineering Contradiction:
Improveaccuracy of behavior representationVSAvoidcomputational burden
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The patent segments the histogram bins into different groups based on their frequency characteristics. High-frequency bins are further divided into smaller intervals to capture detailed behavior patterns, while low-frequency bins are grouped into larger intervals. This selective segmentation maintains measurement precision for important behaviors while reducing the total number of bins to lower computational burden.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent applies different bin width qualities to different regions of the histogram based on local data characteristics. Regions with high frequency values use narrower bins for precise measurement, while regions with low frequency values use wider bins. This local adaptation optimizes the balance between accuracy and computational efficiency by concentrating processing resources where they are most needed.

Inventive Principle:
Principle #3Local quality

2Device complexity

If the number of bins is reduced to decrease computational burden, then device complexity is reduced, but measurement precision deteriorates

Engineering Contradiction:
Improvecomputational burdenVSAvoidaccuracy of behavior representation
Core Design Contradiction:
Device complexityVSMeasurement precision

Solution Approach 1:

Instead of uniformly reducing all bins, the patent segments bins by frequency magnitude and applies different reduction strategies. High-frequency bins maintain finer granularity to preserve important behavior patterns, while low-frequency bins are coarsened more aggressively. This selective approach reduces overall computational burden while preserving measurement precision for critical behaviors.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent implements local quality by applying different bin widths to different frequency regions. Narrow bins are retained where data variability is high and precision is critical, while wider bins are used where data is more uniform. This ensures that reducing the number of bins does not uniformly degrade precision, but rather optimizes it locally based on data characteristics.

Inventive Principle:
Principle #3Local quality

3Ease of manufacture

If equal-width bins are used to simplify histogram construction, then ease of manufacture is improved, but measurement precision deteriorates due to inability to capture data variability

Engineering Contradiction:
Improvesimplicity of histogram constructionVSAvoidaccuracy of behavior representation
Core Design Contradiction:
Ease of manufactureVSMeasurement precision

Solution Approach 1:

The patent segments the histogram into regions with different bin widths based on the underlying data distribution. Instead of using a single uniform bin width, the histogram is constructed with multiple segments where each segment has bin widths optimized for its local characteristics. This maintains relative simplicity in construction while dramatically improving precision by adapting to data variability.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent applies local quality by making bin widths variable rather than uniform. Each region of the histogram uses bin widths tailored to the local data density and variability. This approach maintains ease of construction through systematic methods while achieving superior measurement precision compared to equal-width bins, as the bin structure adapts to capture important behavioral variations.

Inventive Principle:
Principle #3Local quality

Data Source

PatentUS9967275B1Efficient detection of network anomalies
Publication Date: 2018.05.08 NETWITNESS SECURITY LLC
  • US9967275B1 patent drawing
  • US9967275B1 patent drawing
  • US9967275B1 patent drawing

AI summary

Techniques of identifying anomalous behavior on an electronic network involve iteratively combining groups of adjacent bins of a histogram in such a way as to minimize a measure of error in the histogram. Along these lines, a user behavior analytics server represents a user behavior factor with a histogram. The UBA server reduces a number of bins in the histogram by iteratively selecting groups of adjacent bins for combination. Upon each iteration, the group of bins that is selected for combination is the group which, when its bins are combined, minimizes differences between the values of the bins in that group and a value of the combined bin.