HTM Anomaly Detection for Web Config Changes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malicious attacks on web servers often result in subtle changes to web application configurations, which existing detection methods fail to identify effectively, posing a risk to network security and data integrity.
Innovation Solution
A computer-implemented method using a hierarchical temporal memory (HTM) to detect anomalous changes in web application configurations by generating sparse distributed representations of records and training the HTM to recognize normal operation patterns, allowing for the identification of deviations indicative of malicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing detection methods are used to monitor web application configurations, then the detection system is simple to implement, but the detection precision is insufficient to identify subtle malicious changes
Solution Approach 1:
The patent transforms web application configuration data into sparse distributed representations (SDR), changing the parameter format from raw configuration values to binary vectors. This transformation enables the HTM system to detect subtle malicious changes by comparing SDR patterns, significantly improving detection precision while the automated nature of the transformation keeps implementation complexity manageable
Solution Approach 2:
The patent replaces traditional mechanical or rule-based detection systems with a hierarchical temporal memory (HTM) system. The HTM uses unsupervised learning to automatically model normal configuration patterns and detect anomalies, substituting complex manual rule creation with a self-learning system that achieves high detection precision without proportionally increasing implementation complexity
2Reliability
If a hierarchical temporal memory system is implemented to detect subtle configuration changes, then the detection precision improves, but the device complexity increases
Solution Approach 1:
The patent segments the detection system into distinct functional modules: data collection from web application configurations, transformation to sparse distributed representations, HTM model training and inference, and anomaly detection. This segmentation allows each module to be independently optimized and maintained, reducing overall system complexity while maintaining high detection reliability through specialized processing in each segment
Solution Approach 2:
The patent performs preliminary action by training the HTM system on normal configuration patterns before actual security monitoring begins. This pre-training phase creates a baseline model of expected behavior, enabling the system to reliably detect deviations without requiring complex real-time analysis rules, thereby improving detection reliability while keeping the runtime system relatively simple
Data Source
Figure 1~2
Figure 3~4
Figure 5
AI summary
A computer implemented method to detect an anomalous change to a web application configuration, the web application executing with a web server, the method comprising: receiving a first set of records for the web application operating in a training mode of operation, each record including characteristics of the web application; generating a sparse distributed representation of the set of records to form a training set for a hierarchical temporal memory (HTM); training the HTM based on the training set in order that the trained HTM provides a model of the operation of the web application in the training mode of operation; receiving a second set of records for the web application, each record including characteristics of the web application; generating a sparse distributed representation of the second set of records to form an input set for the trained HTM; executing the trained HTM based on the input set to determine a degree of recognition of the records of the input set; and responsive to a determination that a degree of recognition of one or more records of the input set is below a threshold degree, identifying an anomalous change to the web application configuration.