IoT Communication Apparatus for Reducing Network Traffic While Maintaining Detection Accuracy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques for monitoring IoT device internal networks are inadequate as they fail to transmit information about non-monitoring target communications and out-of-sampling time communications, leading to low detection rates for internal network attacks.
Innovation Solution
A communication apparatus that calculates the communication interval of data within the device and determines whether to transmit data to an external apparatus based on predefined ranges, thereby reducing unnecessary data transmission while maintaining detection accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If sampling method is used to reduce data transmission, then communication load is reduced, but detection accuracy of unauthorized communication deteriorates
Solution Approach 1:
The system performs preliminary analysis of communication data to identify anomalous patterns before transmission. By pre-processing data to detect deviations from normal communication patterns, the system can flag potentially unauthorized communications for external analysis without transmitting all raw data, thus reducing communication load while maintaining detection accuracy.
Solution Approach 2:
The system introduces an intermediary processing layer that sits between the internal network monitoring and external data transmission. This intermediary selectively identifies and transmits only communications that exhibit anomalous characteristics or fall outside predefined normal patterns, acting as a filter that reduces data volume while preserving security-relevant information.
2Productivity
If monitoring target optimization is applied to reduce data amount, then communication load is reduced, but information about non-monitoring target communications is lost
Solution Approach 1:
The system dynamically adjusts monitoring targets based on observed communication patterns and detected anomalies. Rather than using fixed monitoring targets, the system adapts its monitoring scope in real-time, expanding to include previously non-monitored communication types when unusual patterns are detected, thus preventing information loss while maintaining reduced data transmission during normal operation.
Solution Approach 2:
The system changes monitoring parameters dynamically based on the state of the internal network. When communication patterns deviate from established baselines, the system adjusts which communication targets are monitored and what thresholds trigger external transmission, allowing flexible adaptation to new threats without continuously transmitting all possible data types.
3Measurement precision
If full logs are transmitted to external device, then detection accuracy is maintained, but communication load increases significantly
Solution Approach 1:
The system extracts only the essential security-relevant features and anomalies from the full communication logs before transmitting to the external device. By separating and transmitting only the critical security indicators rather than complete logs, the system maintains detection accuracy for unauthorized communications while dramatically reducing the communication load to the external server.
Data Source
AI summary
Provided is a communication apparatus communicating with an external apparatus connected via a network, and the communication apparatus includes a processor and a memory storing program instructions that cause the processor to: calculate a communication interval of data communicated within the communication apparatus; determine whether to perform communication with the external apparatus based on whether the communication interval is within a range set in advance; and transmit, to the external apparatus, communication data including the communication interval determined to perform communication with the external apparatus, latter data in the communication interval, and a transition between former data and the latter data in the communication interval, so that traffic from an apparatus to outside is reduced while suppressing deterioration in detection accuracy of unauthorized communication.