Local Network Monitoring Devices for Distributed Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Monitoring large and complex networks is challenging due to their size, complexity, data diversity and quantity, limited visibility, high false positive rates, and the high cost of existing monitoring systems, making it difficult to detect threats effectively.
Innovation Solution
Implementing a system with local monitoring devices placed between computing devices and networking routers to analyze network traffic, generate models of normal behavior, detect anomalies, and transmit alerts to a central monitoring system for further analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If centralized monitoring systems are used to collect and analyze all network data, then comprehensive threat detection is improved, but system complexity and cost increase significantly
Solution Approach 1:
The patent divides the centralized monitoring system into distributed edge monitoring devices deployed at network periphery locations. Each device independently monitors local network segments, generating anomaly scores based on local baseline behavior. This segmentation reduces the complexity of any single monitoring point while maintaining comprehensive coverage through aggregation of multiple distributed devices.
2Measurement precision
If expensive commercial probes are deployed for sophisticated traffic analysis, then measurement precision is improved, but device cost increases
Solution Approach 1:
The edge monitoring devices perform self-learning by automatically establishing baseline behavior patterns for monitored network segments without requiring manual configuration or expensive commercial probe software. The devices autonomously calculate anomaly scores by comparing observed traffic against learned baselines, eliminating the need for costly commercial analysis tools while maintaining precision through continuous adaptive learning.
3Use of energy by moving object
If network traffic metadata is sampled at low rates for capacity planning, then energy consumption is reduced, but threat detection capability deteriorates
Solution Approach 1:
The system performs preliminary action by continuously learning and establishing baseline behavior patterns during normal network operation before threats occur. This pre-established knowledge enables the devices to detect anomalies with high confidence using minimal real-time sampling, as the baseline captures normal traffic characteristics that can be compared against sparse real-time data for efficient anomaly detection.
4Ease of operation
If multiple SOCs and SIEMs operate independently in large networks, then operational autonomy is improved, but overall network visibility deteriorates
Solution Approach 1:
The patent merges the operations of multiple independent monitoring devices by aggregating their anomaly scores and findings at a central coordination point. Each edge device maintains operational autonomy in its local monitoring and baseline learning, but the aggregation mechanism combines insights from multiple devices to provide comprehensive network-wide visibility, eliminating information loss that occurs with completely independent operations.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In accordance with some embodiments of the disclosed subject matter, mechanisms for distributed network monitoring are provided. In some embodiments, a system for distributed network monitoring comprises: local monitors, each comprising: a processor programmed to: generate a model of normal network traffic between a computing device and a router; receive additional traffic; calculate a metric based on a metadata parameter of the additional traffic; determine, based on the metric, whether the additional traffic is anomalous; and transmit, to a central monitoring system, information indicating that the additional traffic is anomalous; and the central monitoring system comprising: a second processor programmed to: receive information indicating that the additional traffic is anomalous; receive information related to the additional traffic; determine, based on the information, that the additional traffic is anomalous; and take an action to secure communications across the portion of the network associated with the additional traffic.