Filtering Mechanism for ML Anomaly Detectors
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Machine learning-based anomaly detectors in computer networks often generate false positives due to insufficient training datasets that fail to cover the entire feature space, leading to difficulties in distinguishing between normal and malicious network behavior, especially in distributed Denial of Service (DoS) attacks.
Innovation Solution
A filtering mechanism is introduced that identifies and mitigates false positives by generating and installing output filters at anomaly detectors, ensuring the training dataset covers all relevant regions of the input feature space, and utilizing a filtering optimization engine to compute optimal filters based on performance metrics and historical data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If machine learning-based anomaly detectors are deployed in computer networks, then the ability to detect network anomalies is improved, but the number of false positives increases
Solution Approach 1:
A filtering mechanism is introduced as an intermediary component between the anomaly detector and the alerting system. This filter receives anomaly detections from the machine learning model, evaluates them using additional criteria (such as checking if traffic patterns match known attack signatures or verifying consistency across multiple detectors), and only passes confirmed anomalies to the alerting system. This intermediary layer reduces false positives while maintaining true anomaly detections.
Solution Approach 2:
The system performs preliminary actions by pre-training the machine learning model with extensive training data that covers normal network traffic patterns, and by pre-configuring filtering rules based on historical attack data. Before actual anomaly detection begins, the system establishes baseline behavior profiles and prepares filter criteria, so that when anomalies are detected, the filtering mechanism can quickly evaluate them against pre-established standards rather than making real-time decisions without context.
2Measurement precision
If the training dataset is expanded to cover more feature space, then the accuracy of anomaly detection is improved, but the complexity of data collection and processing increases
Solution Approach 1:
The training data collection process is segmented into multiple independent sources and phases. Instead of collecting all training data from a single complex source, the system divides data collection into separate streams: normal traffic data from various network segments, attack data from controlled environments, and edge case data from specific scenarios. Each segment is processed and validated independently before being integrated into the comprehensive training dataset, reducing the complexity of any single data collection effort.
Solution Approach 2:
The system employs multi-functional data collection mechanisms that serve multiple purposes simultaneously. For example, the same network monitoring infrastructure used for real-time anomaly detection is also used for collecting training data, eliminating the need for separate dedicated data collection systems. The training dataset is designed to be universal, covering multiple attack types, network configurations, and traffic patterns that can be applied across different detection scenarios, reducing the need for separate datasets for each specific case.
Data Source
AI summary
In one embodiment, a device in a network receives information regarding a network anomaly detected by an anomaly detector deployed in the network. The device identifies the detected network anomaly as a false positive based on the information regarding the network anomaly. The device generates an output filter for the anomaly detector, in response to identifying the detected network anomaly as a false positive. The output filter is configured to filter an output of the anomaly detector associated with the false positive. The device causes the generated output filter to be installed at the anomaly detector.