Monitoring Service Anomaly Detection for False Positive Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Monitoring services, such as security and activity monitoring services, may produce untrustworthy data due to bugs, memory leaks, or attacks, leading to false positives and compromised system integrity.
Innovation Solution
A method involving anomaly detection using techniques like one-class support vector machines, k-nearest neighbor cluster analysis, or recurrent neural networks to analyze data from monitoring services, generating values representative of anomalies, and comparing these values to thresholds to determine the trustworthiness of the service output.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If monitoring services are deployed to ensure security and integrity, then system security monitoring capability is improved, but false positives and untrustworthy data increase
Solution Approach 1:
The patent introduces an intermediary evaluation mechanism that sits between the monitoring service and the system it protects. This intermediary analyzes the monitoring service's output data, evaluates its trustworthiness, and determines whether to accept or reject the monitoring results. This mediator layer filters out false positives while preserving genuine security alerts, resolving the contradiction between maintaining monitoring reliability and reducing false positives.
Solution Approach 2:
The patent implements a feedback mechanism where the evaluation of monitoring service trustworthiness feeds back into the monitoring process. By continuously assessing the monitoring service's performance and adjusting acceptance criteria based on this feedback, the system dynamically optimizes the balance between detecting real threats and minimizing false positives, thereby improving overall reliability while reducing harmful false alerts.
2Productivity
If data from monitoring services is accepted without verification, then processing efficiency is improved, but system integrity is compromised
Solution Approach 1:
The patent applies partial verification by evaluating only the trustworthiness of monitoring service data rather than performing complete validation of all data points. This selective approach verifies critical aspects of data integrity while skipping redundant checks, thereby maintaining system integrity through targeted verification without significantly reducing processing efficiency.
Solution Approach 2:
The patent performs preliminary evaluation of monitoring service trustworthiness before accepting data for processing. By assessing the reliability of the monitoring service in advance and establishing acceptance criteria beforehand, the system prepares verification mechanisms proactively, ensuring data integrity is maintained while minimizing the overhead during actual data processing operations.
Data Source
AI summary
In an example, a method includes analysing data collected from a service. A value representative of the number of anomalies in the data is generated, this value then being compared with a threshold. Depending on whether the value is greater or less than the threshold, a performance parameter of the monitoring service may be evaluated.