NDR False-Alert Reduction Using Client–Server Entropy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional network detection and response (NDR) systems generate a high number of false alerts, overwhelming network administrators and consuming valuable time and resources, making it difficult to distinguish real warnings from false warnings.
Innovation Solution
A system utilizing machine learning (ML) to classify network sessions as normal or malicious by analyzing client and server entropy values and non-empty packet counts, generating alerts based on ML model outputs to reduce false alerts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional NDR systems generate warnings for all detected malicious activities, then the detection coverage is improved, but the number of false alerts increases significantly
Solution Approach 1:
The patent introduces an intermediary classification system between the initial detection mechanism and the final alert generation. This intermediary layer analyzes additional parameters (entropy values, packet characteristics, session duration) to verify detected threats before generating alerts, thereby reducing false positives while maintaining detection coverage
Solution Approach 2:
The system changes the parameters used for detection by incorporating multiple dimensional analysis including entropy calculations, packet size distributions, session timing patterns, and protocol behavior metrics. This multi-parameter approach allows for more accurate differentiation between real threats and false positives
2Measurement precision
If network administrators verify each warning manually, then the accuracy of threat response is improved, but the time and resources required increase significantly
Solution Approach 1:
The system implements self-service by automatically classifying and verifying threats using machine learning models and multiple detection parameters. The system autonomously distinguishes between false positives and real threats without requiring manual administrator verification for each alert, thereby reducing time loss while maintaining accuracy
Solution Approach 2:
The system incorporates feedback mechanisms where classification results and verification outcomes are used to continuously improve the detection models. This feedback loop enables the system to learn from past decisions and improve future accuracy, reducing the need for manual intervention over time
3Device complexity
If conventional detection mechanisms analyze basic traffic patterns, then the system complexity is kept low, but the ability to distinguish false alerts from real threats is insufficient
Solution Approach 1:
The detection system is segmented into multiple independent analysis modules: entropy calculation module, packet characteristic analysis module, session behavior analysis module, and classification module. This segmentation allows for sophisticated analysis while maintaining manageable system complexity through modular architecture
Solution Approach 2:
The system adds another dimension to threat detection by incorporating entropy analysis and multiple traffic parameters beyond basic pattern matching. This dimensional expansion enables more accurate threat classification while the modular implementation keeps system complexity manageable
Data Source
AI summary
A system and a method for reducing false alerts from network detection and response tools retrieves traffic data associated with a network session between a client device and a server. The traffic data includes a first set of parameters associated with the client device and a second set of parameters associated with the server. The system determines client and server entropy values based upon the retrieved traffic data. The system determines a non-empty packet value based upon the first set of parameters associated with the client device and the second set of parameters associated with the server. The system provides to a machine learning (ML) model, as an input, the client and server entropy values, and the non-empty packet value, and generates an alert based upon an output of the ML model.