Network Abnormality Detection Using Distributed Probes and Deviation Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network abnormality detection systems face challenges in accurately assessing the scale of abnormalities due to constant changing data volumes and ambiguous analysis methods, leading to erroneous detections and increased processing loads.
Innovation Solution
A distributed abnormality detection system with probes at arbitrary network positions that calculate and transmit abnormality levels, allowing an abnormality management apparatus to assess the scale of abnormalities based on average values and deviations, and determine the cause of abnormalities by analyzing parameter values across multiple probes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If standard sampling method is used to analyze information traffic, then processing is simplified, but erroneous detection occurs frequently due to constantly changing data volume
Solution Approach 1:
The patent changes the parameter for abnormality assessment from simple data volume sampling to abnormality level calculations that account for data volume changes. Each probe calculates an abnormality level based on current data volume conditions, allowing accurate detection despite constantly changing data volumes.
Solution Approach 2:
The system continuously monitors and compares current abnormality levels against historical data and thresholds. The abnormality management apparatus receives real-time abnormality level information from multiple probes and dynamically adjusts detection criteria based on changing network conditions, preventing erroneous detections.
2Measurement precision
If packet payload analysis is performed to identify applications and users, then monitoring capability is improved, but processing load on computers significantly increases
Solution Approach 1:
The patent extracts only the necessary abnormality level information from packet analysis rather than performing complete payload analysis. Probes calculate abnormality levels based on selected parameters (such as packet size, frequency, or pattern matching) without analyzing entire payloads, reducing processing load while maintaining monitoring capability.
Solution Approach 2:
The system segments the monitoring function into distributed probes that perform localized abnormality level calculations near data sources, rather than centralizing all analysis at a single computer. This distribution reduces the processing load on individual systems while improving overall monitoring capability.
3Measurement precision
If payload portion of packets is analyzed to detect abnormalities, then detection accuracy is improved, but illegal packets may induce erroneous operations during processing
Solution Approach 1:
The patent converts the potential harm of analyzing packet payloads into a benefit by implementing careful parameter selection and validation. Probes analyze only specific, safe parameters for abnormality level calculation, and the system includes validation mechanisms that prevent illegal or malicious packets from causing erroneous operations during abnormality detection processing.
Data Source
AI summary
An abnormality management apparatus, connected via a network to a plurality of probes disposed at arbitrary positions in the network, comprises an abnormality level reception unit that receives information indicating an abnormality level calculated at each of the plurality of probes, an abnormality analysis unit that judges the scale of an abnormality manifesting in the network based upon an average value of the abnormality levels indicated at the plurality of probes and deviations relative to the average value and a result output unit that outputs results obtained at the abnormality analysis unit. The structure enables accurate assessment of the scale of an abnormality having occurred in the network and quick response to the abnormality by detecting its cause at an early stage.