Network Node Access Anomaly Detection from Heterogeneous Session Logs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems struggle to effectively detect anomalous access behaviors in network nodes due to the heterogeneity of terminal session logs, which are unstructured and vary significantly across different deployments, making it difficult to abstract patterns and requiring manual, laborious scanning.
Innovation Solution
A method and network node that utilize machine learning techniques to extract session features from terminal logs, convert them into numerical representations, and apply anomaly detection to identify anomalous sessions, users, and commands, reducing the need for manual rule-based matching and enabling efficient detection of outliers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If rule-based systems are used to scan terminal session logs, then known suspicious patterns can be detected, but the system cannot handle the heterogeneous and unstructured nature of logs from different deployments
Solution Approach 1:
The patent transforms unstructured terminal session logs into structured feature vectors by extracting relevant parameters (command sequences, timing patterns, user behavior metrics). This parameter transformation enables the system to process heterogeneous log formats from different deployments uniformly, resolving the contradiction between detection reliability and log format compatibility.
Solution Approach 2:
The patent introduces an intermediary layer (feature extraction and representation module) between the raw logs and the anomaly detection system. This intermediary transforms diverse log formats into a standardized intermediate representation, allowing the detection algorithm to focus on behavioral patterns rather than format variations, thus maintaining both reliability and adaptability.
2Reliability
If comprehensive scanning of all terminal session logs is performed, then all anomalous behaviors can be detected, but the manual effort and time required become prohibitive
Solution Approach 1:
The patent replaces manual scanning and analysis of terminal session logs with an automated machine learning-based anomaly detection system. The system automatically extracts features, processes logs, and identifies anomalies without human intervention, eliminating the prohibitive manual effort and time while maintaining comprehensive detection capability.
Solution Approach 2:
The patent implements a self-service anomaly detection system that automatically processes logs, learns normal behavior patterns, and identifies deviations without requiring manual configuration or review. The system serves itself by continuously learning from incoming logs and adapting to new patterns, reducing both time loss and manual effort.
3Measurement precision
If custom patterns and rules are created for each deployment, then detection accuracy for that specific deployment improves, but the complexity of maintaining multiple rule sets increases
Solution Approach 1:
The patent creates a universal anomaly detection system that can handle multiple deployments simultaneously through a single unified model. The feature extraction process captures deployment-specific characteristics automatically, allowing the same system to adapt to different environments without requiring separate rule sets, thus reducing complexity while maintaining precision.
Solution Approach 2:
The patent implements a dynamic rule generation approach where the system learns and adapts to each deployment's specific patterns automatically. Rather than maintaining static custom rules, the system dynamically adjusts its understanding of normal behavior for each deployment context, reducing manual rule management complexity while preserving detection precision.
Data Source
AI summary
Embodiments of the present disclosure provide a method, a network node, and a computer program product for detecting anomalous access behaviours in a plurality of network nodes in a communication network. The method is performed in a network in the communication network. The method includes obtaining session logs associated with the plurality of network nodes in the communication network. The method includes extracting session features for each session by evaluating the session logs associated with the plurality of network nodes. Further, the method includes determining access behaviours associated with each session based on the extracted session features, the access behaviours associated with each session including a representation indicative of one or more of session characteristics, user access characteristics, network node access characteristics and command usage characteristics. The method further includes detecting (S14) anomalous access behaviours by analysing the determined access behaviours.