Network Anomaly Identification via Application Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional network monitoring tools cannot identify specific applications causing anomalies in networks, leading to difficulties in security and performance issues, especially when the anomalous application stops executing or operates briefly, using different ports.
Innovation Solution
A monitoring engine is installed on nodes to collect and correlate network information with application information, including application names, IDs, process IDs, and source code sections, to determine which application generates network traffic, enabling identification of anomalies even after the application has stopped or changed ports.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If conventional network monitoring tools are used to monitor network communications, then network information such as IP addresses and ports can be collected, but the specific applications causing anomalies cannot be identified
Solution Approach 1:
The patent segments the monitoring function into two parts: network-level monitoring (IP addresses, ports) and application-level monitoring (application names, process IDs). By collecting both layers of information separately and correlating them through timestamps and process hierarchy, the system recovers lost application identification information without creating a single complex monolithic monitoring device.
Solution Approach 2:
The patent adds a new dimension of monitoring by capturing process hierarchy information (parent-child process relationships) and application metadata (application names, process IDs) alongside traditional network information. This multi-dimensional approach enables identification of applications causing anomalies even when they use different ports or execute briefly.
2Measurement precision
If manual searching through applications is performed to identify the cause of anomalies, then the application can potentially be found, but it requires excessive time and is ineffective when the application stops executing or changes ports
Solution Approach 1:
The patent performs preliminary action by continuously collecting and storing application information (process IDs, application names, process hierarchy) and network information with precise timestamps before anomalies occur. When an anomaly is detected, the pre-collected data can be immediately queried and correlated, eliminating the need for time-consuming manual searching and enabling identification even if the application has since stopped executing.
Solution Approach 2:
The patent establishes a feedback mechanism where network traffic is continuously monitored and correlated with application execution data. When an anomaly is detected in network traffic, the system provides feedback by querying the stored application information to identify the responsible application, creating a closed-loop system that automatically identifies anomaly sources without manual intervention.
3Adaptability or versatility
If brief-execution applications using different ports are monitored, then network traffic can be captured, but traditional monitoring tools cannot track the application across multiple executions and port changes
Solution Approach 1:
The patent performs preliminary action by pre-collecting and storing application identification information (process IDs, application names) and network information (ports, IP addresses) with precise timestamps before anomalies occur. This creates a historical record that can be queried later to track applications across multiple executions and port changes, maintaining application identity continuity even when the application behaves dynamically.
Solution Approach 2:
The patent adds process hierarchy information as another dimension to the monitoring data. By capturing parent-child process relationships and application metadata, the system can track applications across port changes and brief executions through their process identity, enabling versatile tracking that traditional single-dimension port-based monitoring cannot achieve.
Data Source
AI summary
Systems and methods that determine an anomaly in a network are provided. A monitoring engine is installed on a computing device that monitors network information and application information for data flows generated on the computing device and transmitted over a network and for data flows received by the computing device from the network. The network information includes an internet protocol (IP) source address, a source port, an IP destination address, a destination port, and a transport protocol, and a number of bytes sent or received by the flow. The application information includes a process identifier (ID), the threads ID, an application ID and/or a function call, arguments passed to the function, a stack trace of the function, etc., that application used to generate the data flows. The network information and application information can be used to identify the application, thread and/or a function that caused an anomaly in the network.