Network Anomaly Clustering for Unknown Attack Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Detecting new types of anomalies in computer networks is challenging due to increasing complexity and the limitations of signature-based intrusion detection systems, which cannot identify previously unknown attacks or malfunctions.

Innovation Solution

A method involving a computer-implemented anomaly detection system that learns normal network traffic patterns, clusters anomalous traffic, and identifies new types of anomalies through unsupervised machine learning, while updating models to adapt to changing network behaviors.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If signature-based intrusion detection systems are used to detect network attacks, then known attack patterns can be identified, but new types of attacks cannot be detected

Engineering Contradiction:

Improvedetection accuracyVSAvoidability to detect new attacks

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The system dynamically adapts by learning normal network behavior patterns during a training phase and continuously updating its understanding of baseline traffic. This dynamic adaptation enables the system to detect new attack types that deviate from learned normal behavior, resolving the contradiction between reliable known-pattern detection and adaptability to new threats

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The system performs preliminary learning of normal network behavior during a training phase before actual anomaly detection begins. By establishing a baseline of normal traffic patterns in advance, the system can reliably detect deviations caused by new attack types without requiring pre-programmed signatures for them

Inventive Principle:

Principle #10Preliminary action

2Measurement precision

If manual analysis of network traffic is performed to identify undesirable activity, then detailed inspection can be conducted, but detection time increases significantly

Engineering Contradiction:

Improveanalysis depthVSAvoiddetection delay

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The system replaces manual mechanical analysis with automated machine learning-based anomaly detection. The trained model automatically analyzes network traffic patterns, providing both detailed inspection capability and rapid detection without the time constraints of human analysis, thereby resolving the contradiction between analysis depth and detection speed

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The system performs self-analysis by automatically comparing observed network traffic against learned normal behavior patterns. The automated anomaly detection mechanism independently identifies undesirable activity without requiring manual intervention, achieving both thorough analysis and timely detection

Inventive Principle:

Principle #25Self-service

3Adaptability or versatility

If anomaly-based intrusion detection systems analyze all network traffic to detect deviations from normal behavior, then new attack types can be detected, but system complexity increases

Engineering Contradiction:

Improveability to detect unknown attacksVSAvoiddetection system complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The system segments the detection process into distinct phases: a training phase for learning normal behavior patterns and a detection phase for identifying anomalies. This segmentation simplifies the overall system complexity by separating the complex learning process from the ongoing detection process, while maintaining the ability to detect new attack types

Inventive Principle:

Principle #1Segmentation

4Area of stationary object

If the scope of network monitoring is expanded to cover larger and more complex networks, then more comprehensive coverage is achieved, but detection difficulty increases

Engineering Contradiction:

Improvenetwork coverageVSAvoidanomaly detection difficulty

Core Design Contradiction:

Area of stationary objectVSDifficulty of detecting and measuring

Solution Approach 1:

The system employs universal machine learning techniques that can be applied across diverse network types and scales. The anomaly detection approach is universally applicable to any network environment, automatically adapting to different network sizes and complexities without requiring specialized detection methods for each scenario

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS12634311B2Network anomaly detection

Publication Date: 2026.05.19 BRITISH TELECOM PLC

AI summary

A computer implemented method for detecting anomalies in a computer network is provided together with a network monitoring system and computer programs for carrying out the method. The method obtains a model representing normal characteristics of network traffic associated with a set of devices within the computer network. The method analyses network traffic using the model to identify anomalous network traffic associated with the set of devices. The method clusters the anomalous network traffic into clusters of network traffic that share similar characteristics. The method provides an indication that either (i) the network traffic associated with a cluster relates to a new type of anomaly involving the set of devices or (ii) that no new types of anomaly are present.