Network Anomaly Detection via Bayesian Inference
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security systems face challenges in detecting anomalous network traffic and malicious activities in real-time, particularly in identifying changes in device connections and network behavior that may indicate malicious communication or unauthorized access.
Innovation Solution
A monitoring device generates a network map of nodes and edges representing communications paths, analyzes node and edge activity, and calculates anomaly scores using Bayesian inference and machine learning to identify deviations from expected behavior, triggering actions such as alerting users or restricting network access when anomaly scores exceed thresholds.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional network security systems are used to detect anomalous traffic, then system simplicity is maintained, but detection precision and real-time capability deteriorate
Solution Approach 1:
The system segments network analysis into two distinct components: a network map component that structures network relationships and a statistical anomaly detection component that identifies deviations. This segmentation allows each component to specialize, improving detection precision while managing complexity through modular architecture.
Solution Approach 2:
The patent introduces a network map as an intermediary data structure that mediates between raw network traffic data and anomaly detection algorithms. This intermediary layer organizes network relationships and facilitates more precise anomaly detection without directly increasing the complexity of the core detection logic.
2Reliability
If comprehensive network monitoring is implemented to detect all malicious activities, then detection reliability improves, but processing time and computational resources increase
Solution Approach 1:
The system performs preliminary actions by building a network map that pre-structures network relationships and expected traffic patterns before anomaly detection occurs. This pre-processing enables faster real-time detection by comparing actual traffic against the pre-established map, improving reliability without proportionally increasing processing time.
Solution Approach 2:
The patent implements periodic updates to the network map and statistical models, allowing the system to adapt to changing network conditions while maintaining efficient real-time detection. This periodic refresh approach ensures detection reliability improves over time without requiring continuous full-reconstruction processing.
3Adaptability or versatility
If statistical models are updated in real-time to adapt to new threats, then adaptability improves, but system stability and false positive rates worsen
Solution Approach 1:
The system implements feedback mechanisms where detection results and network changes are fed back into the network map and statistical models for periodic updates. This controlled feedback loop enables the system to adapt to new threats while maintaining stability by adjusting models based on accumulated evidence rather than immediate fluctuations.
Solution Approach 2:
The patent employs statistical confidence thresholds and validation rules as a form of cushioning that prevents hasty model updates based on insufficient data. This cushioning mechanism allows the system to adapt to genuine threats while filtering out noise and false patterns, maintaining stability during the adaptation process.
Data Source
Figure 1
Figure 2
Figure 3A
AI summary
Methods, systems, and apparatus, including computer programs encoded on computer storage media, for determining network related anomaly scores. One of the methods includes generating a network map including at least a plurality of network nodes and a plurality of edges that indicate communications paths between the plurality of network nodes, obtaining first data indicating network activity over the edges and between the plurality of network nodes for a first time period, generating a model of expected network activity over the edges and between the plurality of network nodes for a future time period using the network map and the first data, obtaining second data indicating network activity over the edges and between the plurality of network nodes for a second time period, and determining an anomaly score using a comparison between the second data and the model of expected network activity.