Network Anomaly Detection via Correlation Coefficient
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security solutions struggle to accurately detect traffic abnormalities in intranets due to sensitivity to clock synchronization and scaling issues, leading to errors in data flow detection.
Innovation Solution
A method that aggregates net flows by attributes over time intervals, calculates dissimilarities in angle between time sequences using sine values, and employs a one-class Support Vector Machine (SVM) classifier to classify normal or abnormal data flows, ensuring accurate detection regardless of clock synchronization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If Euclidean distance is used to measure dissimilarity between time sequences, then the method can detect abnormality in data flows, but the detection becomes sensitive to translation and expanding transformations caused by clock synchronization issues and different recording scales
Solution Approach 1:
The patent changes the measurement parameter from Euclidean distance to correlation coefficient. The correlation coefficient measures the linear relationship between two variables and is invariant to translation and scaling transformations, thereby resolving the sensitivity issue while maintaining detection accuracy for abnormal data flows
Solution Approach 2:
The patent substitutes the mechanical distance measurement system with a statistical correlation-based system. By replacing Euclidean distance calculation with correlation coefficient calculation, the system becomes robust against clock synchronization variations and recording scale differences
2Ease of manufacture
If rule-based defending solutions are deployed, then the system can be implemented with existing security devices, but the system cannot accurately detect complex abnormal traffic patterns in intranets
Solution Approach 1:
The patent enables the system to automatically learn normal traffic patterns from historical data and generate detection rules dynamically. The system performs self-training by analyzing past net flow data to establish baseline behavior, then automatically detects abnormalities without requiring manual rule configuration, thereby improving detection accuracy while maintaining implementation feasibility
3Reliability
If existing anomaly detection methods are used, then the system can identify abnormal data flows, but false positives increase due to elimination of transformations in time sequences
Solution Approach 1:
The patent changes the dissimilarity measurement from Euclidean distance to correlation coefficient, which naturally handles transformations in time sequences. This parameter change eliminates false positives caused by clock synchronization variations and recording scale differences while maintaining reliable detection of actual abnormal traffic patterns
Data Source
AI summary
A network traffic anomaly detection method and apparatus is provided. The method includes: acquiring network flows generated by a network monitoring node within a set period of time; for any one of attributes in the network flows, aggregating the network flows at a set time interval according to the attribute to generate N time sequences with respect to the attribute; determining N samples to be detected corresponding to the network flows according to the N time sequence, calculating respective angular dissimilarity degrees between a first time sequence and N−1 second time sequences corresponding to a first attribute in the other N−1 samples to be detected, and determining a first detection result with respect to the first time sequence; and determining whether each of the samples to be detected is an abnormal data stream according to a detection result.