Network Anomaly Detection via Host Connection Profiling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network anomaly detection systems face challenges in efficiently identifying unauthorized access and other security threats, such as denial of service attacks and worm propagation, due to high false positive rates and the need for complex user-defined thresholds.
Innovation Solution
A method that retrieves connection pairs from a connection table to determine if a host attempting access has previously accessed another host, and uses heuristics to assess connection patterns for anomalies, including TCP usage, port unfamiliarity, and short connection patterns, to establish an event severity level indicating potential unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional network anomaly detection systems use fixed thresholds and complex user-defined rules, then they can detect security threats, but they generate high false positive rates and require extensive user intervention
Solution Approach 1:
The system performs self-learning by automatically analyzing network connection patterns and building profiles of normal behavior for each host. It self-adjusts detection thresholds based on observed anomalies and connection characteristics, eliminating the need for manual threshold configuration and reducing false positives without requiring extensive user intervention
Solution Approach 2:
The system continuously monitors network traffic and uses feedback from observed connection patterns to refine its anomaly detection algorithms. By analyzing actual network behavior over time and adjusting its profiles accordingly, the system improves detection accuracy while adapting to changing network conditions without user intervention
2Reliability
If the system monitors all connection patterns to detect anomalies, then detection capability improves, but system complexity and processing requirements increase
Solution Approach 1:
The system segments network monitoring by creating individual connection profiles for each host, tracking only the relevant connection patterns for that specific host. This segmentation allows comprehensive anomaly detection for each host without requiring the system to process all network traffic uniformly, reducing overall system complexity
Solution Approach 2:
The system applies partial monitoring by focusing analysis only on connection patterns that deviate from established host profiles, rather than uniformly analyzing all connections. This selective approach maintains high detection capability for anomalies while reducing processing requirements for normal traffic
3Measurement precision
If the system uses multiple anomaly detection heuristics, then detection precision improves, but the time required for analysis increases
Solution Approach 1:
The system performs preliminary learning by establishing baseline connection profiles for each host during normal operation. By pre-characterizing typical host behavior patterns, the system enables rapid anomaly detection without requiring time-consuming analysis of all connection parameters during incident detection
Solution Approach 2:
The system applies different detection heuristics locally for each host based on its specific connection patterns and profile, rather than applying a uniform set of rules to all traffic. This localized approach improves detection precision for each host's specific anomaly types while reducing overall analysis time by avoiding irrelevant checks
Data Source
AI summary
A system for detecting network intrusions and other conditions in a network is described. The system includes a plurality of collector devices that are disposed to collect data and statistical information on packets that are sent between nodes on a network. An aggregator device is disposed to receive data and statistical information from the plurality of collector devices. The aggregator device produces a connection table that maps each node on the network to a record that stores information about traffic to or from the node. The aggregator runs processes that determine network events from aggregating of anomalies into network events.