Network Anomaly Detection via Dynamic Data Structures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network anomaly detection methods, such as Network Intrusion Detection Systems, require high processing power and can be slow in tracking ongoing flows, making them inefficient in real-time anomaly detection, particularly in IoT and automotive networks prone to hacking attacks.
Innovation Solution
A method using an electronic device with a processing circuit that computes packet stream identifiers based on source and destination addresses, and stores metadata in an ordered dynamic data structure like a skip list or balanced binary tree, allowing for efficient searching and blocking of anomalous packet streams.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional Network Intrusion Detection Systems are used to detect network anomalies, then detection capability is provided, but processing power consumption is high and tracking speed is slow
Solution Approach 1:
The patent extracts only the essential metadata fields (source IP, destination IP, source port, destination port, protocol) from packet headers to create flow identifiers, rather than processing complete packet contents. This extraction approach reduces processing power requirements while maintaining anomaly detection capability through statistical analysis of these key fields.
Solution Approach 2:
The patent segments network traffic into distinct flows based on metadata characteristics, organizing them in separate data structures (ordered dynamic data structure with skip list). This segmentation allows parallel processing and selective monitoring of different traffic types, reducing overall processing power consumption while maintaining comprehensive detection coverage.
2Reliability
If traditional Network Intrusion Detection Systems track all ongoing flows, then complete monitoring is achieved, but processing speed decreases
Solution Approach 1:
The patent employs dynamic data structures (skip list) that automatically adjust their organization based on traffic patterns. The ordered dynamic data structure allows efficient insertion and search operations with average O(log n) complexity, enabling fast tracking of ongoing flows while maintaining completeness through continuous updates of flow statistics.
Solution Approach 2:
The patent performs preliminary classification of packet flows into distinct categories based on metadata before detailed analysis. By pre-organizing flows into separate tracking structures based on their characteristics, the system prepares data for rapid statistical analysis, improving tracking speed while maintaining comprehensive monitoring through systematic organization of all flows.
3Quantity of substance
If metadata is stored in a traditional data structure, then all packet stream information is captured, but search and insertion operations become complex and time-consuming
Solution Approach 1:
The patent transforms the traditional two-dimensional array or hash table approach into a one-dimensional ordered dynamic data structure (skip list) organized by packet stream identifiers. This dimensional reorganization enables efficient search and insertion operations through sorted order properties, reducing operational complexity while maintaining comprehensive metadata storage capacity through systematic ordering of all packet stream records.
Data Source
AI summary
A method of detecting network anomalies includes the reception, via an interface of an electronic device, of a first stream of packets sent by a source that is external and/or the transmission of a first stream of packets to a destination external; the computation, by a processing circuit, of a first packet stream identifier based on at least one of: a packet source address of the packets of the first stream; and a packet destination address of the first stream; searching, in an ordered dynamic data structure stored in a memory and including a plurality of entries. The searching is performed based on the value of the first packet stream identifier with respect to one or more search threshold values; and based on metadata associated with the first entry, blocking reception of the first stream of packets.