Hierarchical Network Anomaly Detection Through Nested Node Visualization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The complexity of large-scale computer networks makes it difficult to timely identify and rectify anomalous activity, leading to wasted resources and challenges in representing device relationships for anomaly detection.
Innovation Solution
A method and system for network anomaly detection that generates a graphical representation of nested groups of network nodes, with node sizes proportional to aggregated parameters, and identifies anomalous nodes based on size thresholds for transaction decline.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If network monitoring covers all nodes in a large-scale network, then anomaly detection completeness is improved, but system complexity and difficulty of representation increase
Solution Approach 1:
The patent segments the large-scale network into hierarchical groups (e.g., data centers, networks, sub-networks) where each group contains smaller units. This segmentation allows monitoring to be performed at multiple levels of granularity, maintaining detection completeness while reducing the complexity of representing and analyzing the entire network simultaneously.
Solution Approach 2:
The patent implements a nested hierarchical structure where groups contain sub-groups which contain individual nodes. This nesting allows the system to represent the network at different levels of detail - from individual nodes up to entire data centers - enabling comprehensive monitoring without overwhelming system complexity by allowing selective visualization and analysis at appropriate levels.
2Measurement precision
If detailed representation of all network relationships is provided, then anomaly detection accuracy is improved, but ease of operation and analysis decreases
Solution Approach 1:
The patent implements dynamic visual representation where the level of detail can be adjusted based on the analysis needs. Users can dynamically navigate through hierarchical levels, expanding or collapsing groups as needed. This dynamic approach maintains accuracy by preserving detailed relationship data while improving ease of operation by allowing users to view only the necessary level of detail at any given time.
Solution Approach 2:
The patent adds a hierarchical dimension to the network representation, transforming a flat complex graph into a multi-level hierarchical structure. This additional dimensional organization allows detailed relationships to be preserved in the data structure while presenting a more manageable visual representation through hierarchical grouping and nested displays.
3Loss of time
If real-time monitoring of all network activity is performed, then anomaly detection timeliness is improved, but resource consumption increases
Solution Approach 1:
The patent implements partial monitoring at different hierarchical levels, where not all nodes are monitored at the same intensity simultaneously. The system can perform aggregate monitoring at higher levels and detailed monitoring at lower levels only when anomalies are detected or suspected. This partial action approach maintains timely anomaly detection while reducing overall resource consumption by avoiding excessive monitoring of all nodes at all times.
Data Source
AI summary
Provided are a system, method, and computer program product for network anomaly detection. The method includes determining a plurality of nested groups based on event data associated with a plurality of communications in a computer network. The method also includes generating display data configured to cause a display of a computing device to show a first graphical representation of the event data including a plurality of nested graphical nodes. The method further includes receiving new event data associated with a plurality of new communications in the computer network in a subsequent time period and generating new display data configured to cause the display to show a new graphical representation of the new event data. The method further includes determining an anomalous graphical node based at least partly on a size of the anomalous graphical node being increased in the new graphical representation relative to the first graphical representation.