Network Anomaly Detection Using Packet-Length Pattern Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for detecting anomalies in network traffic are unreliable, especially with the rapid growth of IoT devices and varying traffic trends, as they require deep packet inspection and significant computational power, and struggle with encrypted traffic and scaling networks.
Innovation Solution
The use of statistical features based on packet length values, generated using the Lempel-Ziv-Welch compression algorithm, and an unsupervised machine learning algorithm to determine trends and detect anomalies in network traffic without deep analysis of packet length values.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If deep packet inspection is used to detect anomalies, then detection reliability is improved, but computational power requirements increase significantly
Solution Approach 1:
The patent extracts only the essential feature (packet length) from the complete packet data, eliminating the need for deep packet inspection. By focusing on this single extracted feature rather than analyzing entire packets, the system achieves anomaly detection with minimal computational overhead while maintaining reliability through statistical analysis of the extracted packet length sequences.
2Ease of manufacture
If conventional detection methods are used, then implementation is simpler, but adaptability to varying traffic trends and IoT devices deteriorates
Solution Approach 1:
The patent changes the parameter being analyzed from complex packet content to simple packet length sequences. This parameter transformation enables the system to adapt to varying traffic trends and IoT device patterns without requiring complex algorithms, maintaining implementation simplicity while significantly improving adaptability through statistical analysis of length-based patterns.
3Measurement precision
If Deep Packet Inspection is used to scan entire packet streams, then detection accuracy is improved, but processing time and computational resources increase
Solution Approach 1:
The patent extracts only packet length information from complete packets, discarding the need to inspect entire packet streams. This extraction approach maintains detection accuracy by focusing on the distinctive pattern of packet lengths that characterize anomalies, while dramatically reducing processing time since only a single numerical value needs to be captured per packet rather than analyzing the entire packet content.
Data Source
AI summary
Examples relate to detection of anomalies in a network. Some examples determine a dictionary including a set of keys for a set of packet length values for a selected sequence of packets associated with a traffic flow over a network, each key represents a combination of two or more successive packet length values from the set of packet length values. An aggregated set of statistical features is determined based in part on the set of statistical features using a machine learning algorithm. Upon determining another set of packet length values for another selected sequence of packets, another set of statistical features for the other set of packet length values is determined. The other set of statistical features is compared with the aggregated set of statistical features. Based on the comparison, an indication that an anomaly has occurred in the traffic flow is transmitted to an administrator.