Two-Stage Network Anomaly Detection for Lower Processing Load
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anomaly detection methods in networks require significant processing resources, such as processor capacity and memory, making them inefficient and resource-intensive.
Innovation Solution
An anomaly detection method that involves a gateway device detecting anomalies in control information flowing through a network, transmitting instructions to devices for further anomaly detection in control logs, and using machine learning models to identify anomalies in both communication and control data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If anomaly detection is performed on all control information flowing in the network, then detection accuracy is improved, but processing resources (processor capacity and memory) are excessively consumed
Solution Approach 1:
The anomaly detection process is segmented into two distinct stages: a first detection step that performs initial anomaly detection on control information, and a second detection step that performs further anomaly detection on control logs only when anomalies are detected in the first step. This segmentation allows the system to maintain high detection accuracy while reducing overall processing resource consumption by limiting intensive processing to only when necessary.
Solution Approach 2:
Instead of performing full anomaly detection processing on all control information continuously, the system applies partial processing in the first detection step, and only performs the more resource-intensive second detection step partially - specifically when anomalies are detected in the first step. This selective application of processing power significantly reduces resource consumption while maintaining detection effectiveness.
2Reliability
If constant monitoring of control logs from all devices is implemented, then anomaly detection reliability is improved, but device complexity and processing load increase
Solution Approach 1:
The detection system is divided into two functional components: a first detector that monitors control information and a second detector that analyzes control logs. This segmentation allows the system to maintain reliable anomaly detection by having specialized detectors for different data types, while reducing overall system complexity through clear functional separation and conditional execution.
Solution Approach 2:
The first detector performs preliminary anomaly detection on control information before the second detector analyzes control logs. This preliminary action filters out normal operations early in the process, allowing the more complex second detection step to focus only on potentially problematic cases, thereby reducing the overall processing load and system complexity while maintaining reliability.
Data Source
AI summary
An anomaly detection method according to one aspect of the present disclosure is an anomaly detection method to be executed by an anomaly detection device communicable with a plurality of devices that are communicable with each other via a predetermined network, and includes: a first detection step of detecting an anomaly in first control information that flows in the predetermined network; and a second detection step of transmitting, to the plurality of devices, a first instruction for causing transmission of second control information, and detecting an anomaly in the second control information received, when the anomaly is detected in the first detection step, the second control information indicating content of control executed by, among the plurality of devices, a device that has transmitted the second control information.