Network Anomaly Detection via Time-Series Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network management centers face challenges in promptly and accurately identifying network issues and anomalies from state information transmitted by network devices, particularly in large datasets with low signal-to-noise ratios, which can lead to delayed mitigation of problems such as DDoS attacks.
Innovation Solution
The implementation of a network management component that calculates correlation values between time-series signals from network devices to identify related devices involved in anomalies, allowing for automatic adjustment of traffic parameters to mitigate issues like DDoS attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If network management centers analyze state information from multiple network devices to detect anomalies, then detection accuracy improves, but analysis time increases due to large datasets with low signal-to-noise ratios
Solution Approach 1:
The patent segments the large dataset of state information by grouping it according to correlation values. The network management component calculates correlation values between different state information records, divides them into correlated groups, and analyzes each group separately. This segmentation reduces the complexity of analyzing the entire large dataset at once, thereby reducing analysis time while maintaining detection accuracy through focused analysis of correlated groups.
2Reliability
If the network management center monitors all network devices continuously, then anomaly detection capability improves, but system complexity increases
Solution Approach 1:
The patent extracts only the most relevant state information records by calculating correlation values and identifying correlated groups. Instead of processing all state information from all network devices equally, the system extracts and focuses on records with high correlation values that are most likely to contain anomaly patterns. This extraction approach maintains reliable anomaly detection while reducing system complexity by eliminating unnecessary processing of low-correlation data.
3Measurement precision
If correlation analysis is performed on all state information records, then anomaly detection accuracy improves, but processing load increases
Solution Approach 1:
The patent implements dynamic processing where the network management component adaptively adjusts its analysis based on correlation values. Instead of uniformly processing all state information records with the same computational intensity, the system dynamically identifies correlated groups and concentrates processing resources on these high-value groups. This dynamic approach maintains high anomaly detection accuracy while reducing overall processing load by avoiding exhaustive analysis of all records.
Data Source
AI summary
State information relating to the operation of network devices is used to identify network issues and/or anomalies relating to the operation of the network. The state information from the network devices may include time-series signals from a number of the network devices. Correlation values may be obtained between pairs of time-series signals. Pairs of time-series signals that have a relatively high correlation value may be determined to be related to one another. In one implementation, mitigation of the network issues/anomalies may be automatically performed based on calculated correlation values.