Network Anomaly Detection via Wavelet and SVD Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network anomaly detection methods face challenges in accurately and efficiently identifying unusual network activity due to high variability in normal traffic, leading to false positives or missed anomalies, especially with complex models requiring significant data storage and computational power.
Innovation Solution
A network anomaly detector that combines wavelet analysis for variability characterization and singular value decomposition for interrelationship analysis, using different time windows and historical data to balance local and global detection, reducing false alarms and adapting to normal behavior.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If simple thresholding techniques are used to limit false positive detections, then false positives are reduced, but important anomalies with minor changes in fundamental network statistics cannot be detected
Solution Approach 1:
The patent segments network traffic analysis into multiple statistical dimensions (packet counts, byte counts, flow rates, protocol distributions) and time-based components (short-term variability, long-term trends, seasonal patterns). By dividing the analysis into these segments, the system can detect anomalies in any single dimension without requiring high thresholds across all dimensions, thus maintaining sensitivity while controlling false positives.
Solution Approach 2:
The patent transforms the anomaly detection problem from examining single statistical measures to analyzing multi-dimensional statistical patterns. By incorporating multiple network statistics and their interrelationships, the system detects anomalies that manifest as subtle changes across multiple dimensions simultaneously, rather than requiring large changes in any single statistic.
2Measurement precision
If complex models such as neural nets are used to model normal network behavior, then detection of known anomalies is improved, but detection of unknown or unexpected anomalies is compromised and computational requirements increase
Solution Approach 1:
The patent employs computationally efficient statistical calculations that can be performed rapidly and discarded, rather than maintaining complex persistent models. By using simple statistical measures (means, variances, correlations) that can be recalculated frequently with minimal computational overhead, the system achieves adaptive anomaly detection without the burden of training and maintaining complex neural networks.
Solution Approach 2:
The patent changes the parameters being monitored from raw network traffic volumes to derived statistical parameters (coefficients of variation, correlation coefficients, statistical distances). This transformation allows the system to detect anomalies through changes in statistical relationships rather than requiring complex pattern recognition, reducing computational complexity while maintaining detection effectiveness.
3Measurement precision
If highly sophisticated automated detection techniques are used, then detection accuracy may be improved, but large amounts of data storage and computer power are required making them impractical for routine network analysis
Solution Approach 1:
The patent extracts only the essential statistical features from network traffic data that are necessary for anomaly detection, rather than storing and analyzing complete raw traffic captures. By calculating and retaining only key statistical parameters (means, variances, correlations, and their temporal patterns), the system achieves effective anomaly detection with minimal data storage requirements.
Data Source
AI summary
A network anomaly detector evaluates two complementary measurements of network statistics, a time variation and correlation among those statistics, to provide an extremely robust detection of network anomalies. In one embodiment, the variability and correspondence are compared against historically derived thresholds to provide for a system that accommodates to local network conditions and evolving network qualities.