Network Intrusion Detection via Segmented Anomaly Modeling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current approaches face challenges in distinguishing between legitimate and malicious network accesses in computer networks, making it difficult to detect potential security breaches and compromises of sensitive information.
Innovation Solution
A computer-implemented system and method that segments network activity data to generate predictive models using unsupervised learning techniques, such as compression neural networks, to analyze and detect anomalous behavior, with scoring mechanisms to identify potentially malicious activities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If current approaches are used to analyze network accesses, then the system can process all network traffic, but it cannot effectively distinguish between legitimate and malicious accesses
Solution Approach 1:
The patent segments network activity data into multiple segments based on different characteristics (e.g., protocol type, traffic patterns, time of day). Each segment is then analyzed by specialized predictive models trained on specific types of network behavior. This segmentation allows the system to focus detection resources on anomalous patterns within each category, improving overall detection accuracy while reducing false positives by comparing against segment-specific baselines rather than generic thresholds.
2Adaptability or versatility
If unsupervised learning techniques are used to generate predictive models, then the system can detect unknown attack patterns, but the model generation process becomes more complex
Solution Approach 1:
The patent pre-segments network activity data into meaningful categories before applying unsupervised learning techniques. This preliminary organization of data into segments (e.g., by protocol, source/destination, time patterns) provides a structured foundation that guides the unsupervised model generation process. By preparing the data in advance with appropriate segmentation and feature extraction, the system enables unsupervised models to more efficiently discover novel attack patterns without requiring as much computational complexity during the actual model training phase.
Data Source
AI summary
Computer-implemented systems and methods for analyzing activities associated with accesses of a computer network. A computer-implemented method can be configured to receive data related to the activities associated with the accesses of a computer network. The network activities data are segmented into a plurality of network activities segments. For each of the network activities segments, an anomaly detection predictive model is generated. The generated predictive models are for use in analyzing the activities associated with the computer network.