Network Message Detection Using Burst-Aware Reception Intervals
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies struggle to accurately detect abnormalities in networks due to issues like burst phenomena, leading to erroneous detection or overlooking of unauthorized messages.
Innovation Solution
A detection device and method that calculates reception intervals of periodic messages, identifies delay messages and burst messages, and adjusts detection processes based on count values to accurately determine the presence of unauthorized messages.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If the detection device performs detection process based on reception intervals for all messages, then unauthorized messages can be detected, but erroneous detection occurs during burst phenomena
Solution Approach 1:
The detection device segments the message stream by identifying burst phenomena as distinct periods. During non-burst periods, the detection process operates normally using reception interval analysis. When burst phenomena are detected, the system transitions to a different mode that prevents erroneous detection while still monitoring for unauthorized messages. This segmentation allows the system to adapt its detection strategy based on the current state of the network traffic.
Solution Approach 2:
The detection device dynamically adjusts its detection behavior based on the detected state of the network. The system transitions between different operational modes: normal detection mode for regular traffic and burst suppression mode when burst phenomena are detected. This dynamic adaptation allows the system to maintain high detection accuracy for unauthorized messages while avoiding false positives during burst periods by adjusting the detection thresholds and criteria based on the current traffic pattern.
2Reliability
If the detection device skips detection during burst phenomena, then erroneous detection is prevented, but unauthorized messages within bursts may be overlooked
Solution Approach 1:
The detection device introduces an intermediary analysis layer that operates during burst phenomena. Instead of completely skipping detection, the system uses a different set of criteria and thresholds specifically designed for burst conditions. This intermediary detection mechanism analyzes messages during bursts using relaxed interval thresholds and alternative detection logic that accounts for the compressed timing characteristics of burst traffic, allowing unauthorized messages to be detected even within the chaotic burst environment.
Solution Approach 2:
The system changes the detection parameters dynamically based on the operational mode. During burst phenomena, the detection device adjusts key parameters such as reception interval thresholds, detection sensitivity levels, and timing criteria to accommodate the compressed and irregular message patterns characteristic of bursts. These parameter changes enable the system to maintain detection capability during bursts while preventing false positives that would occur with standard detection parameters.
3Ease of operation
If the detection device uses fixed detection thresholds, then the detection process is simple, but accuracy decreases when burst phenomena occur
Solution Approach 1:
The detection device implements dynamic threshold adjustment based on the detected operational state. The system maintains a set of base thresholds for normal operation and automatically switches to alternative threshold sets when burst phenomena are detected. This dynamic threshold mechanism preserves the simplicity of the detection process from the operator's perspective while internally adapting the parameters to match current traffic conditions, thereby maintaining high detection accuracy across different operational scenarios without requiring complex manual reconfiguration.
Data Source
AI summary
A detection device includes: a calculation unit configured to calculate reception intervals of the target messages; a detection unit configured to perform a detection process based on the reception intervals; and a counting unit configured to count a plurality of burst messages including a delay message that is a target message whose reception interval is larger than the transmission cycle by a predetermined value or more, and one or more target messages which are received subsequently to the delay message and whose reception interval is equal to or smaller than a predetermined value. The detection unit, based on a count value obtained by the counting unit, determines whether or not to perform the detection process based on the reception intervals, for at least one burst message among the plurality of burst messages.