Anomaly Detection in Network Protocol Processes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Detecting anomalies in network protocol processes within switches in a data-center or large-scale network is challenging, as existing methods often fail to accurately identify issues such as protocol implementation errors or system attacks, leading to potential switch shutdowns and network disruptions.
Innovation Solution
A method utilizing probabilistic statistical models to analyze network feature variables, including CPU usage and protocol data units, to detect anomalies by calculating normalized parameter vectors and using multivariate distribution functions to identify deviations from expected behavior, with optional dimensionality reduction via Principal Component Analysis (PCA) for efficient computation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If probabilistic statistical models with multivariate distribution functions are used to analyze network feature variables, then anomaly detection precision is improved, but computational complexity increases
Solution Approach 1:
The patent segments the anomaly detection process into distinct phases: data collection from network switches, normalization of network feature variables, application of multivariate distribution functions for anomaly scoring, and remedial action generation. This segmentation allows complex computations to be distributed and managed in manageable stages, reducing overall computational complexity while maintaining detection precision.
Solution Approach 2:
The patent applies preliminary normalization to network feature variables before they are fed into the multivariate distribution function. By pre-processing the data to establish baseline statistics and normalize variables, the system reduces the computational burden on the anomaly detection algorithm itself, enabling precise detection without excessive computational complexity.
2Reliability
If comprehensive network feature variables are monitored to improve anomaly detection accuracy, then detection reliability is improved, but data processing time increases
Solution Approach 1:
The patent applies different processing treatments to different network feature variables based on their local characteristics. Each variable is normalized using its own statistical properties (mean, standard deviation) derived from historical data, allowing the system to efficiently process comprehensive data without uniform computational overhead, thus reducing processing time while maintaining detection reliability.
Solution Approach 2:
The patent transforms network feature variables by changing their parameters through normalization - converting raw values into standardized scores based on historical statistics. This parameter transformation enables the system to work with dimensionless, comparable values that reduce computational complexity and processing time while preserving the reliability of anomaly detection.
3Stability of the object's composition
If real-time anomaly detection is implemented to prevent network disruptions, then network stability is improved, but system resource consumption increases
Solution Approach 1:
The system implements self-service through automated remedial actions. When anomalies are detected via the multivariate distribution function, the system automatically generates and executes remediation protocols without requiring manual intervention. This self-service capability maintains network stability in real-time while optimizing resource consumption by eliminating human response delays and reducing operational overhead.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems, methods and transitory computer-readable storage media for constructing a loop free multicast tree. The methods include collecting data sample points to form a first data set, each of the data sample points representing a network feature variable, each network feature variable associated with a corresponding network feature, calculating a standard deviation and a mean value of the network feature variables for each network feature, performing normalization of the network feature variables to obtain normalized network feature variables, calculating, using the standard deviation and the mean value for each network feature, a probability value (p-value) for each normalized network feature variable, and determining if an anomaly exists with respect to each network feature based at least upon the p-value for each normalized network feature variable.