Anomaly Detection in Network Protocol Processes

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Detecting anomalies in network protocol processes within switches in a data-center or large-scale network is challenging, as existing methods often fail to accurately identify issues such as protocol implementation errors or system attacks, leading to potential switch shutdowns and network disruptions.

Innovation Solution

A method utilizing probabilistic statistical models to analyze network feature variables, including CPU usage and protocol data units, to detect anomalies by calculating normalized parameter vectors and using multivariate distribution functions to identify deviations from expected behavior, with optional dimensionality reduction via Principal Component Analysis (PCA) for efficient computation.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If probabilistic statistical models with multivariate distribution functions are used to analyze network feature variables, then anomaly detection precision is improved, but computational complexity increases

Engineering Contradiction:
Improveanomaly detection precisionVSAvoidcomputational complexity
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The patent segments the anomaly detection process into distinct phases: data collection from network switches, normalization of network feature variables, application of multivariate distribution functions for anomaly scoring, and remedial action generation. This segmentation allows complex computations to be distributed and managed in manageable stages, reducing overall computational complexity while maintaining detection precision.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent applies preliminary normalization to network feature variables before they are fed into the multivariate distribution function. By pre-processing the data to establish baseline statistics and normalize variables, the system reduces the computational burden on the anomaly detection algorithm itself, enabling precise detection without excessive computational complexity.

Inventive Principle:
Principle #10Preliminary action

2Reliability

If comprehensive network feature variables are monitored to improve anomaly detection accuracy, then detection reliability is improved, but data processing time increases

Engineering Contradiction:
Improvedetection reliabilityVSAvoiddata processing time
Core Design Contradiction:
ReliabilityVSLoss of time

Solution Approach 1:

The patent applies different processing treatments to different network feature variables based on their local characteristics. Each variable is normalized using its own statistical properties (mean, standard deviation) derived from historical data, allowing the system to efficiently process comprehensive data without uniform computational overhead, thus reducing processing time while maintaining detection reliability.

Inventive Principle:
Principle #3Local quality

Solution Approach 2:

The patent transforms network feature variables by changing their parameters through normalization - converting raw values into standardized scores based on historical statistics. This parameter transformation enables the system to work with dimensionless, comparable values that reduce computational complexity and processing time while preserving the reliability of anomaly detection.

Inventive Principle:
Principle #35Parameter changes

3Stability of the object's composition

If real-time anomaly detection is implemented to prevent network disruptions, then network stability is improved, but system resource consumption increases

Engineering Contradiction:
Improvenetwork stabilityVSAvoidsystem resource consumption
Core Design Contradiction:
Stability of the object's compositionVSUse of energy by moving object

Solution Approach 1:

The system implements self-service through automated remedial actions. When anomalies are detected via the multivariate distribution function, the system automatically generates and executes remediation protocols without requiring manual intervention. This self-service capability maintains network stability in real-time while optimizing resource consumption by eliminating human response delays and reducing operational overhead.

Inventive Principle:
Principle #25Self-service

Data Source

PatentEP3224991B1Anomaly detection in protocol processes
Publication Date: 2021.01.06 CISCO TECHNOLOGY INC
  • EP3224991B1 patent drawingFigure 1
  • EP3224991B1 patent drawingFigure 2
  • EP3224991B1 patent drawingFigure 3

AI summary

Systems, methods and transitory computer-readable storage media for constructing a loop free multicast tree. The methods include collecting data sample points to form a first data set, each of the data sample points representing a network feature variable, each network feature variable associated with a corresponding network feature, calculating a standard deviation and a mean value of the network feature variables for each network feature, performing normalization of the network feature variables to obtain normalized network feature variables, calculating, using the standard deviation and the mean value for each network feature, a probability value (p-value) for each normalized network feature variable, and determining if an anomaly exists with respect to each network feature based at least upon the p-value for each normalized network feature variable.