Network Security Anomaly Detection via Traffic Distribution Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security systems fail to detect sophisticated fraudulent transactions that use a variety of traffic attributes to evade detection, as they primarily flag only known fraudulent IP addresses or email addresses, allowing attackers to continue transactions undetected by masking their identity.
Innovation Solution
A network security system that compares observed distributions of traffic attributes to baseline distributions using exponential smoothing to weight recent traffic, identifying anomalies and implementing access controls to prevent fraudulent transactions, utilizing fast and slow means and standard deviations to account for short-term and long-term variations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing systems flag only known fraudulent traffic attributes (IP addresses, email addresses), then detection of confirmed fraud is achieved, but sophisticated attackers can evade detection by using unflagged attributes to mask their identity
Solution Approach 1:
The patent segments the analysis from single-attribute checking to multi-attribute joint analysis. Instead of evaluating each traffic attribute independently, the system divides the fraud detection task into analyzing combinations of attributes (IP address, email address, device information, etc.) together, allowing detection of coordinated fraudulent patterns that individual attribute checks would miss.
Solution Approach 2:
The patent transitions from one-dimensional single-attribute fraud detection to multi-dimensional distributed attribute analysis. By examining how multiple attributes are distributed and correlated across transactions, the system adds dimensional depth to detection, enabling identification of fraudulent patterns that span across different attribute types rather than relying on any single flagged attribute.
2Adaptability or versatility
If a large number of traffic attributes are used by attackers during attacks, then attack versatility increases, but the ability to complete fraudulent transactions undetected improves due to unflagged attributes
Solution Approach 1:
The patent creates a universal detection framework that handles multiple types of traffic attributes (IP addresses, email addresses, device information, geographic data, etc.) through a single multi-attribute analysis system. This multi-functional approach allows the system to detect fraud across diverse attack methods using the same underlying technology, rather than requiring separate detection mechanisms for each attribute type.
Solution Approach 2:
The patent combines multiple traffic attributes into a composite fraud indicator system. Rather than relying on individual attributes, the system synthesizes information from multiple attributes to create a composite view of transaction risk, similar to how composite materials combine different substances to achieve properties that individual materials cannot provide alone.
3Difficulty of detecting and measuring
If attackers mask their identity through varying traffic attributes, then detection difficulty increases, but fraudulent transactions can proceed undetected using unflagged attributes
Solution Approach 1:
The patent implements feedback mechanisms where the multi-attribute analysis system continuously learns from detected patterns and adjusts its detection criteria. By analyzing the distribution and correlation of multiple attributes across transactions, the system receives feedback about fraudulent behavior patterns and refines its detection models, improving its ability to identify masked identities even when individual attributes haven't been previously flagged.
Data Source
AI summary
A method described herein involves various operations directed toward network security. The operations include accessing a traffic attribute describing a feature of network traffic. The operations further include determining a baseline distribution for the traffic attribute of a baseline set of transactions involving an online system over a baseline period and, additionally, determining an observed distribution for the traffic attribute of an observed set of transactions involving the online system over an observed period. Using the observed distribution and the baseline distribution, an attribute risk value for the traffic attribute is computed. The operations further include detecting that an anomaly exists in the traffic attribute of the observed set of transactions, based on the attribute risk value. Responsive to detecting the anomaly, an access control is implemented for access to the online system by additional transactions having a particular value in the traffic attribute meeting a pattern of the anomaly.