Network Threat Detection via Time-Series Graph Centrality
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computer networks face challenges in detecting malicious threats due to the rarity of sudden changes in data flow patterns, which are typically indicative of potential malicious activity, as these networks are generally stable with gradual changes in node importance.
Innovation Solution
A system and method that enriches nodes in a computer network with enhanced importance and centrality measures through graph analytics and time-series analysis, identifying sudden shifts in data flow characteristics to detect anomalous or malicious events by structuring log data as a graph and applying graph analytics and time-series analysis measures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional network monitoring methods are used, then the system maintains stability and gradual changes in data flow patterns are observed, but malicious threats cannot be detected timely due to the rarity of sudden changes
Solution Approach 1:
The patent applies dynamics by transitioning from static network monitoring to dynamic time-series graph analysis. The system continuously updates graph representations of network data flow and recalculates centrality measures over time, enabling detection of sudden dynamic changes that indicate malicious activity while maintaining awareness of normal gradual variations.
Solution Approach 2:
The patent employs parameter changes by computing time-varying centrality parameters (such as betweenness centrality, closeness centrality) for nodes in the network graph. By monitoring changes in these parameters over time and comparing them to baseline values, the system can identify anomalous parameter shifts that signify potential threats, thereby improving detection reliability without excessive false alarms.
2Measurement precision
If graph analytics and time-series analysis are applied to detect sudden shifts, then detection effectiveness is improved, but computational complexity and analysis resource requirements increase
Solution Approach 1:
The patent applies segmentation by dividing the network into subgraphs or communities based on connectivity patterns, and by segmenting the time series into rolling windows for analysis. This allows centrality calculations to be performed on smaller, manageable subsets rather than the entire network at once, reducing computational complexity while maintaining detection precision through localized analysis.
Solution Approach 2:
The patent implements partial action by focusing computational resources on identifying and analyzing only those nodes or subgraphs that exhibit significant changes in centrality measures, rather than uniformly analyzing all nodes. This selective approach maintains high detection precision for anomalies while reducing overall computational burden by avoiding exhaustive analysis of stable network portions.
Data Source
AI summary
Malicious threat detection through time-series graph analysis, in which a data analysis device receives a data file comprising multiple log data entries. The log data entries include parameters associated with a computer network event in a computing network. The data analysis device produces a graphical model of the computing network based on at least one parameter included in the log data. The data analysis device also identifies a parameter associated with a node of the computer network represented by the graphical model, and performs a time-series analysis on the parameter. The data analysis device further determines, based on the time-series analysis on the parameter, at least one of an anomalous event associated with the computing network or a malicious event associated with the computing network.