Network Traffic Anomaly Detection via Browsing Pattern Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current traffic management devices are ineffective in detecting malicious network behavior and distinguishing between network attacks and benign behavior, leading to false positives and inappropriate mitigation actions.
Innovation Solution
A network traffic management system that uses anomaly detection models associated with browsing patterns to generate likelihood scores and flow scores, initiating mitigation actions when the flow score exceeds a threshold, based on stored policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If current traffic management devices use traditional anomaly detection methods, then they can identify some malicious attacks, but they produce high false positives and cannot effectively distinguish between attacks and benign behavior
Solution Approach 1:
The patent segments the anomaly detection process into multiple specialized sub-models, each analyzing specific aspects of network traffic (e.g., packet size distribution, inter-arrival times, protocol behavior). This segmentation allows each sub-model to focus on particular patterns, improving overall detection precision while reducing false positives through specialized analysis.
Solution Approach 2:
The patent transforms raw network traffic data into multiple derived parameters and features (e.g., statistical moments, temporal patterns, spectral characteristics). By changing the parameter representation from simple packet counts to comprehensive traffic characteristics, the system achieves better distinction between malicious and benign behavior, improving measurement precision.
2Measurement precision
If traffic management devices implement comprehensive anomaly detection, then detection capability improves, but system complexity increases
Solution Approach 1:
The detection system is segmented into modular components: traffic capture module, feature extraction module, multiple specialized sub-models, scoring module, and mitigation module. Each module performs a specific function, making the overall complex system manageable through clear separation of concerns and independent optimization of each component.
Solution Approach 2:
The patent creates a universal anomaly detection framework that can handle multiple types of attacks (DDoS, web scraping, brute force) and multiple protocols through a single multi-functional system. The sub-models are designed to be protocol-agnostic and attack-type-agnostic, providing universal detection capability across diverse network traffic scenarios.
3Reliability
If traditional detection methods are used, then the system remains simple to operate, but it cannot robustly identify bots and malicious attacks
Solution Approach 1:
The anomaly detection system operates autonomously without requiring manual configuration or intervention. It automatically captures traffic, extracts features, applies sub-models, calculates scores, and triggers mitigations based on predefined thresholds. This self-service operation maintains ease of use while achieving robust bot detection through sophisticated automated analysis.
Solution Approach 2:
The system implements feedback loops where detection results and mitigation outcomes are continuously monitored and used to refine detection parameters and thresholds. This automated feedback mechanism improves detection robustness over time while maintaining operational simplicity, as the system self-optimizes without manual intervention.
Data Source
AI summary
Methods, non-transitory computer readable media, anomaly detection apparatuses, and network traffic management systems that generate, based on the application of one or more models and for a first flow associated with a received first set of network traffic, one or more likelihood scores and at least one flow score based on the likelihood scores. One or more of the one or more models are associated with one or more browsing patterns for a web application to which the first set of network traffic is directed. A determination is made when the flow score exceeds a threshold. A mitigation action is initiated, based on a stored policy, with respect to the first set of network traffic, when the determining indicates that the flow score exceeds the established threshold.