Network Traffic Anomaly Detection via Statistical Sampling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in distinguishing between brute force attacks and legitimate high-volume use, often resulting in false positives that incorrectly block legitimate users and require significant administrative resources to resolve.
Innovation Solution
The solution involves monitoring network traffic at the router level, using sampling protocols like IPFIX or NetFlow, to compare recent traffic patterns against historical data, thereby distinguishing between attack traffic and normal operations with reduced false positives without the need for agents or full traffic inspection on individual machines.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network administrators implement false-positive reduction schemes to block IP addresses or secure accounts, then security against brute force attacks is improved, but legitimate users may be incorrectly blocked and resources are wasted to undo false positive security measures
Solution Approach 1:
The patent replaces traditional mechanical/block-based security measures (IP blocking, account locking) with a statistical anomaly detection system that uses machine learning models to distinguish between legitimate high-volume users and attackers based on behavioral patterns, thereby reducing false positives while maintaining security effectiveness
Solution Approach 2:
The system changes the detection parameters from simple threshold-based blocking (e.g., number of login attempts) to multi-dimensional statistical analysis including temporal patterns, source IP diversity, and behavioral metrics, enabling more accurate differentiation between legitimate users and attackers
2Measurement precision
If network administrators install agents or perform full traffic inspection on machines to detect attacks, then detection accuracy is improved, but device complexity and resource requirements increase significantly
Solution Approach 1:
The patent extracts the detection function from individual machines and consolidates it at the network level, using centralized sampling and analysis infrastructure to detect attacks without requiring agents or full inspection on each host, thereby reducing device complexity while maintaining detection accuracy
Solution Approach 2:
The system introduces a network-level intermediary sampling and analysis layer that mediates between raw network traffic and security responses, using sampled data and statistical models to make detection decisions without requiring full traffic inspection on individual machines
3Productivity
If network administrators respond to false positives by unlocking accounts and restoring access, then user productivity is improved, but time and resources are wasted to undo security measures
Solution Approach 1:
The patent implements continuous feedback loops where the system learns from user behavior patterns and adjusts detection thresholds dynamically, allowing legitimate users to maintain access during high-volume periods without triggering false positive blocks, thereby eliminating the need for manual unblocking operations
Data Source
AI summary
Detecting a volumetric attack on a computer network with fewer false positives and while also requiring fewer processing resources is provided. The systems and methods described herein use observations taken at the network level to observe network traffic to form a predictive model for future traffic. When the network's future traffic sufficiently exceeds the predictive model, the monitoring systems and methods will indicate to the network to take security measures. The traffic to the network may be observed in subsets, corresponding to various groupings of sources, destinations, and protocols so that security measures may be targeted to that subset without affecting other machines in the network.