Neural Network Vector Representation for Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computer networks are vulnerable to malicious attacks, and existing technologies lack effective methods to detect anomalous behavior in network communications, which hinders timely mitigation measures.
Innovation Solution
A computer-implemented method using neural networks to generate vector representations of network communications, applying clustering algorithms to detect anomalies by comparing baseline and runtime activity, and implementing protective measures upon anomaly detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If neural networks and clustering algorithms are used to detect anomalous behavior, then detection accuracy is improved, but system complexity increases
Solution Approach 1:
The patent segments the anomaly detection process into distinct modules: a neural network component that generates vector representations of network communications, and a clustering algorithm component that identifies anomalous patterns. This segmentation allows each component to specialize in specific tasks, improving overall detection accuracy while making the complex system more manageable and maintainable through modular architecture.
Solution Approach 2:
The patent introduces vector representations as an intermediary data structure between raw network communications and anomaly detection. The neural network transforms complex network data into standardized vector representations, which then serve as input for clustering algorithms. This intermediary representation simplifies the detection process and enables the use of sophisticated algorithms without proportionally increasing overall system complexity.
2Measurement precision
If baseline time period is extended to improve detection accuracy, then measurement precision is improved, but time consumption increases
Solution Approach 1:
The patent establishes a baseline time period during which normal network behavior is characterized and stored as reference data before actual anomaly detection begins. This preliminary action captures the normal operational patterns of the network, enabling faster comparison-based detection during runtime without requiring continuous long-term data collection, thus reducing time consumption while maintaining detection accuracy.
3Reliability
If multiple evaluation criteria are used to detect anomalies, then detection reliability is improved, but computational load increases
Solution Approach 1:
The patent employs multiple evaluation criteria including cluster membership evaluation, vector representation comparison, and statistical analysis of network behavior. However, the system applies these criteria selectively and iteratively, evaluating the most promising indicators first and only applying additional criteria when initial evaluations indicate potential anomalies. This partial application of multiple criteria maintains high detection reliability while avoiding the computational burden of continuously applying all evaluation methods to every data point.
Data Source
AI summary
A computer implemented method of detecting anomalous behavior in a set of computer systems communicating via a computer network, the method including evaluating a difference in a level of activity of the computer system between a baseline time period and a runtime time period, and responsive to a determination of anomalous behavior, implementing one or more protective measures for the computer network.