Network Anomaly Detection via Node Scoring Graph Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In distributed computing systems, network attacks can go undetected when attackers use stolen credentials that are valid for authentication and authorization, as the system cannot differentiate between the attacker and a legitimate user, especially in scenarios where the attacker has breached the first line of defense.
Innovation Solution
A network analysis system uses node scoring techniques to detect anomalies by constructing graphs of server computer interactions over reference and test periods, determining node scores using algorithms like PageRank or HITS, and identifying nodes with significant score differences as potentially anomalous, even if attackers use valid credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional authentication and authorization methods are used, then legitimate users can access the system, but attackers using stolen credentials cannot be differentiated from legitimate users
Solution Approach 1:
The system performs preliminary actions by constructing a reference graph of normal network interactions before testing, establishing a baseline of legitimate behavior patterns. This preliminary graph captures authentication relationships and access patterns that serve as the foundation for later anomaly detection during actual operation.
Solution Approach 2:
The patent introduces an intermediary detection layer that operates between authentication and authorization. The anomaly detection system analyzes network interaction patterns as an intermediary step, examining whether the authenticated user's subsequent network behavior aligns with established norms before allowing full system access.
2Productivity
If the system allows authenticated users to access other server computers, then legitimate operations can proceed, but attackers can move laterally through the network undetected
Solution Approach 1:
The system implements continuous feedback by comparing real-time network interaction patterns against the reference graph. When an authenticated user attempts lateral movement, the system immediately checks whether this behavior deviates from established patterns and provides feedback by blocking or alerting on anomalous access attempts.
Solution Approach 2:
The anomaly detection system dynamically adapts to legitimate changes in network behavior while maintaining security. The reference graph can be updated to reflect new legitimate access patterns, allowing the system to remain productive while continuously detecting deviations that indicate attacks.
3Measurement precision
If the system monitors all network interactions to detect attacks, then attack detection capability improves, but system complexity and computational overhead increase
Solution Approach 1:
The patent extracts only the essential features needed for anomaly detection by focusing on specific network interaction patterns rather than monitoring all possible parameters. The system extracts authentication relationships and access patterns into a simplified graph representation, reducing complexity while maintaining detection precision.
Solution Approach 2:
The detection system is segmented into distinct components: reference graph construction, real-time pattern matching, and anomaly classification. This segmentation allows each component to be optimized independently and enables parallel processing, reducing overall system complexity while improving detection capabilities.
Data Source
AI summary
Systems, methods, and computer program products for detecting network anomalies using node scoring. A network analysis system designates each server computer in a distributed computing network as a node in a graph. The network analysis system constructs a first graph of the distributed computing network for a training period. The system then determines a respective first node score of each node. The system constructs a second graph of the distributed computing network for a test time period. The system then reduces the second graph by removing those edges from the second graph that appear in both the first graph and the second graph. The system determines a respective second node score of each node in the reduced second graph. The system computes differences between the first node scores and the second node scores. The system designates nodes associated with the highest differences as anomalous nodes.