Packet Stream Anomaly Detection Using Distance-Based Context Features
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional anomaly detection methods in network systems, such as rule-based and anomaly-based approaches, face challenges in identifying anomalies in packet streams, especially when the deviation is subtle or not described by predefined rules, and struggle to detect anomalies unless there is a significant increase in data or packet disturbances.
Innovation Solution
The proposed anomaly detection method calculates distances between consecutive data points in packet streams, extracts features from these distances, and calculates anomaly degree information using supplementary information, allowing for the detection of anomalies by identifying deviations from normal context patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If rule-based anomaly detection is used, then detection accuracy for known attack patterns is improved, but the system cannot detect anomalies that do not match predefined rules
Solution Approach 1:
The system pre-calculates and stores distance matrices between normal packet sequences during a training phase. These pre-computed distance relationships serve as a baseline for detecting anomalies, allowing the system to identify deviations from normal patterns without requiring predefined attack rules.
Solution Approach 2:
The system transforms packet sequence data into distance metric representations, changing the parameter space from raw packet contents to inter-packet distance relationships. This transformation enables the detection of subtle anomalies based on temporal and sequential patterns rather than relying on signature matching.
2Adaptability or versatility
If anomaly-based detection is used, then detection of unknown attack patterns is improved, but the system requires drastic increases in data volume or packet disturbances to detect anomalies
Solution Approach 1:
The system introduces a new dimension of analysis by computing distance matrices between packets in a sequence, transforming the detection problem from analyzing individual packet attributes to analyzing the relational structure between consecutive packets. This dimensional transformation enables detection of subtle anomalies that do not require drastic data volume increases.
Solution Approach 2:
The system pre-establishes baseline distance relationships from normal traffic patterns, creating a reference framework before actual anomaly detection begins. This preliminary characterization of normal behavior allows the system to detect subtle deviations with high sensitivity without requiring large volumes of anomaly data for training.
3Measurement precision
If per-packet inspection is used, then detailed analysis of individual packets is improved, but subtle anomalies in packet streams remain undetected
Solution Approach 1:
The system segments the packet stream into discrete units and computes pairwise distance relationships between consecutive packets. By breaking down the continuous stream into measurable distance units, the system can analyze subtle temporal and sequential patterns that per-packet inspection alone cannot detect, while maintaining manageable computational complexity through efficient distance matrix construction.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An anomaly detection method includes: calculating, for a detection target data stream of consecutive detection target data, distances between the detection target data; extracting features of the detection target data stream using the calculated distances; and calculating anomaly degree information about a degree of anomaly in the detection target data stream using the extracted features. Each extracted feature is made up of L consecutive distances (L is an integer greater than or equal to 2). For each feature extracted, supplementary information for calculating the anomaly degree information is calculated using a difference in the feature. For each of one or more information calculation target windows made up of N detection target data (N is an integer greater than or equal to L+1), the anomaly degree information is calculated using all supplementary information calculated from the N detection target data.