Packet Stream Anomaly Detection Using Distance-Window Features
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional anomaly detection methods in network systems, such as rule-based and anomaly-based approaches, face challenges in identifying anomalies in packet streams, especially when deviations are subtle or not drastic, making it difficult to distinguish between normal and anomalous packet streams.
Innovation Solution
The method calculates distances between consecutive data points in packet streams, extracts features from these distances, and calculates anomaly degree information using supplementary information, allowing for the detection of anomalies by analyzing the context and deviations within defined windows of data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional anomaly detection methods are used, then the detection process is simple, but the ability to detect subtle anomalies is insufficient
Solution Approach 1:
The patent segments the anomaly detection process into multiple distinct modules: distance calculation between consecutive packets, feature extraction from distance sequences, supplementary information calculation, and anomaly degree computation. Each module handles a specific aspect of the detection, allowing complex analysis to be broken down into manageable steps that improve precision without overwhelming system complexity
Solution Approach 2:
The patent transitions from analyzing single packet features to analyzing sequences of distance values between consecutive packets. By extracting features from L consecutive distances and calculating supplementary information across N-data windows, the method adds temporal and contextual dimensions to the detection process, enabling identification of subtle anomalies that single-point analysis would miss
2Measurement precision
If feature extraction from L consecutive distances is performed, then anomaly detection accuracy improves, but computational load increases
Solution Approach 1:
The patent applies partial action by selecting specific window sizes (L consecutive distances and N-data windows where N≥L+1) that provide sufficient contextual information for accurate detection without processing the entire data stream. This selective approach maintains high detection accuracy while limiting computational requirements to manageable levels
Solution Approach 2:
The patent performs preliminary calculations of distance sequences and feature extraction before final anomaly degree computation. By pre-calculating supplementary information for each feature from the distance sequences, the system prepares data in advance, reducing the computational burden during real-time anomaly detection and improving overall processing efficiency
Data Source
AI summary
An anomaly detection method includes: calculating, for a detection target data stream of consecutive detection target data, distances between the detection target data; extracting features of the detection target data stream using the calculated distances; and calculating anomaly degree information about a degree of anomaly in the detection target data stream using the extracted features. Each extracted feature is made up of L consecutive distances (L is an integer greater than or equal to 2). For each feature extracted, supplementary information for calculating the anomaly degree information is calculated using a difference in the feature. For each of one or more information calculation target windows made up of N detection target data (N is an integer greater than or equal to L+1), the anomaly degree information is calculated using all supplementary information calculated from the N detection target data.