Anomaly Detection in Packet Networks Using Ordered Resource Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anomaly detection methods for packet-based networks, such as IP-based networks, are excessively computationally-intensive and time-consuming, making them unsuitable for real-time intrusion detection in high-velocity and high-bandwidth networks, and they are limited in detecting a wide spectrum of anomalies.
Innovation Solution
A method involving monitoring network resources, ordering them based on data traffic, and using a one-class Support Vector Machine (OC-SVM) to detect anomalies by forming a detection feature vector and feeding it to a machine learning system, which is less resource-intensive and more efficient in real-time anomaly detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional anomaly detection methods are used, then detection accuracy is improved, but computational complexity and processing time increase excessively
Solution Approach 1:
The patent extracts and monitors only the top N most-used network resources (those generating the most traffic) rather than analyzing all network resources. This selective extraction reduces the data volume fed to the OC-SVM classifier, thereby reducing computational complexity while maintaining detection accuracy for the most significant anomalies.
Solution Approach 2:
The patent applies partial action by focusing computational resources on monitoring only the most critical network resources (top N by traffic volume) rather than performing exhaustive analysis on all resources. This partial monitoring approach reduces processing time and computational load while still capturing the majority of anomalous behavior.
2Measurement precision
If traditional anomaly detection methods are used, then detection accuracy is improved, but processing speed decreases
Solution Approach 1:
The patent extracts only the essential subset of network resources (top N most-used) for monitoring, reducing the input data size for the OC-SVM classifier. This extraction enables faster processing speed while maintaining the ability to detect anomalies in the most traffic-intensive resources where anomalies are most likely to impact the network.
Solution Approach 2:
The patent performs preliminary ordering of network resources by traffic volume before anomaly detection, identifying and prioritizing the top N most-used resources in advance. This preliminary action reduces the dataset size before feeding it to the OC-SVM, thereby improving processing speed without sacrificing detection accuracy for critical resources.
3Adaptability or versatility
If comprehensive network monitoring is performed, then detection coverage is improved, but resource consumption increases
Solution Approach 1:
The patent extracts and monitors only the top N most-used network resources based on traffic volume, rather than comprehensively monitoring all network resources. This selective extraction reduces computational resource consumption (CPU, memory, energy) while maintaining effective anomaly detection coverage for the resources that generate the most network traffic and are most likely to contain significant anomalies.
Data Source
AI summary
Disclosed herein is an anomaly detection method for a packet-based network which includes several network resources, also called network-related software objects. The method includes monitoring the network resources of the packet-based network, ordering the monitored network resources according to a given ordering criterion, and detecting an anomaly in the packet-based network based on the ordered network resources. In particular, detecting an anomaly includes forming a detection feature vector based on the ordered network resources, and feeding the detection feature vector to a machine learning system configured to detect an anomaly in the packet-based network based on the detection feature vector. The detection feature vector includes detection feature items related to corresponding monitored network resources, and arranged in the detection feature vector depending on the ordering of the corresponding monitored network resources. Conveniently, the machine learning system is a one-class classifier, preferably a one-class Support Vector Machine (OC-SVM).