Packet Stream Abnormality Detection Using Distance Metrics
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for detecting abnormalities in packet streams, particularly in industrial control systems, face challenges in distinguishing between normal and abnormal packet streams, especially when the abnormality is subtle or lacks drastic changes in data volume or byte string disturbances.
Innovation Solution
The method calculates distances between consecutive packets in a packet stream, extracts feature amounts based on these distances, and uses metrics like Levenshtein distance and earth mover's distance to determine the degree of abnormality, enabling detection of anomalies within the context of normal packet stream patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional abnormality detection methods are used, then detection capability for obvious abnormalities is maintained, but detection precision for subtle abnormalities deteriorates
Solution Approach 1:
The patent segments the packet stream into individual packets and calculates distances between consecutive packets. This segmentation allows the system to analyze subtle variations in packet characteristics that would be invisible in aggregate analysis, thereby improving detection precision for subtle abnormalities without requiring overly complex processing of the entire stream at once.
Solution Approach 2:
The patent introduces a new dimensional approach by calculating distance metrics (such as Levenshtein distance) between consecutive packets and using earth mover's distance to compare feature distributions. This dimensional transformation from raw packet data to distance-based features enables the detection of subtle abnormalities that conventional methods miss, while the statistical aggregation keeps complexity manageable.
2Measurement precision
If distance-based feature extraction is used, then detection of subtle deviations is improved, but calculation time increases
Solution Approach 1:
The patent performs preliminary extraction of feature amounts from packet distances before conducting the actual abnormality detection. By pre-calculating and storing distance-based features (such as frequency distributions of packet distances), the system reduces the computational burden during real-time detection, thereby minimizing calculation time loss while maintaining high precision for detecting subtle deviations.
3Measurement precision
If earth mover's distance is used to compare feature distributions, then abnormality detection accuracy is improved, but computational complexity increases
Solution Approach 1:
The patent transforms the complex problem of direct packet comparison into a simplified parameter-based comparison by extracting feature amounts (such as frequency distributions of distance values) and using earth mover's distance to compare these parameters. This parameter transformation maintains high detection accuracy by capturing the essential characteristics of packet streams while significantly reducing algorithmic complexity through statistical aggregation and standardized distance metrics.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In an abnormality detection method, for a detection target packet stream made up of a plurality of detection target packets that are consecutive, a plurality of distances between the plurality of detection target packets are calculated, a feature amount of the detection target packet stream is extracted using the plurality of distances calculated, and information about the degree of abnormality in the detection target packet stream is calculated using the extracted feature amount.