Quantile Regression for Cyber Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques are insufficient in detecting cyber-attacks characterized by short bursts of traffic or fast-changing traffic patterns, as they lack sensitivity and response time to identify lower volume 'blips' effectively.
Innovation Solution
A method and system utilizing quantile regression analysis to estimate the probability distribution of traffic data streams, dividing them into quantiles based on features like source IP addresses and bandwidth, allowing for rapid detection of anomalies and characterization of attackers through probability estimates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional detection techniques with baseline and threshold are used, then high volume DoS/DDoS attacks can be detected, but short burst attacks cannot be detected due to coarse sensitivity and response time
Solution Approach 1:
The patent segments the traffic data stream into multiple quantiles based on feature values (e.g., source IP addresses, bandwidth). Each quantile is monitored independently with its own probability estimate, enabling fine-grained detection of short burst attacks that would be missed by conventional aggregate threshold methods. This segmentation provides both the sensitivity to detect small attacks and the rapid response capability needed.
2Adaptability or versatility
If conventional detection methods are used, then sustained high-volume attacks can be detected, but fast morphing traffic patterns cannot be detected
Solution Approach 1:
The patent implements dynamic adaptation by continuously updating probability estimates for each quantile as traffic patterns change. The system adapts to fast morphing attacks by adjusting to new traffic distributions while maintaining reliability through statistical significance testing. This dynamic approach allows detection of evolving attack patterns without excessive false positives.
Solution Approach 2:
The system incorporates feedback mechanisms where detected attacks trigger reinitialization of probability estimates for affected quantiles. This feedback loop allows the system to learn from attacks and adjust its detection parameters, improving adaptability to new attack types while maintaining reliability by resetting potentially biased estimates during attack events.
Data Source
AI summary
A system and method for detecting cyber-attacks using quantile regression analysis are disclosed. The method includes: identifying at least one hit quantile out of a plurality of quantiles, wherein the at least one identified hit quantile falls within quantile edges of a sample of traffic directed at a protected entity, wherein each of the plurality of quantiles is characterized by a probability distribution of at least one feature of a data stream, each of the plurality of quantiles having a respective probability estimate; updating the probability estimates of the plurality of quantiles when the at least one hit quantile has been identified; and when the probability estimate of the at least one hit quantile is above a threshold, taking an action to mitigate existence of a cyber-attack.