Network Request Interval Detection for Intranet Anomalies
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network intrusion detection systems in factory environments struggle to effectively identify and mitigate network anomalies within the intranet, particularly from malware attacks, which can disrupt factory intelligence services and production lines.
Innovation Solution
A detection method and apparatus that analyze network request intervals to identify anomalies by training a detection model using machine learning algorithms, such as autoencoders, to determine normal and anomalous traffic patterns, and utilize statistical distributions like Poisson to validate anomalous events over a statistical period.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional NIDS is deployed at network entrance to monitor incoming packets, then defense capability from Internet to Intranet is improved, but ability to detect internal anomalies and malware attacks within Intranet deteriorates
Solution Approach 1:
The patent divides the network into multiple monitoring zones by deploying detection nodes at different locations (network entrance, intermediate points, and critical service points). This segmentation allows the system to simultaneously monitor both external traffic and internal traffic patterns, enabling comprehensive detection of both external attacks and internal malware activities without relying on a single detection point.
Solution Approach 2:
The patent introduces an intermediary detection mechanism that monitors traffic flows between different network segments. By placing detection nodes at strategic intermediate points within the Intranet, the system can detect anomalies in real-time as they propagate through the network, rather than only detecting them at the final destination or origin.
2Adaptability or versatility
If comprehensive network monitoring is implemented to detect all anomalies, then detection coverage is improved, but system complexity and computational resources required deteriorates
Solution Approach 1:
The patent extracts and monitors only the essential features of network traffic that are most indicative of anomalies, such as request intervals, packet sizes, and flow patterns. By focusing on these key characteristics rather than analyzing every single packet in detail, the system achieves comprehensive anomaly detection with reduced computational complexity and resource requirements.
Solution Approach 2:
The patent applies partial monitoring to normal traffic and excessive (deep) analysis only to suspicious traffic patterns. When traffic appears normal, the system uses lightweight monitoring; when anomalies are detected, the system intensifies analysis. This dynamic approach maintains high detection coverage while avoiding the constant high computational load of comprehensive deep packet inspection.
3Speed
If real-time anomaly detection is performed on all network traffic, then detection speed is improved, but processing time and computational overhead increases
Solution Approach 1:
The patent implements periodic sampling of network traffic at predetermined intervals rather than continuous analysis of every packet. This periodic approach allows the system to maintain real-time detection capability for critical anomalies while reducing overall processing time and computational overhead by analyzing a representative subset of traffic flows.
Solution Approach 2:
The patent dynamically adjusts the detection intensity and sampling rate based on current network conditions and threat levels. During normal operation, the system uses lower-intensity periodic monitoring; when potential threats are detected, the system automatically increases detection frequency and analysis depth. This dynamic adaptation maintains fast response to critical events while minimizing average processing time.
Data Source
AI summary
A detection method of network anomaly and an anomaly detection apparatus are disclosed. In the detection method, one or more request intervals within a detection period are determined, where each of the request intervals is a time interval of two network requests from a network source. A network request anomaly from the network source is determined according to the request interval within the detection period.