Recurrent Neural Network for Anomalous Asset Name Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security analytics fail to effectively detect unmanaged and unauthorized devices in computer networks, particularly those with arbitrary or anomalous names, which pose security risks as potential entry points for malware and adversarial actions.
Innovation Solution
A recurrent neural network (RNN), such as a long short-term memory (LSTM) network, is trained to identify patterns in asset names within a network, measuring reconstruction errors to flag assets with anomalous names, and a filtering process is applied to refine the identification of potentially unmanaged and unauthorized assets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional policy-based device management is used, then controlled devices can be managed, but unmanaged and unauthorized devices with arbitrary names cannot be detected
Solution Approach 1:
The patent transforms the approach from rigid policy-based device management to a machine learning-based system that analyzes naming patterns. The RNN model learns from historical asset name data to identify deviations from established patterns, enabling detection of unauthorized devices while adapting to legitimate naming variations across different departments and systems.
Solution Approach 2:
The patent replaces traditional mechanical/policy-based device registration and verification systems with an automated RNN-based analysis system. Instead of requiring explicit device registration policies, the system passively monitors and analyzes asset name patterns to automatically identify anomalies, reducing administrative overhead while improving detection capability.
2Measurement precision
If RNN is trained to identify patterns in asset names, then anomalously-named devices can be detected, but computational complexity and training time increase
Solution Approach 1:
The patent applies partial action by focusing the RNN model specifically on analyzing asset name patterns rather than attempting comprehensive device monitoring. The model processes only the naming convention aspect of device identification, which is a subset of the full device management problem, thereby reducing overall system complexity while maintaining effective anomaly detection for unauthorized devices.
3Reliability
If all anomalously-named assets are flagged, then potential security risks are identified, but false positives from legitimate naming variations increase
Solution Approach 1:
The patent implements feedback mechanisms where the RNN model continuously learns from confirmed anomaly cases and false positive corrections. The system refines its anomaly detection thresholds and pattern recognition based on feedback from security analysts who verify flagged assets, allowing the model to distinguish between legitimate naming variations and actual security threats over time.
Data Source
AI summary
The present disclosure describes a system, method, and computer program for detecting unmanaged and unauthorized assets on an IT network by identifying anomalously-named assets. A recurrent neural network (RNN) is trained to identify patterns in asset names in a network. The RNN learns the character distribution patterns of the names of all observed assets in the training data, effectively capturing the hidden naming structures followed by a majority of assets on the network. The RNN is then used to identify assets with names that deviate from the hidden naming structures. Specifically, the RNN is used to measure the reconstruction errors of input asset name strings. Asset names with high reconstruction errors are anomalous since they cannot be explained by learned naming structures. After filtering for attributes or circumstances that mitigate risk, such assets are associated with a higher cybersecurity risk.