Information System Anomaly Detection With Siamese Signatures
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity tools fail to detect advanced persistent threats and black swan attacks due to their unpredictable nature, as these threats do not trigger predefined rule conditions, limiting their effectiveness in anomaly detection within information systems.
Innovation Solution
A method utilizing pre-trained deep learning Siamese neural networks to generate digital signatures for each entity within an information system, comparing them to reference signatures from a sliding reference period to detect deviations and calculate an anomaly score, allowing for scalable and adaptive anomaly detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If predefined rules are used to detect attacks, then detection speed is improved, but detection accuracy for advanced threats deteriorates
Solution Approach 1:
The patent segments the detection process into two distinct phases: (1) a learning phase where the system observes normal behavior patterns and builds a reference model, and (2) a detection phase where deviations from the learned model are identified. This segmentation allows the system to maintain high detection speed through rule-based anomaly scoring while improving accuracy through adaptive learning from historical data, directly addressing the contradiction between speed and accuracy for detecting advanced threats.
2Adaptability or versatility
If the system adapts to behavior changes, then adaptability is improved, but system complexity deteriorates
Solution Approach 1:
The patent implements dynamics by making the reference behavior model adaptive rather than static. The system continuously learns from new data and updates its understanding of normal behavior patterns, allowing it to adapt to changing conditions. This dynamic approach improves adaptability while managing complexity through efficient learning algorithms that update only the necessary portions of the model, avoiding complete system reconfiguration.
Solution Approach 2:
The system employs self-service mechanisms through automated learning and adaptation. The reference model automatically updates based on observed behavior patterns without requiring manual intervention or complex configuration. This self-service capability allows the system to adapt to behavior changes autonomously, improving adaptability while keeping operational complexity manageable through automated processes.
3Measurement precision
If deep learning Siamese networks are used for signature generation, then measurement precision is improved, but ease of manufacture deteriorates
Solution Approach 1:
The patent applies preliminary action by pre-training the Siamese neural networks during an offline learning phase before deployment. The complex deep learning models are trained in advance on historical data to learn meaningful feature representations and similarity metrics. This preliminary training allows the system to achieve high measurement precision in signature generation while simplifying ease of manufacture during deployment, as the heavy lifting of model training occurs beforehand rather than requiring complex real-time training infrastructure.
Data Source
Figure 1~2b
Figure 3~4
Figure 5
AI summary
The invention relates to a computer-implemented method (300) for detecting anomalies in an information system (IS), comprising at least one iteration of a detection phase (304) for at least one entity of said IS and at least one current unit window, said detection phase (304) comprising the following steps: - generation (310) of a digital signature, said unit signature, representative of a behavior of said entity during a current unit window based on data relating to said entity and collected at least during said unit window; and - calculation (314) of an anomaly score, associated with said entity for said unit window, based on: • said unit signature, and • a digital signature, said reference signature, previously calculated for said entity and representative of the activity of said entity over a period, said reference period, preceding said current unit window;characterized in that each digital signature is generated using a generator based on pre-trained deep learning Siamese neural networks. It also relates to a computer program, a detection system and an information system implementing such a process.