Stackable Aggregator for Network Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Managing and detecting network anomalies in enterprise networks is increasingly costly and challenging due to the complexity of monitoring and security violations such as denial of service attacks, worm propagation, and unauthorized access attempts.
Innovation Solution
A system comprising collector devices and a stackable aggregator that collects and analyzes network data, producing a connection table mapping each node to records of traffic information, with a manager blade for event correlation, analyzer blades for anomaly detection, and a database blade for storing connection data, allowing for distributed processing and scalable anomaly detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network monitoring and anomaly detection are implemented to detect security violations, then network security is improved, but management cost and system complexity increase
Solution Approach 1:
The system divides the network monitoring function into separate collector devices and aggregator devices. Collector devices gather raw network data locally, while aggregator devices perform anomaly detection and correlation. This segmentation reduces the complexity burden on any single device and allows for distributed processing across the network infrastructure.
Solution Approach 2:
The aggregator acts as an intermediary between collector devices and network operators. It receives raw data from collectors, performs complex analysis and correlation, then presents simplified anomaly information to operators. This intermediary layer handles the complexity of analysis while keeping the collector devices simple and the operator interface clean.
2Measurement precision
If more collector devices and aggregators are deployed to improve anomaly detection capability, then detection accuracy is improved, but system cost increases
Solution Approach 1:
The aggregator device performs multiple functions: collecting data from multiple collectors, storing data in connection tables, performing anomaly detection, and correlating events. This multi-functionality consolidates what would otherwise require separate devices, reducing overall system cost while maintaining detection accuracy.
Solution Approach 2:
The system merges data collection, storage, analysis, and correlation functions into a coordinated architecture where aggregators handle multiple collectors' data. This consolidation reduces the total number of separate components needed and lowers overall system cost while improving detection through aggregated data from multiple sources.
3Reliability
If network data is collected and analyzed to detect anomalies, then security monitoring is improved, but processing load and time required increase
Solution Approach 1:
The system performs preliminary data collection and local processing at collector devices before data reaches aggregators. Connection tables are maintained at aggregators to enable fast lookup and comparison. This preliminary organization of data reduces the processing time required for anomaly detection when events occur.
Solution Approach 2:
The system continuously collects and stores network data in connection tables at aggregators, maintaining ready-access data structures that enable immediate anomaly detection when new events arrive. This continuous preparation eliminates the need for time-consuming data gathering during detection events.
Data Source
AI summary
A system includes a plurality of collector devices that are disposed to collect statistical information on packets that are sent between nodes on a network. The system also includes a stackable aggregator that receives network data from the plurality of collector devices, and which produces a connection table that maps each node on the network to a record that stores information about traffic to or from the node. The stackable aggregator includes a manager blade, a database blade, and two or more, analyzer blades.