Temporal Knowledge Graphs for Interpretable Network Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anomaly detection methods in cybersecurity for modern manufacturing systems with complex network topologies and autonomous components struggle with topology changes, produce unmanageable false positives, and require baseline establishment, failing to capture temporal dependencies and provide human-interpretable explanations.
Innovation Solution
A method and system that represent networks as temporal knowledge graphs, using temporal random walks to extract interpretable temporal logical rules for anomaly detection, framing the task as a quadruple classification problem, and providing scalable, rule-based classification with human-understandable explanations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional anomaly detection methods are used that focus on separate data streams, then the detection process is simple, but it produces an unmanageable number of false positives that are hard to interpret
Solution Approach 1:
The patent merges multiple separate data streams (network events, system logs, threat intelligence) into a unified knowledge graph that integrates heterogeneous data sources. This consolidation allows the system to correlate events across different domains, reducing false positives by providing contextual understanding while maintaining high detection accuracy through multi-source validation.
Solution Approach 2:
The knowledge graph serves as an intermediary layer between raw event data and anomaly detection algorithms. It transforms unstructured events into structured entities with semantic relationships, enabling interpretable anomaly detection through graph-based patterns while preserving the contextual information needed for accurate classification.
2Reliability
If commercial software baselining methods are used that require running the network without security events, then a baseline behavior is established, but it does not deal well with topology changes and requires baselining activities beforehand
Solution Approach 1:
The system implements dynamic baselining where the knowledge graph continuously evolves as new events are processed. Instead of static baseline configurations, the system adapts to topology changes by learning new patterns from incoming events, automatically updating its understanding of normal behavior without requiring manual re-baselining activities.
Solution Approach 2:
The system performs preliminary learning by processing events in batches to build the knowledge graph structure before full anomaly detection begins. This preliminary action establishes the baseline patterns and entity relationships needed for accurate detection, while the system remains prepared to adapt to future topology changes through continuous learning.
3Loss of information
If graph-based machine learning algorithms are used to evaluate plausibility of new edges, then context-aware security monitoring is achieved, but the system complexity increases
Solution Approach 1:
The system segments the complex graph-based detection task into distinct processing stages: event ingestion and entity extraction, knowledge graph construction with predefined schemas, pattern matching against stored templates, and anomaly scoring. This segmentation reduces system complexity by breaking down the monolithic graph algorithm into manageable, independently optimizable components while preserving context-aware capabilities.
Data Source
AI summary
For anomaly detection in a network, a temporal knowledge graph represents the network including interactions between network modules with a set of entities, a set of relations, and a set of timestamps. In a first step, temporal random walks are sampled from the temporal knowledge graph. These are transformed in a second step into temporal logical rules. After observing an event in the network—or in a different network—the observed event is classified in a third step regarding an anomaly, using the temporal logical rules. The temporal knowledge graph is used as a stream-based data structure to extract rules that identify typical temporal behavior of the network and is used to identify anomalies in a human-interpretable way. The anomaly detection task is framed as a quadruple classification problem, using the temporal logical rules and their respective groundings in the temporal knowledge graph to support the classification.