Temporal Link Prediction for Network Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for link prediction in computer networks are inefficient in detecting anomalous behavior due to their inability to account for complex time-dependent dynamics, leading to potential undetected breaches and malicious activities.
Innovation Solution
The use of random dot product graphs (RDPGs) and generalized RDPGs (GRDPGs) for temporal link prediction, which generate time series of adjacency matrices to estimate link probabilities and detect anomalies by comparing predicted and actual network activity, employing techniques like spectral embedding, autoregressive integrated moving average (ARIMA) models, and common subspace independent-edge (COSIE) models.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional link prediction methods are used, then the system is simpler to implement, but the anomaly detection accuracy is insufficient and cannot capture complex time-dependent network dynamics
Solution Approach 1:
The patent applies dynamics by transitioning from static link prediction to temporal link prediction that captures time-dependent network dynamics. The method models network evolution over time using temporal graphs and dynamic spectral embeddings, allowing the system to adapt to changing network structures and detect anomalies that evolve temporally, thereby improving detection accuracy while accounting for the inherent complexity of dynamic systems.
Solution Approach 2:
The patent introduces a temporal dimension to traditional link prediction by incorporating time-series analysis and spectral embeddings that evolve over time. This additional dimension allows the system to capture network dynamics across multiple time points, improving anomaly detection accuracy by considering not just the current network state but also its historical evolution patterns.
2Measurement precision
If temporal link prediction with spectral embeddings is used, then the detection accuracy improves, but the computational efficiency decreases due to handling large volumes of time-series data
Solution Approach 1:
The patent extracts and focuses on the most relevant temporal patterns and spectral features from the time-series network data. By identifying and isolating key dynamic characteristics through spectral embeddings and temporal link prediction, the method captures essential anomaly indicators while filtering out redundant information, thereby improving detection accuracy without proportionally increasing computational burden.
Solution Approach 2:
The patent transforms the network data into spectral embedding space and uses parameter-based temporal models to predict link probabilities. This parameter transformation approach converts raw time-series adjacency matrices into compressed spectral representations, reducing the dimensionality of the problem while preserving critical temporal dynamics, thus improving computational efficiency while maintaining detection accuracy.
3Loss of information
If complex temporal models are used to capture network dynamics, then the understanding of network evolution improves, but the latency increases
Solution Approach 1:
The patent performs preliminary spectral embedding and temporal pattern analysis on historical network data to establish baseline models of normal network evolution. By pre-computing spectral embeddings and training temporal prediction models on past data, the system prepares anomaly detection frameworks in advance, allowing for faster real-time detection without sacrificing the depth of dynamic analysis when actual anomalies need to be identified.
Data Source
AI summary
Disclosed are systems and methods for temporal link prediction based on (generalized) random dot product graphs (RDPGs), as well as applications of such temporal link prediction to network anomaly detection. In various embodiments, starting from a time series of adjacency matrices characterizing the evolution of the network, spectral embeddings and time-series models are used to predict estimated link probabilities for a future point in time, and the predicted link probabilities are compared against observed links to identify anomalous behavior. In some embodiments, element-wise independent models are used in the prediction to take network dynamics into account at the granularity of individual nodes or edges.