Time-Slice Autoencoder Detection for Low-False-Alarm DDoS Traffic
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing DDOS attack detection methods are cumbersome, slow, and prone to both false-positives and false-negatives due to the use of thresholding techniques.
Innovation Solution
Employing a network of smaller, less complex autoencoders, such as CNN and LSTM, to analyze traffic data in different time frames and attributes, using multiple autoencoders to distinguish between malicious and non-malicious traffic, and aggregating their outputs with weighted values to identify DDOS attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If thresholding techniques are used for DDOS attack detection, then the detection process is simple, but the detection accuracy is low and false positives/negatives occur
Solution Approach 1:
The patent segments the detection process into multiple specialized autoencoders, each trained on different time frames (e.g., 1-second, 5-minute, 1-hour intervals) and different traffic attributes. This segmentation allows each autoencoder to focus on specific patterns while collectively achieving high detection accuracy without using simple thresholding.
Solution Approach 2:
The system employs multiple autoencoders that serve universal functions across different detection scenarios. Each autoencoder can detect various types of DDOS attacks (volumetric, protocol analysis, application layer) by analyzing different time frames and attributes, making the system versatile and accurate without requiring separate specialized systems for each attack type.
2Measurement precision
If a single complex autoencoder is used, then detection accuracy may improve, but processing speed and complexity increase
Solution Approach 1:
Instead of one complex autoencoder, the system segments the detection task into multiple smaller autoencoders, each handling specific time frames and attributes. This reduces the complexity of individual models while maintaining or improving overall detection accuracy through ensemble analysis.
Solution Approach 2:
The system uses multiple autoencoders with different scopes (some analyzing short time frames, others analyzing long time frames) to perform partial detection tasks. By combining these partial results, the system achieves comprehensive detection accuracy without requiring any single autoencoder to be overly complex.
3Measurement precision
If multiple autoencoders are used to analyze different time frames, then detection accuracy improves, but computational resources increase
Solution Approach 1:
The system applies partial action by having different autoencoders analyze only specific time frames and attributes relevant to their function. Not all autoencoders process all data, which reduces redundant computational work while maintaining detection accuracy through coordinated analysis of specialized subsets.
Solution Approach 2:
By segmenting the computational workload across multiple specialized autoencoders, each processing specific time frames and attributes, the system distributes computational resources efficiently. This segmentation prevents any single processor from being overwhelmed while achieving comprehensive detection through aggregated results.
4Reliability
If real-time analysis of all traffic attributes is performed, then detection completeness improves, but processing speed decreases
Solution Approach 1:
The system segments traffic analysis into parallel streams, with different autoencoders simultaneously analyzing different time frames and attributes. This parallel processing maintains detection completeness while improving processing speed, as multiple analyses occur concurrently rather than sequentially.
Solution Approach 2:
Different autoencoders perform partial analyses on specific subsets of traffic attributes and time frames. By combining these partial analyses, the system achieves complete detection coverage without requiring any single processor to analyze all attributes, thus maintaining high processing speed.
Data Source
AI summary
Techniques are provided for dynamic time slice autoencoder network anomaly detection. A method for dynamic time slice autoencoder network anomaly detection can include generating data from a router connecting a plurality of IP addresses in at least one network to a public network, generating a plurality of visual representations of the data, ingesting each of the visual representations of the data into a unique autoencoder corresponding to a time frame of the ingested visual representation, aggregating the values from the autoencoders, and identifying a Denial-of-service (DDOS) attack based on the aggregated values from the autoencoders. Each of the plurality of visual representations of the data can be generated for one of a plurality of predetermined time frames. The data can characterize attributes of traffic passing through the router. The autoencoder can be trained to output a value indicating that the ingested visual representation contains one of anomalous or non-anomalous activity.