Vector-Based Anomaly Detection in Network Fabrics
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anomaly detection techniques in network fabrics are inadequate as they fail to cover the full fabric, detect subtle intrusions, and are consumptive of time and bandwidth, with a reliance on static conditions that do not account for new threats.
Innovation Solution
Monitoring network behavior using vectors of behavior metrics that can be weakly or strongly correlated, with each node locally monitoring these metrics and reporting criterion status rather than sending bulk raw data, allowing for the detection of anomalies based on variations from a baseline vector.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If raw data is sent throughout the network for anomaly detection, then detection coverage is improved, but bandwidth consumption and time consumption increase
Solution Approach 1:
The network fabric is segmented into multiple nodes, each independently evaluating anomaly criteria locally. Instead of centralizing raw data collection, each node processes its own metrics and contributes only when necessary, dividing the detection workload across the distributed system and reducing overall bandwidth consumption.
Solution Approach 2:
The essential information for anomaly detection is extracted from raw data at each node through local evaluation of anomaly criteria. Only criterion status indicators (not raw data) are transmitted across the network, extracting the essential detection signal while eliminating redundant data transmission.
2Ease of manufacture
If static conditions are used for anomaly detection, then implementation simplicity is improved, but detection of new threats deteriorates
Solution Approach 1:
The anomaly detection system transitions from static signature matching to dynamic statistical evaluation. Anomaly criteria are expressed as statistical functions that continuously evaluate measured vectors against baseline behavior, allowing the system to adapt to new threat patterns while maintaining implementation simplicity through standardized statistical methods.
Solution Approach 2:
The detection approach changes from fixed parameter thresholds to dynamic statistical parameters. Instead of comparing against static condition lists, the system uses statistical functions that evaluate variations in measured behavior vectors, enabling detection of novel threats that deviate from baseline patterns without requiring pre-defined signatures.
3Ease of operation
If multiple individual metrics are monitored separately, then measurement simplicity is improved, but detection of correlated anomalies deteriorates
Solution Approach 1:
Multiple individual behavior metrics are merged into a unified measured behavior vector at each node. The anomaly criteria evaluate the vector as a whole, capturing correlations between metrics through statistical functions that consider the joint behavior of multiple parameters simultaneously, thereby detecting correlated anomalies that individual metric monitoring would miss.
Data Source
AI summary
A hybrid-fabric apparatus comprises a black box memory configured to store a plurality of behavior metrics and an anomaly agent coupled to the black box. The anomaly agent determines a baseline vector corresponding to nominal behavior of the fabric, wherein the baseline vector comprises at least two different behavior metrics that are correlated with each other. The anomaly agent disaggregates anomaly detection criteria into a plurality of anomaly criterion to be distributed among network nodes in the fabric, the anomaly detection criteria characterizing a variation from the baseline vector, and each of the plurality of anomaly criterion comprising a function of a measured vector of behavior metrics. The variation can be calculated based on a variation function applied to a vector of measured behavior metrics having elements corresponding to member elements of the baseline vector. Anomaly criterion statuses calculated by at least some of the network nodes are aggregated.