Web Traffic Anomaly Detection Using Multi-Characteristic Client Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Detecting anomalies in web traffic is challenging due to the sophistication of attacks and the inability of human analysts to effectively evaluate data at low levels of granularity, leading to inaccurate and time-consuming anomaly detection.
Innovation Solution
Automated web traffic anomaly detection using client keys that include multiple characteristics, enabling the calculation of z-score, change rate, and failure metrics to identify anomalies with greater granularity and efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If human analysts manually evaluate web traffic data, then they can detect anomalies with human judgment, but the detection accuracy is low and the process is time-consuming
Solution Approach 1:
The patent replaces the mechanical system of human analysts manually evaluating web traffic data with an automated computer-based system that applies mathematical algorithms (z-score, change rate, failure metrics) to detect anomalies. This substitution eliminates human limitations in processing speed and granularity while maintaining consistent, objective detection criteria across all data points.
Solution Approach 2:
The patent transforms the evaluation process by changing from subjective human judgment to objective mathematical parameter calculations. By computing z-score metrics, change rate metrics, and failure metrics automatically, the system achieves both higher precision in anomaly detection and dramatically reduced time requirements compared to manual analysis.
2Measurement precision
If human analysts evaluate web traffic at a single level of granularity, then the analysis process is simple, but the detection is incomplete and cannot effectively evaluate lower levels of granularity
Solution Approach 1:
The patent segments web traffic data into multiple client keys, each representing different levels of granularity (e.g., overall traffic, traffic by country, traffic by webpage). The automated system independently calculates anomaly metrics for each segment, enabling comprehensive detection across all granularities simultaneously without increasing human workload or complexity.
Solution Approach 2:
The automated anomaly detection system performs multiple functions simultaneously: it evaluates web traffic at various granularities, calculates multiple types of metrics (z-score, change rate, failure), and generates comprehensive reports all through a single unified system, rather than requiring separate manual analysis processes for each level.
3Measurement precision
If more characteristics are included in client keys to increase granularity, then anomaly detection becomes more precise, but the computational complexity increases
Solution Approach 1:
The patent segments client keys to include multiple characteristics (country, webpage, time period) that define different levels of granularity. By organizing data into these segmented groups, the system can efficiently calculate metrics for each segment independently, achieving high precision detection without overwhelming computational complexity through structured data organization.
Solution Approach 2:
The patent manages computational complexity by changing parameters in a systematic way: it calculates metrics hierarchically from broader to more specific client keys, reusing intermediate results. This parameter-based approach allows the system to handle multiple characteristics per client key while maintaining computational efficiency through structured calculation sequences.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An anomaly detection system that includes a database and a server. The server is connected to the database. The server is configured to identify anomalous web traffic for a certain time period based on one or more client keys from the certain time period. The client key(s) includes at least two characteristics related to web traffic data. The server includes a processing unit and a memory. The server is configured to receive the web traffic data from the database, calculate a z-score metric for the client key, calculate a change rate metric for the client key, calculate a failure metric for the client key, determine an anomaly score based on the z-score metric, the change rate metric, and the failure metric, and determine that the certain time period is an anomalous time period based on the anomaly score.