Power Law Distributions in Network Security
Most security events in networks follow power law distributions—a mathematical pattern where a few events occur very frequently while many events occur rarely. Traditional IDS systems treat all events equally, leading to alert fatigue. Our approach leverages this natural distribution to identify truly anomalous activity.
This methodology is based on the founder's patented research (US-6353385-B1) and represents a fundamental rethinking of how intrusion detection should work.
Network events follow a distribution where P(X=k) ∝ k^(-α), meaning frequency decreases as a power of event rarity. This pattern appears consistently across networks.
Modern networks exhibit small-world properties with clustered connections and short path lengths. Understanding topology is key to detecting lateral movement.
Rather than arbitrary thresholds, we use hypothesis testing to determine if observed patterns deviate significantly from expected power law distributions.
Shannon entropy and Kolmogorov complexity metrics quantify the "surprise" in security events, highlighting genuinely unusual patterns.
System observes normal network behavior for 2-4 weeks, building statistical models of event frequencies, source/destination patterns, and temporal rhythms.
For each event type, we fit power law distributions and test goodness-of-fit using Kolmogorov-Smirnov tests to ensure the model accurately represents reality.
New events are scored based on how well they fit the expected distribution. Events in the "tail" (rare but following the power law) are normal; events far from the distribution are flagged.
Network structure is mapped as a graph. Communication patterns inconsistent with the topology (e.g., workstation-to-workstation connections) are highlighted.
Events are correlated across time to identify multi-stage attacks. Even if individual steps seem normal, the sequence may be anomalous.
Only statistically significant anomalies generate alerts, with confidence scores and context to aid investigation.
Normal Pattern: Server receives 10,000-100,000 requests/day (power law)
Observation: Server receives 500 requests from single IP in 10 minutes
Analysis: While 500 requests is within normal volume range, the concentration from a single source in a short window has p-value < 0.001—highly unlikely under normal distribution
Result: Alert generated for potential reconnaissance/scanning activity
False Positive Rate: < 1% due to statistical rigor
This approach is grounded in multiple areas of research:
Research by Barabási, Albert, and others demonstrates that many natural and technological networks follow scale-free, power law patterns. Security events inherit these properties.
Networks are complex adaptive systems where simple rules create emergent behavior. Understanding these dynamics enables better anomaly detection.
Techniques from signal detection theory allow us to optimize the trade-off between detection probability and false alarm rate.
Currently under development. Request beta access to be among the first to deploy.