# US 2025/0097243 A1 · Detection method of network anomaly and anomaly detection apparatus > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2025/0097243 A1 - Document ID: US20250097243A1 - Status: Published application - Kind: A1 - Application number: 18/511,860 - Filed: 2023-11-16 - Published: 2025-03-20 - Earliest claimed: 2023-09-18 - Assignees: Wistron Corporation - Applicants: Wistron Corporation - Inventors: Yuan Fu Huang - Web page: https://patentgrep.com/patent/US20250097243A1 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1433: {Vulnerability analysis} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A detection method of network anomaly and an anomaly detection apparatus are disclosed. In the detection method, one or more request intervals within a detection period are determined, where each of the request intervals is a time interval of two network requests from a network source. A network request anomaly from the network source is determined according to the request interval within the detection period. ## Claims ### Claim 1 A detection method of network anomaly, adapted to be executed by a processor, the detection method comprising: determining at least one request interval within a detection period, wherein each of the request intervals is a time interval of two network requests from a network source; and determining a network request anomaly from the network source according to the at least one request interval within the detection period. ### Claim 2 (depends on 1) The detection method of network anomaly according to claim 1, wherein determining the network request anomaly from the network source according to the at least one request interval within the detection period comprises: determining that the at least one request interval is an anomalous interval through a detection model, wherein the detection model is trained using at least one request interval of at least one normal interval. ### Claim 3 (depends on 1) The detection method of network anomaly according to claim 1, wherein determining the network request anomaly from the network source according to the at least one request interval within the detection period comprises: determining a number of occurrences of an anomalous interval where the at least one request interval is determined as the anomalous interval within the detection period; and determining the network request anomaly from the network source according to the number of occurrences of the anomalous interval within a plurality of the detection periods within a statistical period. ### Claim 4 (depends on 3) The detection method of network anomaly according to claim 3, wherein determining the network request anomaly from the network source according to the number of occurrences of the anomalous interval within the detection periods within the statistical period comprises: determining whether the number of occurrences of the anomalous interval within the detection periods within the statistical period conforms to a statistical distribution to produce a compliance result, wherein the compliance result comprises that the number of occurrences within the statistical period conforms to the statistical distribution, and that the number of occurrences within the statistical period does not conform to the statistical distribution; and determining the network request anomaly from the network source according to the compliance result of the statistical distribution. ### Claim 5 (depends on 4) The detection method of network anomaly according to claim 4, wherein determining whether the number of occurrences of the anomalous interval within the detection periods within the statistical period conforms to the statistical distribution comprises: determining a test statistic according to a number of observation and a number of expectation, wherein the number of observation is a number of occurrences in each of the detection periods, and the number of expectation is an expected value of the number of occurrences of the anomalous interval in the each of the detection periods in the statistical distribution; and determining the compliance result according to the test statistic. ### Claim 6 (depends on 5) The detection method of network anomaly according to claim 5, wherein determining the compliance result according to the test statistic comprises: determining whether the test statistic lies within an anomalous range of the statistical distribution; in response to the test statistic not lying within the anomalous range, determining that the compliance result is that the number of occurrences of the anomalous interval within the statistical period conforms to the statistical distribution; and in response to the test statistic lying within the anomalous range, determining that the compliance result is that the number of occurrences of the anomalous interval within the statistical period does not conform to the statistical distribution. ### Claim 7 (depends on 6) The detection method of network anomaly according to claim 6, wherein determining whether the test statistic lies within the anomalous range of the statistical distribution comprises: comparing the test statistic with a threshold value, wherein the threshold value is at a beginning of the anomalous range. ### Claim 8 (depends on 1) The detection method of network anomaly according to claim 1, wherein determining the network request anomaly from the network source according to the at least one request interval within the detection period comprises: blocking the network requests from the network source. ### Claim 9 (depends on 5) The detection method of network anomaly according to claim 5, wherein the test statistic is defined by a chi-square test. ### Claim 10 (depends on 4) The detection method of network anomaly according to claim 4, wherein the statistical distribution is Poisson distribution. ### Claim 11 An anomaly detection apparatus, comprising: a communication transceiver; a storage, storing a program code; and a processor, coupled to the communication transceiver and the storage, loading the program code to execute: determining at least one request interval within a detection period, wherein each of the request intervals is a time interval of two network requests from a network source received from the communication transceiver; and determining the network request anomaly from the network source according to the at least one request interval within the detection period. ### Claim 12 (depends on 11) The anomaly detection apparatus according to claim 11, wherein the processor further executes: determining that the at least one request interval is an anomalous interval through a detection model, wherein the detection model is trained using at least one request interval of at least one normal interval. ### Claim 13 (depends on 11) The anomaly detection apparatus according to claim 11, wherein the processor further executes: determining a number of occurrences of an anomalous interval where the at least one request interval is determined as the anomalous interval within the detection period; and determining the network request anomaly from the network source according to the number of occurrences of the anomalous interval within a plurality of the detection periods within a statistical period. ### Claim 14 (depends on 13) The anomaly detection apparatus according to claim 13, wherein the processor further executes: determining whether the number of occurrences of the anomalous interval within the detection periods within the statistical period conforms to a statistical distribution to produce a compliance result, wherein the compliance result comprises that the number of occurrences of the anomalous interval within the statistical period conforms to the statistical distribution, and that the number of occurrences of the anomalous interval within the statistical period does not conform to the statistical distribution; and determining the network request anomaly from the network source according to the compliance result of the statistical distribution. ### Claim 15 (depends on 14) The anomaly detection apparatus according to claim 14, wherein the processor further executes: determining a test statistic according to a number of observation and a number of expectation, wherein the number of observation is a number of occurrences in each of the detection periods, and the number of expectation is an expected value of the number of occurrences in the each of the detection periods in the statistical distribution; and determining the compliance result according to the test statistic. ### Claim 16 (depends on 15) The anomaly detection apparatus according to claim 15, wherein the processor further executes: determining whether the test statistic lies within an anomalous range of the statistical distribution; in response to the test statistic not lying within the anomalous range, determining that the compliance result is that the number of occurrences of the anomalous interval within the statistical period conforms to the statistical distribution; and in response to the test statistic lying within the anomalous range, determining that the compliance result is that the number of occurrences of the anomalous interval within the statistical period does not conform to the statistical distribution. ### Claim 17 (depends on 16) The anomaly detection apparatus according to claim 16, wherein the processor further executes: comparing the test statistic with a threshold value, wherein the threshold value is at a beginning of the anomalous range. ### Claim 18 (depends on 11) The anomaly detection apparatus according to claim 11, wherein the processor further executes: blocking the network requests from the network source through the communication transceiver. ### Claim 19 (depends on 15) The anomaly detection apparatus according to claim 15, wherein the test statistic is defined by a chi-square test. ### Claim 20 (depends on 14) The anomaly detection apparatus according to claim 14, wherein the statistical distribution is Poisson distribution.