Unsupervised machine learning

Calculation of anomaly indicator values

Airlock Anomaly Shield uses unsupervised machine learning to model normal application behavior based on previously observed web sessions. As there is no fixed definition of what constitutes “normal” behavior (for example, for the TimingCluster indicator), the system establishes dynamic baselines from historical data.

For each new session, the current measurements are evaluated against these learned baselines. The degree of deviation is quantified as an anomaly indicator value.

Example: TimingCluster indicator

The following example illustrates how unsupervised learning is applied using the TimingCluster indicator:

  1. Airlock Anomaly Shield collects timing statistics from past sessions, capturing the distribution of request intervals (timestamp deltas) within each session.
  2. Based on this data, the model groups similar timing patterns using a clustering algorithm (e.g. k-means), forming clusters that represent typical session behavior.
  3. For a new session, its timing distribution is assigned to one of these clusters. The anomaly indicator value reflects how typical this cluster is:
    • If the session is assigned to a small cluster (rare timing behavior), the indicator value is close to 1.0.
    • If the session is assigned to a large cluster (common timing behavior), the indicator value is closer to 0.0.
  5. The computed indicator value is compared against a configured threshold. If the threshold is exceeded, the TimingCluster indicator is activated and contributes to the anomaly indicator pattern.

Predefined thresholds are provided to detect common session anomalies and can be adjusted as needed.