3D Anomaly Dashboard for Network Behavior Pattern Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional user behavior analysis (UBA) struggles to identify critical behavior anomalies across large enterprises due to the difficulty in analyzing every account's behavior, especially with hundreds to thousands of users, and generalized organizational rules fail to detect deviations in typical yet potentially malicious patterns.
Innovation Solution
A digital fingerprinting (DFP) workflow using artificial intelligence and machine learning to generate fine-grained, unsupervised behavior models for each account, identifying user-specific anti-patterns through a suite of techniques and pipelines that analyze day-to-day activities, enabling early alerting on anomalous behavior.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional user behavior analysis uses generalized organizational rules to identify patterns, then it can detect explicitly bad patterns, but it fails to detect deviations in typical yet potentially malicious patterns and cannot deeply analyze every account behavior across large enterprises
Solution Approach 1:
The patent segments the analysis system into multiple specialized components: unsupervised behavior models for each account, supervised anomaly detection models, and a prioritization system. This segmentation allows each component to focus on specific tasks, improving overall detection precision while managing complexity through modular architecture.
Solution Approach 2:
The patent introduces a new dimension of analysis by moving from rule-based detection to machine learning-based behavioral analysis. It adds temporal dimensions through time-series analysis and multi-dimensional scoring (anomaly score, risk rating, prioritization score) to detect subtle deviations that traditional rules miss.
2Reliability
If the system analyzes every account login or application activity across an enterprise network with hundreds to thousands of users, then it can identify critical behavior anomalies, but it becomes difficult to rapidly identify and react to threats
Solution Approach 1:
The system performs preliminary actions by pre-training unsupervised behavior models for each account using historical data. These models establish baseline behaviors in advance, enabling rapid real-time anomaly detection without requiring complex analysis during threat events. The prioritization system also pre-ranks anomalies to speed up response.
Solution Approach 2:
The patent replaces manual security analysis with automated machine learning systems. Supervised anomaly detection models and automated prioritization algorithms substitute for manual inspection, enabling rapid processing of large volumes of account activities while maintaining high detection reliability.
3Reliability
If traditional UBA systems detect anomalies across large enterprises, then they can identify security threats, but they generate excessive false positives that increase the load on cybersecurity analysts
Solution Approach 1:
The system implements feedback loops where supervised anomaly detection models are trained on confirmed anomalies, and the prioritization system learns from analyst actions. This continuous feedback improves detection accuracy and reduces false positives over time by refining what constitutes a true anomaly versus normal variation.
Solution Approach 2:
The patent changes detection parameters by using multiple scoring dimensions (anomaly score, risk rating, prioritization score) instead of single threshold rules. It dynamically adjusts sensitivity based on account-specific baselines and contextual factors, reducing false positives while maintaining detection of true anomalies.
4Loss of information
If the system provides detailed analysis of every account behavior, then it can deeply understand user patterns, but it becomes difficult to rapidly identify critical behavior anomalies for security analysts
Solution Approach 1:
The system extracts only the most critical information from comprehensive account behavior analysis. The prioritization system identifies and extracts top anomalies requiring analyst attention, while less critical patterns are handled automatically or deferred. This extraction maintains detailed behavioral understanding while presenting only essential information to analysts.
Solution Approach 2:
The patent adds a prioritization dimension to the analysis output, transforming comprehensive behavioral data into ranked anomaly lists. It uses multi-dimensional scoring (anomaly score, risk rating, business impact) to project detailed analysis results into a format that highlights critical issues without overwhelming analysts with raw data volume.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Technologies for generating a graphical user interface (GUI) dashboard with a three-dimensional (3D) grid of unit cells are described. An anomaly statistic can be determined for a set of records. A subset of network address identifiers can be identified and sorted according to the anomaly statistic. The subset can have higher anomaly statistics than other network address identifiers. There can be a maximum number in the subset. The GUI dashboard is generated with unit cells organized by the subset of network address identifiers as rows, time intervals as columns, colors as a configurable anomaly score indicator, and a number of network access events as column heights. Each unit cell is a colored, 3D visual object representing a composite score of anomaly scores associated with zero or more network access events corresponding to the respective network address identifier at the respective time interval. The GUI dashboard is rendered on a display.