Abnormal User Identification via Behavioral Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for identifying abnormal users in network systems, such as those engaging in malicious activities, rely on blacklisting, which only detects known users and fails to identify unknown or unforeseen abnormal behavior.
Innovation Solution
An abnormal user identification method that acquires user behavior data, extracts eigenvalues under multiple behavior dimensions, clusters these values using algorithms like K-means, and determines difference eigenvectors to identify users outside predetermined ranges, allowing for the detection of unknown abnormal users without the need for blacklisting.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If blacklisting methods are used to identify abnormal users, then known abnormal users can be detected, but unknown abnormal users and unforeseen abnormal behaviors cannot be identified
Solution Approach 1:
The system performs preliminary clustering of user behavior data to establish normal behavior patterns and thresholds before actual abnormal user detection. By pre-processing the behavior data and determining clustering parameters in advance, the system creates a foundation for detecting both known and unknown abnormal behaviors without needing to manually update blacklists for every new threat
Solution Approach 2:
The system automatically identifies abnormal users through unsupervised clustering algorithms that self-adjust to detect deviations from normal behavior patterns. The clustering-based detection mechanism serves itself by continuously learning from behavior data and automatically adapting to new abnormal patterns without requiring manual blacklist updates, thereby detecting both known and unknown abnormal users
2Adaptability or versatility
If multiple detection methods are implemented for different user behaviors, then detection coverage improves, but system complexity increases
Solution Approach 1:
The patent employs a universal clustering-based detection framework that can handle multiple types of user behaviors (email sending, web browsing, video downloading, etc.) through a single unified algorithm. This multi-functional approach allows the system to detect various abnormal behaviors using the same clustering mechanism, thereby improving detection coverage across different behavior types while avoiding the need for separate complex detection systems for each behavior
Solution Approach 2:
The system changes detection parameters dynamically based on clustering results and behavior dimensions. By adjusting clustering parameters and thresholds according to different behavior types and data distributions, the system achieves comprehensive detection coverage across multiple behaviors while maintaining a relatively simple unified detection framework rather than requiring separate fixed-threshold systems for each behavior type
Data Source
AI summary
User behavior data of multiple users is acquired, and multiple user eigenvalues of user behavior data of each user under preset multiple user behavior dimensions are extracted. A user eigenvector of each user is determined based on the multiple eigenvalues of this user. Multiple user classes are obtained by clustering the user eigenvectors of multiple users are clustered through a preset clustering algorithm. A central vector of each user class is determined based on the user eigenvectors included in this user class. A difference eigenvector of each user class is determined, wherein a distance between the difference eigenvector and a central vector of an aggregation class to which the difference eigenvector belongs is not within a preset distance range. A user characterized by the difference eigenvector is determined as an abnormal user.