Access Graph for Suspicious Entity-Resource Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern data centers face challenges in analyzing and searching massive quantities of machine-generated data from various sources, including system logs, network packet data, sensor data, and application program data, due to the diverse formats and types of data generated by thousands of components, which can lead to inefficiencies in data processing and storage.
Innovation Solution
The implementation of an access graph that includes entity and resource access data, with access scores determined by applying access rules, is used to train a probabilistic prediction model for detecting suspicious access. This model predicts the suspiciousness of accesses between entities and resources, leveraging both observed and artificial access data to improve prediction accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional data analysis methods are used on massive machine-generated data, then data processing can be performed, but false positives increase and detection accuracy decreases
Solution Approach 1:
The system performs preliminary actions by generating an access graph that incorporates both observed access data and artificial access data before conducting suspicious access detection. This pre-processing step creates a comprehensive baseline of normal access patterns, enabling the probabilistic prediction model to more accurately distinguish suspicious activities and reduce false positives.
Solution Approach 2:
The access graph serves as an intermediary structure that bridges raw access data and the probabilistic prediction model. It transforms diverse machine-generated data into a standardized format with entity-resource relationships and access scores, enabling more precise detection while reducing the noise that causes false positives.
2Measurement precision
If access rules are applied to determine access scores for all entity-resource pairs, then prediction accuracy improves, but computational complexity increases
Solution Approach 1:
The system applies local quality by calculating access scores selectively for specific entity-resource pairs rather than uniformly across all possible pairs. The probabilistic prediction model focuses computational resources on pairs with higher suspiciousness potential, maintaining high prediction accuracy while reducing overall computational complexity.
3Measurement precision
If both observed and artificial access data are included in the access graph, then model training accuracy improves, but data processing time increases
Solution Approach 1:
Artificial access data is generated in advance as part of the preliminary access graph construction process. This synthetic data supplements observed access patterns and provides additional training examples for the probabilistic prediction model, improving training accuracy without requiring real-time data collection for all scenarios.
Data Source
AI summary
Embodiments of the present invention are directed to facilitating detection of suspicious access to resources. In accordance with aspects of the present disclosure, an access graph is generated. The access graph contains access data that includes observed accesses between entities and resources. Access scores can be determined for entity-resource pairs in the access graph by applying a set of access rules to the entity-resource pairs in the access graph. The access scores indicate an extent of relatedness between the corresponding entity and resource. Thereafter, the access scores can be used to train a probabilistic prediction model that predicts suspiciousness of accesses between entities and resources.