Per-Account Behavior Models for Real-Time Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional user behavior analysis (UBA) struggles to identify critical behavior anomalies across large enterprise networks due to the difficulty in analyzing every account's behavior, especially for enterprises with hundreds to thousands of users, and generalized organizational rules fail to detect deviations in typical yet potentially malicious patterns.
Innovation Solution
A digital fingerprinting (DFP) workflow using artificial intelligence and machine learning to generate fine-grained, unsupervised behavior models for each account, detecting user-specific anti-patterns through a suite of techniques and pipelines that analyze day-to-day activities, enabling early threat detection and reducing false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional generalized organizational rules are used to identify patterns, then the analysis process is simple, but the detection precision is insufficient for deviations in typical yet potentially malicious patterns
Solution Approach 1:
The patent segments the analysis system into multiple specialized components: unsupervised training pipeline for model generation, inference pipeline for anomaly detection, model registry for model management, and various processing modules for different data types. This segmentation allows each component to specialize in specific tasks, improving overall detection precision while managing complexity through modular architecture.
Solution Approach 2:
The patent introduces digital fingerprinting models as intermediaries between raw user behavior data and anomaly detection results. These models act as mediators that transform complex behavioral patterns into interpretable anomaly scores, enhancing detection precision without requiring direct complex analysis of all raw data.
2Measurement precision
If every account's behavior is deeply analyzed across the enterprise network, then the anomaly detection precision is improved, but the analysis time and computational resources increase significantly
Solution Approach 1:
The patent implements preliminary action by pre-training unsupervised behavior models for each account using historical data during off-peak periods. These pre-trained models are stored in a model registry and can be rapidly applied for real-time anomaly detection, allowing deep analysis to be performed in advance without impacting real-time analysis time.
Solution Approach 2:
The patent changes parameters by transitioning from traditional supervised learning approaches to unsupervised learning with digital fingerprinting. This parameter change enables the system to detect deviations from normal behavior patterns without requiring labeled training data, significantly reducing analysis time while maintaining high detection precision.
3Productivity
If traditional UBA methods are used, then the system is easier to operate, but the productivity in identifying critical behavior anomalies is insufficient
Solution Approach 1:
The patent replaces manual mechanical analysis methods with automated machine learning-based digital fingerprinting models. The system automatically generates behavior models, scores anomalies, and identifies critical patterns without manual intervention, dramatically improving productivity while the standardized automated processes maintain ease of operation.
Solution Approach 2:
The patent implements feedback mechanisms where anomaly detection results are continuously fed back into the model training process. The system learns from detected anomalies and continuously improves its detection capabilities, increasing productivity over time while the automated feedback loops maintain operational simplicity.
4Reliability
If multiple fine-grained models are generated for each account, then the detection precision is improved, but the device complexity and computational resources increase
Solution Approach 1:
The patent creates universal model registry infrastructure that can store, manage, and retrieve multiple fine-grained digital fingerprinting models for different accounts and data types. This universal system handles model lifecycle management uniformly, allowing the system to maintain high reliability through multiple specialized models while managing complexity through a single unified model registry interface.
Data Source
AI summary
Technologies for generating a set of models for each account, where each model is a fine-grained, unsupervised behavior model trained for each user to monitor and detect anomalous patterns are described. An unsupervised training pipeline can generate user models, each being associated with one of multiple accounts and is trained to detect an anomalous pattern using feature data associated with the one account. Each account is associated with at least one of a user, a machine, or a service. An inference pipeline can detect a first anomalous pattern in first data associated with a first account using a first user model. The inference pipeline can detect a second anomalous pattern in second data associated with a second account using a second user model.