Compromised Account Detection Using Behavioral Risk Modeling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security systems for monitoring user accounts are generic and rely on one-size-fits-all security rules, failing to effectively detect compromised accounts and attempts to compromise accounts.
Innovation Solution
A computer-implemented method involving machine learning (ML) models trained on datasets of compromised and uncompromised user accounts, using event sourcing to analyze user behavior patterns, and generating numerical representations to predict security risks, with adaptive sliding window selection and semi-supervised learning processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If generic security rules and one-size-fits-all metrics are used to monitor user accounts, then the security system is simple to implement and maintain, but it fails to effectively detect compromised accounts and attempts to compromise accounts
Solution Approach 1:
The system transitions from static generic security rules to dynamic machine learning models that continuously learn from event data. The ML models adapt to different user roles and behaviors, making the security detection dynamic rather than fixed, thereby improving reliability while managing complexity through automated learning processes
Solution Approach 2:
The system changes from using fixed security metrics to using learned numerical representations of user behavior patterns. By transforming event data into numerical features through ML models, the system adapts security parameters based on actual user behavior rather than predetermined rules, enhancing detection accuracy
2Reliability
If machine learning models trained on user behavior patterns are used to detect compromised accounts, then detection accuracy is improved, but data processing time and computational resources increase
Solution Approach 1:
The system performs preliminary training of machine learning models offline using historical event data before deployment. By pre-training the models with comprehensive datasets and storing the learned numerical representations, the system avoids time-consuming processing during actual security monitoring, reducing real-time data processing time while maintaining high detection accuracy
Solution Approach 2:
The system creates numerical representations (copies) of complex user behavior patterns from raw event data. These numerical representations serve as simplified proxies that capture essential behavior characteristics without requiring processing of the entire raw event dataset during detection, thereby reducing computational time and resources
Data Source
AI summary
Please replace the abstract with the following abstract:A method includes determining, from an event store, a compromised account dataset and an uncompromised account dataset, and determining from the datasets, a training dataset. The training dataset comprises examples from the compromised account dataset and examples from the uncompromised account dataset, at least some of which comprise a label indicative of a security risk or no security risk, respectively. The method comprises determining a set of attributes from the examples, and determining a numerical representation of each set of attributes. The method comprises training a compromised account detection model using the numerical representations and the labels to predict a likelihood of a candidate user account being a security risk and providing the trained compromised account detection model.