Adaptive Online Data Protection System Using Machine Learning Feedback
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for controlling unauthorized data activity rely on hard-coded rules, leading to numerous false positives and false negatives, and lack the flexibility to learn from user actions, making them ineffective in differentiating between authorized and unauthorized data access.
Innovation Solution
An adaptive online data protection system using machine learning techniques to identify and respond to anomalous data activity, allowing for real-time differentiation between authorized and unauthorized data access without the need for pre-defined rules, and learns from user feedback to refine its decisions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hard-coded rules are used to control data activity, then data security policies can be enforced, but the system generates numerous false positives and false negatives and cannot learn from user actions
Solution Approach 1:
The system implements feedback loops where user responses to alerts (false positives and false negatives) are collected and used to retrain the machine learning model. This continuous feedback mechanism allows the system to learn from its mistakes and improve its accuracy over time, directly addressing the inability of hard-coded rules to adapt to user behavior patterns
Solution Approach 2:
The machine learning model performs self-improvement by automatically learning from user feedback without requiring manual rule updates. The system serves itself by continuously refining its own detection algorithms based on accumulated data, transitioning from static hard-coded rules to a dynamic self-learning system
2Reliability
If hard-coded rules are used for data activity control, then unauthorized access can be detected, but the system produces many false positives and false negatives
Solution Approach 1:
The system changes the fundamental parameter of detection from static rule-based thresholds to dynamic machine learning predictions. The ML model analyzes multiple features and patterns simultaneously, adjusting detection parameters based on learned relationships, which significantly improves detection precision and reduces false positives compared to rigid hard-coded rules
Solution Approach 2:
The detection system combines multiple data sources and analysis methods into a composite approach. Instead of relying on a single hard-coded rule, the system integrates various user behavior patterns, access contexts, and historical data through machine learning, creating a more robust and precise detection mechanism
3Measurement precision
If machine learning techniques are used to identify anomalous data activity, then false positives and false negatives are reduced, but the system requires continuous learning from user feedback
Solution Approach 1:
The system implements automated feedback collection and processing mechanisms where user responses to alerts are automatically captured, processed, and used to retrain the model. This automated feedback loop manages the complexity by systematizing the learning process rather than requiring manual intervention, making the continuous learning aspect manageable
Solution Approach 2:
The patent introduces an intermediary alerting system that acts as a buffer between the ML detection model and the user. The system presents uncertain cases as alerts for user review, allowing the model to learn from user decisions without directly exposing the complexity of the learning mechanism to end users
Data Source
Figure 1
Figure 2~3
Figure 4
AI summary
Systems and methods for identifying and responding to anomalous data activity by a computer user on a computing device are presented. An anomalous data activity service, implemented as a machine learning service, receives notice of data activity and conducts an evaluation to determine whether the data activity is an anomalous data activity. Upon determining that the data activity is an anomalous data activity, a responsive action may be taken that may result in the anomalous data activity being blocked or allowed.