Adaptive Object Modeling for ML User Behavior Analytics
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security platforms face performance bottlenecks due to high CPU usage during data ingestion and machine learning model training, particularly in user behavior analytics systems, which are time-consuming and inefficient for security analysts.
Innovation Solution
Implementing an adaptive object monitoring system with a watch list that selectively updates and refines the training data set through differential data ingestion and pruning, focusing on users with high moving average risk scores and recent activity, to optimize machine learning model updates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If comprehensive data from all users is ingested for machine learning model training, then model accuracy and threat detection capability are improved, but CPU usage and data ingestion time increase significantly
Solution Approach 1:
The patent segments the user base into different groups based on risk profiles, behavior patterns, and threat indicators. Instead of processing all user data uniformly, the system divides users into high-risk, medium-risk, and low-risk segments, applying different data ingestion strategies to each segment. This segmentation allows the system to focus computational resources on users most likely to exhibit malicious behavior while maintaining adequate monitoring of other users.
Solution Approach 2:
The patent implements local quality by applying different levels of data collection and analysis intensity to different user segments. High-risk users receive comprehensive monitoring and detailed data ingestion, while low-risk users receive minimal monitoring. This differentiated approach ensures that the highest quality data processing is applied where it is most needed for threat detection, rather than uniformly across all users.
2Reliability
If machine learning models are trained frequently with updated data, then detection capability is improved, but computational resource consumption and processing time increase
Solution Approach 1:
The patent implements periodic action by scheduling machine learning model training and updates at specific intervals rather than continuously. The system performs full model retraining periodically (e.g., weekly or monthly) while conducting lighter, more frequent updates based on significant events or threshold crossings. This periodic approach balances the need for up-to-date detection capability with the computational cost of frequent training cycles.
Solution Approach 2:
The patent applies preliminary action by pre-processing and preparing training data in advance, organizing it into ready-to-use formats before model training begins. The system pre-computes features, aggregates data, and validates training sets beforehand, so that when model training is initiated, the actual computation time is reduced. This preliminary preparation significantly decreases the time required for frequent model updates.
Data Source
AI summary
A machine learning (ML)-based technique for user behavior analysis that detects when users deviate from expected behavior. A ML model is trained using training data derived from activity data from a first set of users. The model is refined in a computationally-efficient manner by identifying a second set of users that constitute a “watch list.” At a given time, a differential data ingestion operation is then performed to incorporate data for the second set of users into the training data, while also pruning at least a portion of the data set corresponding to data associated with any user included in the first set but not in the second set. These operations update the training data used for the machine learning. The machine learning model is then refined based on the updated training data that incorporates the activity data ingested from the users identified in the watch list.