Anomalous Action Security Assessor Linked Query Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security systems struggle to effectively detect and differentiate between anomalous actions that pose a threat and those that are false positives or benign, leading to potential security breaches in cloud and network environments.
Innovation Solution
Implementing an anomalous action security assessor within a security service that utilizes a series of linked queries, including base queries and subqueries, to assess anomalies and determine whether to dismiss or tag them, thereby issuing security alerts only for confirmed threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security systems issue alerts for all anomalous actions, then security coverage is improved, but false alarms increase
Solution Approach 1:
The patent segments the anomaly assessment process into multiple hierarchical levels: initial anomaly detection, decision tree evaluation with multiple queries, and final alert generation. This segmentation allows the system to filter anomalies at different stages, improving security coverage while reducing false alarms by only alerting on anomalies that fail multiple assessment criteria.
Solution Approach 2:
The patent introduces an intermediary assessment layer (decision tree with multiple queries) between anomaly detection and alert generation. This intermediary evaluates contextual information and user responses to determine whether an anomaly warrants an alert, effectively mediating between comprehensive monitoring and false alarm reduction.
2Measurement precision
If security systems investigate all anomalies, then threat detection accuracy is improved, but system resources are consumed
Solution Approach 1:
The patent applies partial action by investigating only those anomalies that meet specific criteria through the decision tree assessment, rather than investigating all anomalies equally. The system performs full investigation only when necessary (when decision tree outcomes indicate potential threats), while applying lighter assessment to other cases, thus balancing accuracy with resource conservation.
Solution Approach 2:
The patent applies different levels of investigation intensity to different anomalies based on their characteristics and decision tree outcomes. High-priority anomalies receive comprehensive investigation while lower-priority ones receive minimal assessment, optimizing resource allocation according to local needs of each anomaly case.
3Productivity
If security systems use simple anomaly detection, then processing speed is improved, but false positives increase
Solution Approach 1:
The patent performs preliminary assessment actions through the decision tree evaluation before final alert generation. This preliminary action filters out many false positives early in the process using efficient query evaluation, allowing the system to maintain high processing speed while improving accuracy by only proceeding to full investigation for suspicious cases.
4Object-generated harmful factors
If security systems implement multi-level query assessment, then false alarm reduction is improved, but system complexity increases
Solution Approach 1:
The patent segments the complex assessment task into structured decision tree components with multiple queries and outcomes. This segmentation organizes the complexity into manageable, modular units that can be evaluated systematically, reducing false alarms while keeping the system architecture organized and maintainable.
Data Source
AI summary
An anomalous action security assessor is disclosed. An anomaly is received from a set of anomalies. A series of linked queries associated with the anomaly is presented to the user. The series of linked queries includes a base query and a subquery. The base query tests an attribute of the anomaly and resolves to a plurality of outcomes of the base query. The subquery is associated with an outcome of the plurality of outcomes of the base query. The series of linked queries finally resolve to one of tag the anomaly and dismiss the anomaly. A security alert is issued if the series of linked queries finally resolves to tag the anomaly.