Anomalous User Session Detector Using Supervised Learning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security measures in cloud computing environments are inadequate in detecting newly developed or undefined attacks, as they rely on predefined rules and are prone to false positives and negatives, especially when attackers disguise irregular operations within benign commands.
Innovation Solution
An anomalous user session detector is implemented, comprising a training component that learns typical user behavior and a detection component that identifies deviations using a supervised learning model, allowing for real-time identification of unauthorized access and taking appropriate security actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If predefined security rules are used to detect attacks, then the system is simple to implement, but it cannot detect newly developed or undefined attacks and produces false positives and negatives
Solution Approach 1:
The patent replaces the mechanical/predefined rule-based security system with an artificial intelligence-based system. Specifically, it uses machine learning models (including deep learning neural networks) to automatically learn and detect attack patterns from user behavior data, eliminating the need for manual rule creation while significantly improving detection accuracy for both known and unknown attack types.
Solution Approach 2:
The security system performs self-learning and self-improvement by automatically analyzing user behavior patterns and updating its detection models without human intervention. The system continuously learns from new data to adapt to evolving attack techniques, making it self-sufficient in improving its own detection capabilities over time.
2Measurement precision
If predefined rules are used for security detection, then the system is easy to operate, but it is prone to false positives and negatives when attackers disguise irregular operations
Solution Approach 1:
The patent replaces simple predefined rule matching with complex machine learning models that can nuancedly distinguish between legitimate user behavior variations and disguised attack patterns. The neural networks analyze multiple dimensions of user behavior data simultaneously, enabling precise detection even when attackers obfuscate their actions within seemingly benign operations.
Solution Approach 2:
The system incorporates feedback mechanisms where detected anomalies and confirmed attacks are fed back into the training data to continuously refine the detection models. This feedback loop enables the system to learn from past detections and improve its precision over time, reducing both false positives and negatives.
3Reliability
If a machine learning model is trained to identify authorized users, then detection of anomalous sessions is improved, but the system complexity and training requirements increase
Solution Approach 1:
The patent implements preliminary training of machine learning models on historical user behavior data before actual detection occurs. The system pre-trains on labeled data representing authorized users and various attack scenarios, enabling the models to make accurate predictions during real-time detection without requiring complex inference during operation.
Solution Approach 2:
The detection system is segmented into distinct functional components: data collection modules, feature extraction units, machine learning model layers, and decision output components. This segmentation allows each component to be optimized independently and simplifies the overall system architecture while maintaining high detection reliability through specialized processing at each stage.
Data Source
AI summary
An anomalous user session detector is disclosed. A sequence of operations in a logon session for an authorized user is gathered. A supervised learning model is trained to identify the authorized user from the sequence of operations. An anomalous session is detected by querying the supervised learning model.