Anomaly Detection via Baseline Profile Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Detecting anomalous activity in online services is challenging due to the large volume of data that needs to be analyzed, often requiring examination of events from multiple machines, which can be time-consuming and inefficient, especially when relying on predefined rules or conditions.
Innovation Solution
Anomaly detection is achieved by comparing the frequency of events in a baseline profile representing normal activity to a recent profile, using a variety of monitored events from accounts within the online service, without the need for individual rules, and generating reports on detected anomalies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If all data from multiple machines is analyzed to detect anomalous activity, then detection accuracy is improved, but processing time and system complexity increase significantly
Solution Approach 1:
The patent segments the analysis by focusing on a specific subset of accounts (operator accounts with privileged access) rather than analyzing all accounts across all machines. This segmentation allows the system to maintain detection accuracy for critical anomalies while reducing the overall processing scope and time required.
Solution Approach 2:
Instead of completely analyzing all data from all machines, the patent applies partial action by selectively monitoring only operator accounts and their activities. This partial monitoring approach provides sufficient detection capability for the most critical anomalies without the time cost of analyzing every account and machine.
2Speed
If predefined rules are used to detect anomalous activity, then detection speed is improved, but adaptability to new anomaly patterns decreases
Solution Approach 1:
The patent employs dynamic baseline profiles that automatically adapt to changing operational patterns of operator accounts. Rather than using static predefined rules, the system continuously learns and updates what constitutes normal behavior, enabling it to detect new anomaly patterns as they emerge while maintaining fast detection speeds.
Solution Approach 2:
The system incorporates feedback mechanisms where detected anomalies and their responses are fed back into the baseline profile generation process. This feedback loop allows the system to learn from past detection experiences and refine its anomaly detection capabilities over time, improving adaptability without sacrificing speed.
3Productivity
If a subset of accounts is monitored instead of all accounts, then processing load is reduced, but detection coverage decreases
Solution Approach 1:
The patent applies local quality by concentrating monitoring resources on operator accounts who have privileged access and can perform critical operations. These accounts represent the most critical subset for anomaly detection, so focusing monitoring efforts here provides high detection coverage for the most important activities while maintaining processing efficiency.
Data Source
AI summary
Anomalous activity is detected using event information that is received from accounts from within an online service. Generally, anomalous activity is detected by comparing a baseline profile that includes past event information for accounts of the online service with a recent profile that includes recent event information for the accounts. Anomalous activity is detected when the recent profile shows that one or more events are occurring more frequently as compared to the occurrence of the event the associated baseline profile. The events that are recorded and used in the anomaly detection may include all or a portion of events that are monitored by the online service. One or more reports may also be automatically generated and provided to one or more users to show activity that may be considered anomalous activity.