Anomaly Detection via Compound Behavioral Deviation Matrices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anomaly detection methods based on single-day individual-user behaviors often generate false positives due to low, long-lasting cyber threats and fail to account for group behavioral correlations, leading to overwhelmed security analysts with unnecessary investigation workloads.
Innovation Solution
The proposed system uses compound behavioral deviation matrices that incorporate both individual-user and group behaviors across multiple time-frames, employing deep fully-connected autoencoders to calculate anomaly scores and produce an ordered list of users requiring further investigation, thereby reducing false positives by considering long-term and group behavioral signals.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If anomaly detection is based on single-day individual-user behaviors, then the detection method is simple and fast, but it generates overwhelming false positives and misses low-signal long-lasting threats
Solution Approach 1:
The patent segments the detection problem into multiple dimensions: individual-user behavior analysis, group behavior analysis, and multi-timeframe analysis (single-day, weekly, monthly patterns). By dividing the complex detection task into these manageable segments, the system achieves high detection accuracy without overwhelming complexity, as each segment can be processed independently and then integrated.
Solution Approach 2:
The patent adds temporal dimensions by analyzing behaviors across multiple timeframes (daily, weekly, monthly patterns) and dimensional expansion by incorporating group behavior correlations alongside individual user behaviors. This multi-dimensional approach transforms the detection from simple single-day analysis to a comprehensive multi-faceted analysis, improving reliability while managing complexity through structured dimensional expansion.
2Reliability
If anomaly detection focuses on individual-user behavior only, then the analysis is straightforward, but it fails to account for common environmental changes affecting multiple users
Solution Approach 1:
The patent merges individual-user behavior analysis with group behavior analysis. By combining these two perspectives, the system can distinguish between individual anomalies and common environmental changes affecting multiple users. The group behavior component captures shared patterns and environmental factors, while the individual component identifies unique deviations, together reducing false positives without excessive complexity.
3Productivity
If anomaly detection outputs only anomaly labels, then the classification is simple, but security analysts are overwhelmed by heavy investigation workload
Solution Approach 1:
The patent introduces an intermediary component that generates prioritized anomaly explanations between the raw detection results and the security analysts. This intermediary layer provides structured explanations and prioritization, translating complex multi-dimensional analysis results into actionable insights that reduce analyst workload while maintaining simple output interfaces. The explanations serve as a mediator that bridges the gap between complex detection and simple interpretation.
Data Source
AI summary
Autoencoder-based anomaly detection methods have been used in identifying anomalous users from large-scale enterprise logs with the assumption that adversarial activities do not follow past habitual patterns. Most existing approaches typically build models by reconstructing single-day and individual-user behaviors. However, without capturing long-term signals and group-correlation signals, the models cannot identify low-signal yet long-lasting threats, and will incorrectly report many normal users as anomalies on busy days, which, in turn, leads to a high false positive rate. A method is provided based on compound behavior, which takes into consideration long-term patterns and group behaviors. The provided method leverages a novel behavior representation and an ensemble of deep autoencoders and produces an ordered investigation list.