Anomaly Detection via Multi-Source User Behavior Profiling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security analytics systems fail to detect anomalous user network activity across multiple data sources, missing changes in behavior patterns and volume over time, which can indicate malicious or non-malicious intent, due to their reliance on single-dimensional correlation rules and lack of behavior profiling across multiple data sources.
Innovation Solution
A system and method that create a baseline behavior model using Principal Component Analysis (PCA) to capture daily user activity patterns and volumes from multiple data sources, detecting anomalies by comparing current activity to the model and updating it when consistent, with a score normalization scheme to flag deviations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Difficulty of detecting and measuring
If correlation rules are used for threat detection in SIEM systems, then single-dimensional event monitoring is achieved, but multi-source data integration and comprehensive behavior evaluation are lost
Solution Approach 1:
The patent combines multiple data sources (Active Directory logs, firewall logs, endpoint security logs, web proxy logs) into a unified user behavior profile. The system merges heterogeneous log data from different sources to create comprehensive user activity representations, enabling multi-dimensional anomaly detection that correlates events across all sources rather than analyzing them in isolation.
Solution Approach 2:
The system transitions from single-dimensional correlation rules to multi-dimensional behavior profiling by incorporating temporal patterns, event frequencies, and cross-source correlations. The user behavior profile adds dimensions such as historical baseline comparisons, activity timing patterns, and multi-source event sequences, enabling detection of anomalies that span multiple data sources and time periods.
2Speed
If point-in-time correlation rules are applied, then immediate threat indicators are identified, but long-term behavior profiling and pattern recognition are missed
Solution Approach 1:
The system performs preliminary actions by continuously building and updating user behavior profiles during normal operation. Historical behavior patterns are captured and stored in advance, creating a baseline that enables rapid anomaly detection when new events occur. The pre-computed behavior profiles allow the system to immediately compare new events against established patterns without requiring lengthy analysis periods.
Solution Approach 2:
The behavior profiling operates continuously over time, constantly updating user profiles as new events are observed. The system maintains an ongoing record of user behavior across multiple time periods, enabling both immediate threat detection through pattern matching and long-term behavioral analysis. This continuous operation ensures that both speed of detection and depth of behavioral understanding are maintained.
Data Source
AI summary
The present disclosure relates a system, method, and computer program for detecting anomalous user network activity based on multiple data sources. The system extracts user event data for n days from multiple data sources to create a baseline behavior model that reflects the user's daily volume and type of IT events. In creating the model, the system addresses data heterogeneity in multi-source logs by categorizing raw events into meta events. Thus, baseline behavior model captures the user's daily meta-event pattern and volume of IT meta events over n days. The model is created using a dimension reduction technique. The system detects any anomalous pattern and volume changes in a user's IT behavior on day n by comparing user meta-event activity on day n to the baseline behavior model. A score normalization scheme allows identification of a global threshold to flag current anomalous activity in the user population.