Audit Log Intrusion Detection via User Group Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Intrusion detection systems face challenges in identifying unknown attacks and managing high false negatives and false positives due to the high cost of collecting and labeling anomalous samples, especially in anomaly-based methods that assume malicious behavior differs significantly from benign activities.
Innovation Solution
A method for detecting intrusions in audit logs by predicting probabilities of user sessions belonging to a user, constructing user groups based on similar activity features, and determining anomaly scores to identify potential intrusions, which reduces false positives by clustering users with similar activity patterns and using a supervised classification model like random forest for efficient prediction.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If anomaly-based methods are used to detect intrusions, then detection capabilities for unknown attacks are improved, but false positives and false negatives rates increase due to mismatch between malicious behavior and anomalous audit records
Solution Approach 1:
The patent introduces user groups as an intermediary concept between individual users and anomaly detection. By clustering users with similar activity patterns into groups and detecting anomalies at the group level rather than individual level, the system reduces false positives caused by natural variations in user behavior while maintaining sensitivity to actual intrusions.
Solution Approach 2:
The patent merges multiple users with similar activity features into unified user groups. This combining approach allows the system to treat variations within a user group as normal behavior while detecting deviations from the group's collective pattern as potential intrusions, thereby reducing false alarms.
2Ease of manufacture
If unsupervised anomaly-based methods are used, then the cost of collecting and labeling anomalous samples is reduced, but detection accuracy decreases due to lack of supervised learning from labeled data
Solution Approach 1:
The system performs self-service by automatically forming user groups based on activity pattern similarity without requiring manual labeling of anomalous samples. The clustering process itself serves as the learning mechanism, enabling the system to adapt to normal behavior patterns while maintaining low operational costs.
3Measurement precision
If user sessions are evaluated individually for anomaly detection, then detection precision for individual intrusions is improved, but false positives increase due to natural variations in user behavior patterns
Solution Approach 1:
The patent merges individual user evaluations into group-level evaluations. By aggregating behavior patterns across users in the same group, the system establishes a more robust baseline of normal behavior that accounts for natural variations, thereby reducing false positives while maintaining detection precision through group-level anomaly scoring.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A Method for detecting intrusions in an audit log comprising records of user sessions including activity features and a user label of a claimed user of the user session, comprises the following steps: Probabilities that a user session belongs to a user are predicted. A probability is predicted for each combination of a user and a user session of the audit log based on the activity features of the user sessions. A user group including users with similar activity features is constructed based on the predicted probabilities. An anomaly score for a user session of the audit log and a claimed user of the user session belonging to the user group is determined based on a probability that the user session belongs to the user group. An intrusion is detected if the anomaly score of the user session and the claimed user exceeds a predetermined threshold.