Autoencoder Anomaly Attribution for Sign-in Logs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security detection logic for sign-in log data is primarily rule-based and univariate, making it ineffective in detecting complex, multivariate anomalies that could indicate cyber threats.
Innovation Solution
The use of an autoencoder model to encode and reconstruct multivariate session data, allowing for the identification of anomalous sessions and providing reasons for the anomalous classification based on feature element contributions and prediction errors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If rule-based detection logic is used for sign-in log data, then specific known attacks can be detected, but complex multivariate anomalies cannot be effectively detected
Solution Approach 1:
The patent transforms the detection approach by changing from rule-based parameters to statistical parameters. The system collects sign-in log data and computes statistical features (mean, variance, skewness, kurtosis) for multiple dimensions including time of day, day of week, geographic location, and device characteristics. This statistical parameter transformation enables detection of complex multivariate anomalies that rule-based systems cannot detect.
Solution Approach 2:
The patent adds multiple dimensions to the detection space by analyzing sign-in patterns across time (hourly, daily, weekly cycles), geographic locations, devices, and account properties simultaneously. This multivariate dimensional approach moves beyond single-dimension rule-based detection to capture complex attack patterns that manifest across multiple dimensions.
2Reliability
If statistics-based detection is performed on sign-in logs, then sudden spikes in failures can be detected, but the reasons for anomalies cannot be explained
Solution Approach 1:
The patent segments the anomaly detection into distinct analytical components: (1) statistical feature computation for each dimension, (2) anomaly scoring based on deviation from baseline, and (3) attribution analysis identifying which specific dimensions contributed to the anomaly. This segmentation preserves explanatory information by showing which time periods, locations, or device types contributed most to the detected anomaly.
Solution Approach 2:
The system provides feedback by computing anomaly scores that quantify deviation from normal patterns and by identifying the specific dimensions (time, location, device) that contribute to each anomaly. This feedback mechanism explains not just that an anomaly exists, but why it occurred, enabling security analysts to understand the underlying causes.
3Reliability
If multivariate session data is analyzed using autoencoder models, then complex anomalies can be detected with explanatory insights, but the system complexity increases
Solution Approach 1:
The patent replaces complex manual analysis mechanisms with automated machine learning systems. The autoencoder model automatically learns normal sign-in patterns from historical data and identifies anomalies without requiring manual rule configuration. This substitution of automated ML mechanisms for manual analysis reduces operational complexity while improving detection accuracy.
Solution Approach 2:
The autoencoder model performs self-service by automatically adapting to normal sign-in patterns through unsupervised learning. The system continuously learns from incoming data, updating its understanding of normal behavior without human intervention. This self-service capability enables the system to handle complex multivariate patterns without requiring proportional increases in human analytical resources.
Data Source
AI summary
The output of an autoencoder model is used to provide reasons for classifying logged event data as anomalous. Multivariate input feature vectors based on the event data are applied to the autoencoder model to generate corresponding predicted multivariate feature vectors with respective feature elements. Each feature element of each vector corresponds to a respective type of event data (e.g., sign-in failures). A reconstruction loss is determined for each predicted feature vector and used to classify the predicted feature vector as anomalous or not anomalous. Reason(s) for an anomaly classification are determined by selecting one or more feature elements based on a level of percent contribution to the vectors loss and underprediction or overprediction, determined for each feature element of the anomalous predicted feature vector. Each reason is related to the type of event associated with a selected feature element. The reasons may be displayed in a security analytics UI.