Behavioral Threat Detection via Client Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current intrusion detection systems face challenges in efficiently processing vast amounts of data to detect malicious activities in computer and network security, becoming impractical as software services are decentralized and data flows increase.
Innovation Solution
A server computer system assigns events from a training corpus to categories and clusters client systems based on event patterns, using a behavior model trained on client-cluster-specific sub-corpora to determine if a target event indicates a security threat, allowing for efficient anomaly detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional intrusion detection systems process vast amounts of data from decentralized software services, then detection coverage increases, but system performance becomes impractical
Solution Approach 1:
The patent segments the detection task by clustering client systems into groups based on behavioral characteristics and processing events at different levels. Instead of processing all events from all clients uniformly, the system divides clients into clusters and applies cluster-specific behavior models, reducing the processing burden while maintaining comprehensive detection coverage.
Solution Approach 2:
The patent applies local quality by creating cluster-specific behavior models that are tailored to the unique event patterns of each client cluster. Rather than using a single generic detection model for all clients, the system generates localized behavior models for each cluster, improving detection accuracy for each group while managing computational resources more efficiently.
2Measurement precision
If the system analyzes all events from all client systems, then detection accuracy improves, but processing time increases
Solution Approach 1:
The patent segments events for analysis by first clustering clients and then processing events within each cluster using cluster-specific behavior models. This segmentation allows the system to focus computational resources on relevant event patterns within each cluster rather than uniformly processing all events from all clients, reducing processing time while maintaining accuracy.
Solution Approach 2:
The patent performs preliminary clustering of client systems and generation of behavior models before actual threat detection. By preorganizing clients into clusters and pre-training cluster-specific behavior models on historical data, the system prepares detection frameworks in advance, enabling faster real-time analysis of new events without reprocessing all historical data.
3Adaptability or versatility
If the system processes data from decentralized software services, then detection scope expands, but system complexity increases
Solution Approach 1:
The patent manages system complexity by segmenting the decentralized client population into manageable clusters with homogeneous behavioral characteristics. This segmentation organizes the complexity into structured groups that can be processed using standardized cluster-specific models, making the system more adaptable to diverse decentralized services while preventing unmanageable complexity growth.
Solution Approach 2:
The patent creates a universal clustering and behavior modeling framework that can be applied across different types of decentralized software services. The same core algorithms and architecture serve multiple service types, allowing the system to expand its detection scope to various decentralized environments without proportionally increasing complexity in the core system architecture.
Data Source
Figure 1
Figure 2
Figure 3-A~3-B
AI summary
In some embodiments, a behavioral computer security system protects clients and networks against threats such as malicious software and intrusion. A set of client profiles is constructed according to a training corpus of events occurring on clients, wherein each client profile represents a subset of protected machines, and each client profile is indicative of a normal or baseline pattern of using the machines assigned to the client respective profile. A client profile may group together machines having a similar event statistic. Following training, events detected on a client are selectively analyzed against a client profile associated with the respective client, to detect anomalous behavior. In some embodiments, individual events are analyzed in the context of other events, using a multi-dimensional event embedding space.