Anomaly Detection Using Bipartite Graphs and Temporal Behavioral Matrices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to effectively detect unauthorized access to network assets, such as credentials theft or misuse of intellectual property, especially in large datasets, leading to potential harm and data breaches.
Innovation Solution
A process utilizing a massively parallel processing system to generate a bipartite graph and temporal behavioral matrix, followed by anomaly detection through principal component analysis (PCA) or other models, to identify deviations in user behavior and flag potential threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional anomaly detection methods are used, then detection capability is limited, but processing speed and scalability to massive datasets deteriorate
Solution Approach 1:
The patent segments the anomaly detection process into distinct phases: (1) generating a bipartite graph from event logs that segments users and assets as separate vertex sets, (2) constructing temporal behavioral matrices that segment time-based patterns, and (3) applying PCA to segment normal from abnormal behavior. This segmentation enables parallel processing of different data aspects, improving both detection precision and processing speed for massive datasets
Solution Approach 2:
The patent transforms the anomaly detection problem from traditional single-dimension analysis to multi-dimensional analysis by: (1) creating bipartite graphs that add the dimension of user-asset relationships, (2) incorporating temporal dimensions through time-series behavioral matrices, and (3) applying PCA to project high-dimensional behavior data into lower-dimensional anomaly scores. This dimensional transformation enables comprehensive detection across multiple aspects simultaneously
2Measurement precision
If comprehensive behavior analysis is performed, then detection accuracy improves, but computational complexity increases
Solution Approach 1:
The patent applies preliminary action by pre-computing and storing temporal behavioral matrices that capture historical user behavior patterns across different time periods. These pre-computed matrices serve as the foundation for anomaly detection, eliminating the need to re-analyze raw event logs during detection operations. This preliminary computation separates the complex data processing from the detection phase, reducing real-time computational complexity while maintaining high detection accuracy
Solution Approach 2:
The patent replaces traditional mechanical anomaly detection methods with Principal Component Analysis (PCA), a mathematical transformation approach. Instead of using rule-based or threshold-based mechanical detection systems, PCA transforms the complex multi-dimensional behavioral data into orthogonal components, where the first few principal components capture the majority of variance. This substitution reduces computational complexity by focusing analysis on the most significant behavioral patterns rather than processing all dimensions equally
Data Source
AI summary
A bipartite graph is generated which includes one or more source vertices and one or more destination vertices. For a given source vertex, a temporal behavioral matrix is generated using the bipartite graph where a first dimension of the temporal behavioral matrix is associated with time and a second dimension of the temporal behavioral matrix is associated with at least some of the one or more destination vertices. For the given source vertex, a model is generated using at least some portion of the temporal behavioral matrix. Anomaly detection is performed on at least part of the temporal behavioral matrix using the model.