Browser Activity Classification for User vs Application Actions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems struggle to accurately distinguish between user-initiated and application-initiated activities in complex network environments, leading to potential security vulnerabilities and inefficiencies in data analytics.
Innovation Solution
Implementing a data platform with agents that collect and analyze data from compute assets, using polygraphs to model user behavior and detect deviations from typical patterns, enabling differentiation between user and application activities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing systems collect and analyze network data to detect security threats, then security monitoring capability is improved, but the ability to accurately distinguish between user-initiated and application-initiated activities deteriorates
Solution Approach 1:
The patent segments network activities into distinct categories (user-initiated vs. application-initiated) by analyzing specific attributes such as source/destination ports, protocols, and behavioral patterns. This segmentation enables accurate distinction between different activity types while maintaining comprehensive security monitoring capabilities.
Solution Approach 2:
The patent introduces an intermediary analysis layer that processes network data through multiple filtering and classification stages. This intermediary layer separates and identifies different activity types before security analysis, enabling both accurate distinction and effective security monitoring simultaneously.
2Reliability
If systems monitor all network activities comprehensively, then security coverage is improved, but data processing complexity and resource consumption increase
Solution Approach 1:
The patent extracts and focuses analysis on specific critical attributes and activity patterns rather than processing all network data uniformly. By extracting only the necessary information (such as port numbers, protocols, and behavioral characteristics), the system maintains comprehensive security coverage while reducing processing complexity.
Solution Approach 2:
The patent applies different monitoring and analysis depths to different types of network activities based on their security relevance. High-security-risk activities receive detailed analysis while routine activities are monitored at a lighter level, optimizing resource utilization while maintaining comprehensive coverage.
3Reliability
If systems treat all activities as potential security risks, then security detection sensitivity is improved, but false positive rates increase
Solution Approach 1:
The patent dynamically adjusts detection sensitivity based on activity context and historical behavior patterns. Rather than using a fixed high-sensitivity threshold, the system adapts its detection parameters based on whether an activity appears to be user-initiated or application-initiated, reducing false positives while maintaining security detection capability.
Solution Approach 2:
The patent implements feedback mechanisms that continuously refine activity classification based on observed patterns and outcomes. This feedback loop allows the system to learn from past detections and adjust its sensitivity thresholds, reducing false positives while maintaining high detection accuracy for actual security threats.
Data Source
AI summary
Distinguishing user-initiated activity from application-initiated activity, including: gathering first information generated by a browser extension of a browser executed on a user device, wherein the first information describes activity associated with the browser; gathering second information generated by a client application executed on the user device, wherein the second information describes activity associated with the user device; and determining whether a user has deviated from normal activity by determining, based on the first information, whether at least a portion of the activity described in the second information comprises user-initiated activity or browser-initiated activity.