Cloud Session Log Anomaly Detection Using Token-Level LLM Loss
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity solutions for computing clouds struggle to effectively detect nuanced, context-rich anomalies and threats due to their reliance on fixed rules and limited dimensionality, often missing novel patterns and failing to capture complex behavioral sequences.
Innovation Solution
Utilizing a large language model (LLM) to tokenize and analyze session logs, compute loss functions, and identify anomalies based on thresholds, enabling granular anomaly scoring and heatmap generation for precise threat detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional fixed-rule cybersecurity solutions are used, then device complexity is reduced, but anomaly detection precision deteriorates due to inability to capture nuanced patterns
Solution Approach 1:
The patent replaces traditional mechanical rule-based security systems with an LLM-based semantic analysis system. The LLM processes cloud session logs to detect anomalies, substituting fixed-rule mechanical detection with intelligent semantic understanding that captures nuanced patterns and contextual relationships in cloud infrastructure activity.
Solution Approach 2:
The patent changes the detection parameters from fixed rules to dynamic semantic representations. By tokenizing session logs and using LLMs to compute loss functions per token, the system adapts detection parameters based on contextual understanding of each log entry, enabling precise anomaly detection while managing complexity through parameter transformation.
2Measurement precision
If LLM-based token-level analysis is implemented, then anomaly detection precision improves, but computational energy consumption increases
Solution Approach 1:
The patent segments cloud session logs into individual tokens and computes loss functions at the token level. This segmentation allows the LLM to analyze specific portions of logs independently, improving anomaly detection precision while enabling selective computation that can optimize energy usage by focusing on relevant segments rather than processing entire logs uniformly.
Solution Approach 2:
The patent applies partial action by computing loss functions for specific tokens rather than processing all tokens with equal depth. The system identifies tokens with high loss values (indicating anomalies) and focuses computational resources on those segments, reducing overall energy consumption while maintaining high detection precision for critical anomalies.
3Reliability
If comprehensive session log analysis is performed, then detection recall improves, but processing time increases
Solution Approach 1:
The patent enables continuous analysis of session logs by processing tokens sequentially through the LLM. The continuous computation of loss functions across all tokens ensures comprehensive coverage for high recall, while the sequential processing approach allows for optimized throughput that manages processing time efficiently.
Solution Approach 2:
The patent implements skipping by rapidly processing tokens with low loss values (normal activity) while allocating more computational time to tokens with high loss values (potential anomalies). This rushing through of normal segments while carefully examining suspicious segments maintains high detection recall while reducing overall processing time.
Data Source
AI summary
There is provided a method of using a large language model (LLM) for controlling access to a computing cloud, comprising: accessing a log of activity of sessions of the computing cloud, tokenizing the sessions, feeding the tokenized sessions into the LLM, obtaining a loss function per token of the tokenized sessions, computing a session loss for each respective session as an aggregation of the loss function for tokens associated with the respective session, identifying a session including an anomaly associated with a security risk when the session loss of the session is greater than a first threshold, for the identified session, identifying a token(s) having the loss function greater than a second threshold, wherein the identified token(s) denotes the anomaly associated with the security risk, identifying an access event associated with the identified token(s), the access event associated with the security risk, and instructing access control for the access event.