Cloud Security Risk Scoring Using Weighted Behavior Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional approaches to determining security risks in cloud-based systems rely on transaction counts, which fail to accurately identify users or groups posing the highest risk, as they may have lower negative event counts but still pose a significant threat.
Innovation Solution
A method that analyzes log data to calculate a weighted risk score based on pre-infection, post-infection, and suspicious behavior, using Structured Query Language (SQL) queries for aggregation, and adjusts security policies and monitoring accordingly.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional transaction-based approaches are used to identify high-risk users, then users with high negative event counts are identified, but users with lower negative event counts who pose greater risk are missed
Solution Approach 1:
The patent changes the parameter basis for risk assessment from simple transaction counts to a multi-dimensional risk score that incorporates behavior type, severity, recency, and user context. This transforms the measurement from a single numeric count to a composite score with multiple weighting factors, thereby improving measurement precision while accepting increased complexity.
Solution Approach 2:
The patent segments the risk assessment into multiple independent components: behavior type classification (pre-infection, post-infection, suspicious), severity levels, recency factors, and user context. Each segment is evaluated separately and then aggregated into a comprehensive risk score, allowing for more precise identification of high-risk users.
2Productivity
If transaction-based counting is used to assess security risks, then the assessment process is simple and fast, but it fails to accurately identify the true highest-risk users
Solution Approach 1:
The patent performs preliminary actions by pre-defining risk weights for different behavior types, severity levels, and recency factors. These pre-calculated weights are stored and applied during risk assessment, allowing the system to quickly compute accurate risk scores without performing complex real-time analysis, thus maintaining productivity while improving precision.
Solution Approach 2:
The patent implements feedback mechanisms where risk scores are continuously updated as new events occur, and the system learns from patterns in the data. This allows the risk assessment to become more accurate over time while maintaining efficient processing through cached results and incremental updates.
3Measurement precision
If a comprehensive weighted risk score system is implemented, then accurate identification of high-risk users is achieved, but the system complexity and computational requirements increase
Solution Approach 1:
The patent divides the complex risk scoring system into manageable segments: behavior type classification, severity assessment, recency calculation, and context evaluation. Each segment is handled by dedicated computational modules that can be independently optimized and maintained, reducing overall system complexity while maintaining comprehensive assessment accuracy.
4Measurement precision
If multiple levels of aggregation and weighted formulas are used to calculate risk scores, then more accurate risk determination is achieved, but the computational time and processing requirements increase
Solution Approach 1:
The patent performs preliminary calculations of risk weights and factors in advance, storing them in cached structures. During actual risk assessment, the system retrieves pre-computed values and applies simple aggregation formulas, dramatically reducing computational time while maintaining precise risk score calculation through the use of pre-analyzed behavioral patterns and historical data.
Data Source
AI summary
Systems and method implemented through a distributed security system for determining and addressing risk of users, groups of users, locations, and/or companies include obtaining log data from the distributed security system; analyzing the log data to obtain a risk score for an entity associated with the distributed security system, wherein the entity comprises one of a user, a group of users, a location, and a company, and wherein the risk score is a weighted combination of pre-infection behavior, post-infection behavior, and suspicious behavior; performing one or more remedial actions for the entity; and subsequently obtaining updated log data and analyzing the updated log data to obtain an updated risk score to determine efficacy of the one or more remedial actions.