Cloud User Anomaly Detection with Hierarchical Behavior Models
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques for identifying compromised cloud user accounts often generate false positives, leading to ignored alerts and missed actual anomalous behavior due to misclassification of benign operations as abnormal.
Innovation Solution
Anomalous cloud activities are detected by comparing user behavior with previous behavior and related users, using multivariate anomaly detection models and hierarchical analysis across different levels, and applying filters to reduce false alerts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing techniques identify abnormal user behavior by comparing with previous behavior models, then compromised accounts can be detected, but false positives increase causing actual anomalies to be lost in noise
Solution Approach 1:
The patent segments the anomaly detection process into multiple independent models: a user-specific behavior model, a hierarchical group behavior model (organizing users into groups based on similarities), and an impact model. Each model analyzes different aspects of behavior independently, and their results are combined to reduce false positives while maintaining detection accuracy.
Solution Approach 2:
The patent introduces hierarchical user groups as intermediaries between individual user behavior and overall system anomaly detection. These groups serve as mediators that aggregate behavior patterns from multiple users, providing a contextual reference frame that helps distinguish true anomalies from false positives in individual user behavior.
2Reliability
If multiple false positive alerts are generated, then comprehensive monitoring is achieved, but customers ignore all alerts including actual threats
Solution Approach 1:
The patent applies local quality by providing customized, context-specific explanations for each anomaly alert based on the particular user's behavior pattern, hierarchical group context, and impact assessment. This tailored approach makes each alert meaningful and actionable, reducing alert fatigue while maintaining comprehensive monitoring coverage.
Solution Approach 2:
The patent changes the parameter of alert information from simple anomaly flags to multi-dimensional assessments including anomaly score, confidence level, hierarchical context, and potential impact. This transformation makes alerts more informative and prioritizable, improving customer ability to distinguish true threats from false positives.
3Reliability
If benign new behavior is classified as anomalous, then security sensitivity is improved, but false positive rate increases
Solution Approach 1:
The patent performs preliminary analysis by comparing new behavior against both the user's historical pattern and the hierarchical group's established behavior norms before classifying it as anomalous. This preliminary contextualization allows the system to recognize when new behavior is benign (consistent with group patterns) versus when it represents a true security threat.
Solution Approach 2:
The patent implements feedback mechanisms where anomaly detections are continuously refined based on hierarchical group behavior patterns. When multiple users in a hierarchical group exhibit similar new behavior, the system learns that this pattern is acceptable, reducing false positives while maintaining sensitivity to true anomalies that deviate from established group norms.
Data Source
AI summary
Compromised user accounts are identified by detecting anomalous cloud activities. Cloud activities are determined to be anomalous by comparing the behavior of a particular user with the previous behavior of that user as well as the previous behavior of other, related users. In some configurations, the related users are organized into one or more hierarchies, such as by geographic location or by a logical structure of a cloud service. The behavior of the related users is modeled at different levels in the hierarchy. Anomaly scores from different groups and levels of the hierarchy are compiled and filtered before being used to determine whether to send a security alert. In some configurations, the security alert indicates that the anomalous operation was detected, why the operation was determined to be anomalous, and in some cases, what harm the operation could lead to if the user is in fact compromised.