Collaborative Filtering Anomaly Explainability via User Behavior Vectors
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Collaborative filtering-based anomaly detection systems lack explainability, as latent features do not readily correspond to familiar security rules or provide clear interpretations of user behavior, making it difficult to understand why a cybersecurity anomaly was flagged.
Innovation Solution
Enhancing explainability by deriving user behavior vectors from a trained collaborative filter, computing similarity based on vector distances, and producing human-friendly explanations that describe changes in user behavior similarity, associating anomaly detection results with specific behavior changes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If collaborative filtering-based anomaly detection is used, then anomaly detection accuracy is improved, but explainability of detection results deteriorates
Solution Approach 1:
The patent introduces user behavior vectors as an intermediary between the collaborative filtering anomaly detection system and the security analysts. These vectors serve as a mediator that translates the opaque latent features into a more interpretable form by representing user behavior patterns in a structured vector space, allowing analysts to understand the basis for anomaly detection while preserving the accuracy benefits of collaborative filtering
Solution Approach 2:
The patent transforms the uninterpretable latent features into user behavior vectors by changing the parameter representation. Instead of using the original latent feature space that lacks semantic meaning, the system projects user behaviors into a vector space where similarities can be computed and interpreted, thereby converting the detection results into an explainable format while maintaining detection accuracy
2Reliability
If latent features are used for anomaly detection, then detection capability is improved, but interpretability of user behavior deteriorates
Solution Approach 1:
User behavior vectors act as an intermediary layer between the reliable but opaque latent features and the human analysts. The vectors preserve the detection capability by maintaining the mathematical relationships learned from latent features while providing a structured representation that is easier to interpret and reason about in terms of user behavior patterns
Data Source
Figure 1~3
Figure 4~6
Figure 7
AI summary
Cybersecurity anomaly explainability is enhanced, with particular attention to collaborative filter-based anomaly detection. An enhanced system obtains user behavior vectors derived from a trained collaborative filter, computes a similarity measure of user behavior based on a distance between user behavior vectors and a similarity threshold, and automatically produces an explanation of a detected cybersecurity anomaly. The explanation describes a change in user behavior similarity, in human-friendly terms, such as "User X from Sales is now behaving like a network administrator." Each user behavior vector includes latent features, and corresponds to access attempts or other behavior of a user with respect to a monitored computing system. Users may be sorted according to behavioral similarity. Explanations may associate a collaborative filter anomaly detection result with a change in behavior of an identified user or cluster of users, per specified explanation structures. Explanations may include organizational context information such as roles.