Collaborative Filtering for Cloud Storage Intrusion Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cybersecurity solutions fail to efficiently detect unauthorized access to storage accounts, particularly in cloud storage, as they often rely on rigid rules or supervised machine learning models that require labeled data, leading to false alarms and missing detection of malware insertion, backdoor attacks, and other forms of unauthorized access.
Innovation Solution
Adaptation of collaborative filtering techniques from recommendation systems to detect intrusion risk by calculating recommendation scores based on accessor IDs and storage item IDs, using matrix factorization and other methods to identify anomalies in storage access patterns, thereby preventing or alerting on potential security threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If rigid rules or supervised machine learning models are used for intrusion detection, then detection coverage is improved, but false alarm rate increases and detection accuracy deteriorates in sparse data environments
Solution Approach 1:
The patent replaces traditional mechanical intrusion detection methods (rigid rules and supervised machine learning) with a collaborative filtering approach borrowed from recommendation systems. This substitution enables the system to detect intrusions by identifying anomalies in access patterns without requiring labeled training data, thereby reducing false alarms while maintaining detection accuracy in sparse data environments.
Solution Approach 2:
The patent changes the fundamental parameters of intrusion detection by shifting from rule-based thresholds and supervised learning metrics to collaborative filtering recommendation scores. This parameter transformation allows the system to evaluate access requests based on pattern similarity and anomaly detection rather than fixed rules, improving reliability while reducing false positives.
2Reliability
If supervised machine learning models are used, then detection capability is improved, but data requirements increase and system complexity worsens
Solution Approach 1:
The patent substitutes supervised machine learning models with collaborative filtering techniques that do not require labeled historical data for training. By borrowing methods from recommendation systems, the approach can detect intrusions using only access pattern information, eliminating the need for extensive labeled datasets while maintaining detection capability.
Solution Approach 2:
The patent copies collaborative filtering methods from recommendation systems and adapts them for intrusion detection. This copying allows the system to leverage established techniques that work effectively with sparse, unlabeled data, avoiding the need to develop new supervised learning models from scratch and reducing data requirements significantly.
3Productivity
If collaborative filtering is adapted from recommendation systems, then detection efficiency in sparse data environments is improved, but system complexity increases
Solution Approach 1:
The patent applies collaborative filtering techniques originally designed for recommendation systems to the domain of intrusion detection. This universal application allows the same mathematical framework to serve multiple purposes: generating recommendation scores for access patterns, identifying anomalies, and detecting intrusions without requiring domain-specific customization, thereby improving efficiency while managing complexity.
Solution Approach 2:
The patent introduces recommendation scores as an intermediary metric that bridges access pattern analysis and intrusion detection. Instead of directly classifying accesses as legitimate or malicious, the system uses collaborative filtering to generate scores that indicate anomaly levels, providing a nuanced intermediate representation that simplifies the detection process and improves efficiency.
Data Source
Figure 1~3
Figure 4~5
Figure 6~7
AI summary
Described technologies enhance cybersecurity by leveraging collaborative filtering tools and techniques for security use by scoring attempts to access items in digital storage. Examples provided illustrate usage of accessor IDs and storage item IDs to compute recommendation scores which then operate as inverse measures of intrusion risk. Actions taken in response to recommendation scores that fall below a specified threshold may include preventing or terminating access, or alerting an administrator, for instance. A requested access may be allowed when the computed recommendation score is above a specified threshold, which indicates an acceptably low risk that the access is an unauthorized intrusion. Described cybersecurity technologies may be used by, or incorporated within, cloud services, cloud infrastructure, or virtual machines. Described cybersecurity technologies may also be used outside a cloud, e.g., on individual servers or on server clusters or on storage area networks that are not necessarily part of a cloud.