Connected Component Collaborative Filtering for Intrusion Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cybersecurity solutions for detecting cyberattacks in computer networks, such as unauthorized access to storage accounts, often rely on rigid rule-based systems or supervised machine learning that require labeled data, leading to inefficiencies and false alarms, and fail to detect anomalies effectively.
Innovation Solution
Adaptation of collaborative filtering techniques to model user and network item interactions as a bipartite graph, allowing for the calculation of recommendation scores that indicate intrusion risk, enabling the detection of unauthorized access and potential cyberattacks by processing connected components in parallel.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If rule-based systems or supervised machine learning are used for intrusion detection, then the system can detect cyberattacks, but the system produces false alarms and requires labeled data
Solution Approach 1:
The patent segments the user-item interaction graph into multiple connected components, processing each component separately through collaborative filtering. This segmentation allows the system to focus on localized interaction patterns without being influenced by noise from other components, thereby reducing false alarms while maintaining detection accuracy.
Solution Approach 2:
The patent introduces collaborative filtering as an intermediary mechanism between raw access logs and intrusion detection. Instead of directly applying rule-based systems or supervised learning to labeled data, the collaborative filtering model first processes user-item interactions to generate recommendations, which then serve as the basis for detecting anomalies. This intermediary approach eliminates the need for labeled training data while reducing false positives.
2Reliability
If the entire bipartite graph is processed together, then the system can detect intrusions, but the processing efficiency is reduced
Solution Approach 1:
The patent divides the large bipartite graph into multiple smaller connected components based on graph connectivity. Each connected component is then processed independently through collaborative filtering, which significantly reduces computational complexity and improves processing efficiency while maintaining the ability to detect intrusions within each component.
Solution Approach 2:
The patent applies collaborative filtering selectively to each connected component rather than processing the entire graph uniformly. This partial action approach focuses computational resources on relevant subgraphs, improving overall processing efficiency while still providing comprehensive intrusion detection coverage across all components.
3Measurement precision
If collaborative filtering is applied to the entire user-item matrix, then recommendation scores can be generated, but the computational complexity increases
Solution Approach 1:
The patent segments the user-item interaction matrix into multiple connected components based on graph connectivity. By applying collaborative filtering to each smaller sub-matrix separately rather than the entire large matrix, the computational complexity is significantly reduced while maintaining recommendation score accuracy within each component.
Data Source
AI summary
A system to determine an intrusion risk and take action is described. The system collaboratively filters a combination based on a user access and a network item in a computer network to determine an associated recommendation score. The system determines connected components of a model of the computer network and separately collaboratively filters the connected components to determine the recommendation score as a measure of intrusion risk. An action is taken on the user access based on the intrusion risk.