Contextual Anomaly Detection in Behavioral Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional anomaly detection techniques fail to effectively identify contextual anomalies in behavioral networks, as they either focus on global anomalies or treat context formation and anomaly detection as separate steps, lacking the ability to detect deviations within specific contexts.
Innovation Solution
The method involves label propagation to construct contexts and assign context membership scores by combining behavioral information and contextual side information, allowing for the detection of contextual anomalies by computing anomaly scores based on these scores and side information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional anomaly detection techniques are used to detect global anomalies, then point anomalies can be identified, but contextual anomalies cannot be detected
Solution Approach 1:
The patent segments the network into multiple contexts or communities using label propagation algorithms. Instead of treating the entire network as a single entity for anomaly detection, it divides users into different contextual groups (e.g., social circles, organizational departments) and performs anomaly detection within each segment. This allows the system to identify contextual anomalies that would be invisible in global analysis.
Solution Approach 2:
The patent applies local quality by evaluating anomalies relative to local contextual norms rather than global statistics. Each user's behavior is assessed against the behavior patterns of their specific context members, allowing the same behavior to be normal in one context and anomalous in another. This resolves the contradiction by making detection precision context-dependent.
2Device complexity
If context formation and anomaly detection are treated as separate steps, then the process is simpler, but the detection accuracy for contextual anomalies deteriorates
Solution Approach 1:
The patent merges context formation and anomaly detection into a unified iterative process. Label propagation simultaneously constructs contexts and identifies anomalies in each iteration, rather than first forming contexts and then separately detecting anomalies. This integration ensures that anomaly detection is inherently context-aware, resolving the precision issue while maintaining reasonable complexity through algorithmic efficiency.
Solution Approach 2:
The patent employs continuous label propagation that iteratively refines both context assignments and anomaly scores together. Rather than discrete separate steps, the system continuously updates context memberships and anomaly detections in an integrated loop, allowing contextual information to continuously inform anomaly detection and vice versa, improving precision without proportionally increasing complexity.
3Productivity
If only behavioral information is used for anomaly detection, then the detection process is faster, but contextual side information that could improve detection is ignored
Solution Approach 1:
The patent performs preliminary label propagation to establish contextual memberships before final anomaly scoring. This preliminary action pre-computes the contextual structure that will be used for anomaly detection, allowing the system to efficiently leverage contextual side information during the actual detection phase without sacrificing speed. The preliminary context formation enables faster contextualized detection compared to computing contexts on-the-fly for each anomaly check.
Solution Approach 2:
The patent dynamically balances the use of behavioral information and contextual side information during the label propagation process. The algorithm adaptively weights different information sources based on their relevance to each user and context, allowing the system to maintain high detection speed by relying primarily on behavioral data while incorporating contextual side information where it provides the most value, thus improving precision without proportionally increasing computational cost.
Data Source
AI summary
Various technologies described herein pertain to detecting contextual anomalies in a behavioral network. Label propagation can be performed to construct contexts and assign respective context membership scores to users. Each context can be a respective subset of the users expected to have similar resource usages. The contexts can be constructed and the context membership scores can be assigned by combining behavioral information and contextual side information. The behavioral information can specify respective resource usages by the users within the behavioral network. Moreover, respective contextual anomaly scores for the users can be computed based on the respective context membership scores assigned to the users and the contextual side information. Further, the contextual anomalies can be detected from the contextual anomaly scores.