Cross-Platform Threat Detection with Independent Abnormality and Risk Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional defense mechanisms for enterprise platforms are platform-specific and inadequate against novel security threats, allowing attackers to exploit gaps between different platforms used by employees.
Innovation Solution
A cross-platform security threat detection system that performs independent abnormality and risk analysis, incorporating machine learning to identify unusual multi-event patterns across various platforms, and generates an abnormal behavior case timeline to detect potential threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional platform-specific defense mechanisms are used, then each platform can be defended individually, but security gaps exist between platforms that attackers can exploit
Solution Approach 1:
The patent combines multiple platform-specific security mechanisms into a unified cross-platform security system. The system aggregates security events from different platforms (email, messaging, cloud infrastructure, SaaS) and analyzes them collectively using machine learning models, thereby eliminating security gaps between platforms while maintaining individual platform defense capabilities.
Solution Approach 2:
The security system is designed with universal functionality to detect threats across multiple different platforms simultaneously. The machine learning models are trained on multi-event patterns that span across various platform types, enabling the system to adapt to and defend against threats on any platform while providing centralized cross-platform protection.
2Ease of manufacture
If platform-specific defense mechanisms are implemented, then deployment is simpler for each individual platform, but the system cannot detect complex cross-platform attack patterns
Solution Approach 1:
The patent introduces a centralized security system that acts as an intermediary between multiple platforms. This intermediary collects and standardizes security events from various platforms, then applies machine learning analysis to detect cross-platform attack patterns, thereby simplifying implementation while enhancing detection capability.
Solution Approach 2:
The system segments the complex task of cross-platform threat detection into manageable components: individual platform event collection, event standardization, feature extraction, and machine learning-based pattern recognition. This segmentation maintains implementation simplicity while enabling sophisticated cross-platform attack detection.
3Productivity
If traditional security analysis methods are used, then processing is faster and simpler, but accuracy in identifying novel threats is insufficient
Solution Approach 1:
The system performs preliminary actions by pre-training machine learning models on extensive multi-event patterns from various platforms before actual threat detection. This preliminary training enables the models to quickly and accurately identify novel threats during operation, balancing processing speed with high detection accuracy.
Solution Approach 2:
The patent transforms security event data into standardized features with specific parameters (time, user, platform, event type) that are optimized for machine learning analysis. This parameter transformation enables both rapid processing and high-precision detection of complex cross-platform attack patterns.
Data Source
AI summary
In various embodiments, a process for security threat detection using independent abnormality analysis and risk analysis includes receiving a plurality of events from a plurality of different digital service platforms. The process includes, for a specific event included in the plurality of events: determining an abnormality score using an abnormality detection machine learning model and determining a risk score using a risk detection machine learning model, wherein the risk score is different from the abnormality score. The process determines whether to perform a secondary analysis of the specific event to detect a security threat based on at least the abnormality score and the risk score.