Cybersecurity Event Detection Using User Behavior Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cybersecurity systems are ineffective in detecting cyber security events, particularly those involving gradual and subtle changes in user behavior, such as 'encroaching breaches', which can evade traditional detection methods.
Innovation Solution
A system that generates time series based on user actions, clusters users based on these actions, and generates additional time series on cluster properties like membership, diameter, and centroid, allowing for anomaly detection and execution of prevention instructions when anomalies are found.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional detection methods are used to monitor user behavior, then the system is simple to operate, but it fails to detect gradual and subtle malicious changes in user behavior patterns
Solution Approach 1:
The system segments users into distinct clusters based on their behavior patterns, allowing for granular analysis of individual user anomalies rather than treating all users uniformly. This segmentation enables precise detection of subtle deviations in specific user groups while maintaining manageable system complexity through modular cluster-based processing.
Solution Approach 2:
The system transforms behavioral data into time-series representations, adding a temporal dimension to the analysis. This dimensional transformation allows the detection of gradual changes over time that would be invisible in static analysis, improving detection precision without proportionally increasing system complexity.
2Measurement precision
If the system monitors all user actions in detail to detect anomalies, then detection accuracy improves, but the processing time and computational resources increase
Solution Approach 1:
By dividing users into behavior-based clusters, the system reduces the computational burden of analyzing every user action individually. Anomalies are detected at the cluster level first, then drilled down to individual users only when necessary, significantly reducing processing time while maintaining high detection accuracy for subtle malicious changes.
Solution Approach 2:
The system applies full monitoring intensity only to specific clusters or individual users when anomalies are detected, rather than uniformly monitoring all users at maximum detail. This partial action approach maintains high detection accuracy for suspicious activities while reducing overall processing time and resource consumption for benign user behavior.
Data Source
AI summary
A system for detecting cyber security events can include a processor to generate a first set of a plurality of time series and aggregate statistics based on a plurality of properties corresponding to user actions for each user in a set of users. The processor can also separate the set of users into a plurality of clusters based on the first set of the plurality of time series or aggregate statistics for each user and assign an identifier to each of the plurality of clusters. Additionally, the processor can generate a second set of a plurality of time series based on properties of the plurality of clusters, wherein the properties of a cluster correspond to a membership, a diameter, and a centroid and detect an anomaly based on a new value stored in the second set of the time series. Furthermore, the processor can execute a prevention instruction.