Cybersecurity Peer Identification Using Group Similarity Scores
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity measures lack effective criteria for determining user similarity in behavior analytics, leading to potential false positives and inefficiencies in detecting suspicious activities within computing systems.
Innovation Solution
The development of cybersecurity peer identification (CPI) technology, which uses an identity directory API to obtain security group definitions and compute peerSimilarityScores based on shared security permissions, providing contextual data for behavior analytics, intrusion detection, and resource management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional cybersecurity measures are used without effective user similarity criteria, then the system structure remains simple, but false positives increase and detection accuracy deteriorates
Solution Approach 1:
The patent introduces security group membership information as an intermediary element that mediates between users and the behavior analytics system. By computing peer similarity scores based on shared security group memberships, the system gains an additional dimensional context for comparing user behaviors, which improves detection accuracy without requiring direct complex analysis of user profiles or behaviors
Solution Approach 2:
The system performs preliminary computation of peer similarity scores between users based on security group memberships before conducting behavior analytics. This pre-computed similarity information is stored and reused during anomaly detection, avoiding repeated complex calculations and reducing real-time system complexity while maintaining high detection accuracy
2Reliability
If peer similarity computation based on security group definitions is implemented, then false positives are reduced, but computational overhead increases
Solution Approach 1:
The system pre-computes peer similarity scores using security group membership data before behavior analytics are performed. These pre-computed scores are stored and reused during anomaly detection, avoiding repeated computational overhead while maintaining reliable detection results
Solution Approach 2:
The patent transforms complex user similarity assessment into a simpler parameter-based computation using security group membership counts. By changing the similarity measurement from analyzing entire user profiles to counting shared security group memberships, the system reduces computational overhead while maintaining detection reliability
3Productivity
If comprehensive behavior analytics without peer context are used, then the system operates quickly, but the ability to detect sophisticated attacks deteriorates
Solution Approach 1:
The system pre-computes and stores peer similarity scores based on security group memberships before behavior analytics are executed. During runtime, these pre-computed scores are quickly retrieved and used to contextualize user behaviors, maintaining high analysis speed while improving suspicious activity detection capability
Solution Approach 2:
Peer similarity scores serve as an intermediary contextual layer that bridges individual user behavior analysis and collective security patterns. This intermediary enables sophisticated attack detection by providing peer context without requiring comprehensive analysis of all user behaviors, thus maintaining analysis speed
Data Source
Figure 1~2
Figure 3~6
Figure 7~9
AI summary
Cybersecurity peer identification (CPI) technology obtains security group definitions from an identity directory, computes peerSimilarityScores that represent user similarity in terms of security permissions, and submits contextual cybersecurity peer data to cybersecurity peer-based functionality (CPBF). CPBF code may then perform behavior analytics, resource management, permissions management, or location management. Cyberattacks may then be disrupted or mitigated, and inefficiencies may be avoided or decreased. Having smaller security groups in common gives users higher peerSimilarity Scores than having larger groups in common, as a result of logarithmic, reciprocal, or other score functions. Security group definitions are refreshed and peer scores are updated at regular intervals or on demand by CPI code, to avoid staleness. CPI code may be tuned by varying update intervals, varying cutoffs imposed on the size of security groups deemed suitable for use in computing peerSimilarityScores, or varying other parameters.