Database Access Monitoring via Vector Distance Anomaly Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database access monitoring systems face challenges in managing large volumes of login events and effectively identifying risks, particularly in unsupervised settings, leading to high false positive rates and inability to detect malicious activities such as lateral movement and privilege escalation.
Innovation Solution
A system and method utilizing graph-based representations and machine learning techniques, including personalized PageRank algorithms and Kullback-Leibler divergence, to generate vector representations of login events, determine distances between entities, and assign anomaly scores, thereby strengthening existing monitoring tools and reducing false alarms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If access controls and static policies are used to monitor database access, then the monitoring system is simple to implement, but it cannot effectively identify risk associated with login events in unsupervised settings
Solution Approach 1:
The system performs self-learning by automatically analyzing login event data to generate vector representations and determine distances between entities without human intervention. The machine learning model continuously improves its anomaly detection capability by processing new login events, enabling the system to adapt to changing access patterns autonomously
Solution Approach 2:
The system transforms static access control policies into dynamic vector representations that capture contextual relationships between subjects and objects. By converting login events into vector space and calculating distances, the system creates a dynamic risk assessment mechanism that adapts to evolving access patterns rather than relying on fixed rules
2Productivity
If existing monitoring tools are used to manage large volumes of login events, then the system can process data, but it generates high false positive rates and cannot detect malicious activities such as lateral movement and privilege escalation
Solution Approach 1:
The system replaces traditional mechanical rule-based monitoring with a machine learning-based vector representation approach. By transforming login events into vector space and using distance calculations to identify anomalies, the system achieves more precise detection that adapts to complex access patterns and detects sophisticated threats like lateral movement and privilege escalation
Solution Approach 2:
The system adds a vector representation dimension to traditional login event monitoring. By projecting entities into vector space and calculating distances, the system creates an additional analytical dimension that enables detection of subtle anomalies and contextual relationships that traditional flat-file monitoring cannot capture
Data Source
AI summary
Systems and methods for database access monitoring are provided. The system comprises at least one processor and a memory storing instructions which when executed by the at least one processor configure the at least one processor to perform the method. The method comprises receiving login event data, generating a vector representation of a subject entity and a vector representation of an object entity associated with a login event in the login event data, determining a distance between the subject entity and the object entity, and determining an anomaly score for the subject entity and the object entity. The anomaly score based at least in part on the distance between the subject entity and object entity.