Device Security Detection via User State Segmentation

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current methods for detecting compromised devices are inadequate as they fail to effectively differentiate between legitimate and malicious activities, especially when users are inactive, leading to missed alerts and false positives.

Innovation Solution

The system employs supervised learning models to generate statistical profiles of device activities during active and inactive user states, comparing current activity data against these profiles to determine anomalies and initiate security alerts when a compromised state is detected.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If current methods are used to detect compromised devices, then device security monitoring is performed, but the ability to differentiate between legitimate and malicious activities is insufficient, leading to missed alerts and false positives

Engineering Contradiction:
Improvedetection accuracyVSAvoidalert reliability
Core Design Contradiction:
Measurement precisionVSReliability

Solution Approach 1:

The patent segments device activity monitoring into distinct user states (active vs. inactive) and creates separate statistical profiles for each state. This segmentation allows the system to evaluate device activities against the appropriate baseline, improving detection accuracy by comparing activities against state-specific norms rather than a generic baseline, thereby reducing false positives and missed alerts.

Inventive Principle:
Principle #1Segmentation

2Measurement precision

If statistical profiles are generated for both active and inactive user states, then detection accuracy is improved, but system complexity increases

Engineering Contradiction:
Improvedetection accuracyVSAvoidsystem complexity
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The patent employs a universal statistical profiling framework that can adapt to different user states through a single multi-functional system. The same core infrastructure generates and compares statistical profiles whether the user is active or inactive, eliminating the need for separate complex systems for each state. This universal approach maintains detection accuracy while minimizing system complexity.

Inventive Principle:
Principle #6Universality (Multi-functionality)

3Measurement precision

If supervised learning models are used to generate statistical profiles, then the distinction between normal and suspicious activities is enhanced, but computational resources and processing time increase

Engineering Contradiction:
Improveactivity differentiationVSAvoidprocessing time
Core Design Contradiction:
Measurement precisionVSLoss of time

Solution Approach 1:

The patent performs preliminary action by pre-generating statistical profiles for both active and inactive user states before actual security monitoring begins. These baseline profiles are created using supervised learning models in advance, capturing normal device activity patterns for each state. During runtime, the system only needs to compare current activities against these pre-established profiles, significantly reducing processing time while maintaining high differentiation accuracy between normal and suspicious activities.

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentEP3523743B1Detection of compromised devices via user states
Publication Date: 2021.09.01 MICROSOFT TECHNOLOGY LICENSING LLC
  • EP3523743B1 patent drawingFigure 1
  • EP3523743B1 patent drawingFigure 2
  • EP3523743B1 patent drawingFigure 3

AI summary

Controlling device security includes obtaining a set of device activity data indicating current device activity on a device and a set of user activity data indicating a current activity state of one or more legitimate users of the device. It is determined whether the indicated current activity state of the users indicates that a legitimate user is in an active state on the device, or that none of the legitimate users is in an active state on the device. A statistical fit of the indicated current device activity on the device, with the indicated current activity state of the one or more legitimate users, is determined, by a comparison with at least one of the models that are generated via supervised learning. A security alert action may be initiated, based on a result of the determination of the statistical fit indicating a compromised state of the device.