Device Security Detection via User State Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting compromised devices are inadequate as they fail to effectively differentiate between legitimate and malicious activities, especially when users are inactive, leading to missed alerts and false positives.
Innovation Solution
The system employs supervised learning models to generate statistical profiles of device activities during active and inactive user states, comparing current activity data against these profiles to determine anomalies and initiate security alerts when a compromised state is detected.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If current methods are used to detect compromised devices, then device security monitoring is performed, but the ability to differentiate between legitimate and malicious activities is insufficient, leading to missed alerts and false positives
Solution Approach 1:
The patent segments device activity monitoring into distinct user states (active vs. inactive) and creates separate statistical profiles for each state. This segmentation allows the system to evaluate device activities against the appropriate baseline, improving detection accuracy by comparing activities against state-specific norms rather than a generic baseline, thereby reducing false positives and missed alerts.
2Measurement precision
If statistical profiles are generated for both active and inactive user states, then detection accuracy is improved, but system complexity increases
Solution Approach 1:
The patent employs a universal statistical profiling framework that can adapt to different user states through a single multi-functional system. The same core infrastructure generates and compares statistical profiles whether the user is active or inactive, eliminating the need for separate complex systems for each state. This universal approach maintains detection accuracy while minimizing system complexity.
3Measurement precision
If supervised learning models are used to generate statistical profiles, then the distinction between normal and suspicious activities is enhanced, but computational resources and processing time increase
Solution Approach 1:
The patent performs preliminary action by pre-generating statistical profiles for both active and inactive user states before actual security monitoring begins. These baseline profiles are created using supervised learning models in advance, capturing normal device activity patterns for each state. During runtime, the system only needs to compare current activities against these pre-established profiles, significantly reducing processing time while maintaining high differentiation accuracy between normal and suspicious activities.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Controlling device security includes obtaining a set of device activity data indicating current device activity on a device and a set of user activity data indicating a current activity state of one or more legitimate users of the device. It is determined whether the indicated current activity state of the users indicates that a legitimate user is in an active state on the device, or that none of the legitimate users is in an active state on the device. A statistical fit of the indicated current device activity on the device, with the indicated current activity state of the one or more legitimate users, is determined, by a comparison with at least one of the models that are generated via supervised learning. A security alert action may be initiated, based on a result of the determination of the statistical fit indicating a compromised state of the device.