Device Subpopulation Partitioning for Accurate Anomaly Baselines
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anomaly detection systems face challenges in determining optimal device subpopulations for accurately representing normal behavior, leading to false positives and negatives due to subjective human judgments and the wide variety of device attributes, which complicates effective cyber-threat detection.
Innovation Solution
A method and system for device subpopulation partitioning that recursively partitions device activity data based on deterministic characteristics, using a split density metric to optimize subpopulations and establish baselines for anomaly detection, with fallbacks to mixture modeling when necessary.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If larger subpopulations are selected for anomaly detection, then statistical significance is improved, but the ability to represent a specific device type deteriorates
Solution Approach 1:
The patent segments the device population into multiple subpopulations based on deterministic characteristics (device type, manufacturer, model) and further divides them into partitions using recursive partitioning. This allows the system to select optimal subpopulations that balance statistical significance with specific device type representation, resolving the contradiction between population size and representation accuracy.
Solution Approach 2:
The patent applies local quality by creating device-specific baselines for different subpopulations rather than using a single global baseline. Each subpopulation is analyzed separately to determine its normal behavior patterns, allowing the system to maintain both statistical significance at the population level and representation accuracy at the device type level.
2Reliability
If manual human input is used for subpopulation selection, then subjectivity and bias are reduced, but operational complexity and time consumption increase
Solution Approach 1:
The patent implements self-service by using automated recursive partitioning algorithms that objectively determine subpopulation boundaries based on deterministic characteristics. The system automatically evaluates split density metrics and selects optimal partitions without requiring manual human intervention, thereby maintaining objectivity while reducing operational complexity.
Solution Approach 2:
The patent replaces the mechanical process of manual human judgment with an automated computational system that uses mathematical metrics (split density metric) to objectively determine subpopulation selections. This substitution eliminates human bias while keeping the system manageable through algorithmic automation.
3Measurement precision
If more device attributes are considered for partitioning, then subpopulation accuracy is improved, but processing time and computational resources increase
Solution Approach 1:
The patent applies preliminary action by pre-defining deterministic characteristics (device type, manufacturer, model) as partitioning criteria before anomaly detection begins. This preliminary structuring of data into subpopulations based on stable attributes allows for faster processing during actual anomaly detection, as the partitioning framework is already in place and does not require real-time computation.
Solution Approach 2:
The patent uses parameter changes by dynamically adjusting the recursive partitioning process based on split density metrics. The system automatically determines when to stop partitioning based on measured density thresholds, optimizing the balance between subpopulation accuracy and processing time by avoiding unnecessary further division.
Data Source
AI summary
A system and method for anomaly detection. A method includes recursively partitioning a sample of device activity data including deterministic characteristics of a population of devices over iterations in order to create partitions. Each iteration includes determining a split density metric for a candidate subpopulation created by splitting a portion of the population with respect to a corresponding type of deterministic characteristic. The split density metric for the candidate subpopulation is determined based on a density value of the candidate subpopulation and a coverage value of the corresponding type of deterministic characteristic. The partitions include each candidate subpopulation meeting a split density metric threshold. A baseline for each of the partitions is established based on device activity for devices represented in device activity data of the partition. An anomaly is detected based on behavior of a device and the baseline established for a partition corresponding to the device.