Directed Graph Interface for Entity Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer software struggles to detect malicious activity involving entities complicit in data reuse, as it focuses on individual interactions rather than entity-level patterns, leading to resource-intensive processing and suboptimal detection of complex schemes.
Innovation Solution
A directed graph interface is developed to analyze interaction data, generating a network graph that represents entities and their relationships, allowing for the detection of anomalies by comparing aggregate values to baseline metrics, thereby identifying potentially malicious entities with reduced resource consumption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing computer software analyzes individual interactions to detect malicious activity, then detection coverage is provided, but computational resources are excessively consumed and complex schemes involving complicit entities are not effectively detected
Solution Approach 1:
The patent segments the analysis from individual interaction level to entity level by creating a directed graph where nodes represent entities and edges represent interactions. This segmentation allows the system to analyze patterns across multiple interactions involving the same entities, improving detection of complex schemes while reducing redundant computational processing of individual interactions.
Solution Approach 2:
The patent transitions from analyzing one-dimensional individual interactions to examining multi-dimensional entity-level patterns by constructing a directed graph structure. This dimensional change enables the system to capture relationships and patterns across multiple interactions, entities, and time periods, thereby detecting sophisticated malicious schemes that span multiple entities while optimizing resource utilization.
2Adaptability or versatility
If existing computer software focuses on individual interactions, then simple malicious activities are detected, but complex schemes involving multiple entities and data reuse are missed
Solution Approach 1:
The patent segments malicious activity detection into distinct categories: outbound interactions (potential data theft), inbound interactions (potential credential stuffing), and reciprocal interactions (potential complicit entities). This segmentation enables the system to adapt to various attack patterns while maintaining a structured analysis framework that balances detection versatility with manageable system complexity.
Solution Approach 2:
The directed graph structure serves multiple functions simultaneously: it visualizes entity relationships, identifies malicious patterns, detects complicit entities, and supports both outbound and inbound interaction analysis. This multi-functionality enhances detection versatility while avoiding the need for separate specialized systems for each detection task, thereby controlling overall system complexity.
3Measurement precision
If existing computer software processes all interaction data individually, then comprehensive analysis is achieved, but processing time and resource consumption increase significantly
Solution Approach 1:
The patent merges multiple individual interaction analyses into entity-level pattern recognition by grouping interactions according to their involved entities in a directed graph. This merging allows the system to maintain comprehensive analysis of all interactions while processing them collectively rather than individually, significantly reducing processing time and resource consumption without sacrificing detection completeness.
Solution Approach 2:
The patent performs preliminary actions by pre-processing interaction data into entity-level aggregates and constructing the directed graph structure before conducting malicious activity detection. This preliminary organization of data enables faster query processing and pattern recognition, reducing the time required for actual detection while maintaining comprehensive analysis capabilities.
Data Source
AI summary
A computer system can automatically generate a directed graph interface for use in detecting and mitigating anomalies in entity interactions. For example, the system can receive interaction data describing a set of interactions at two entities. The system can then generate a directed network graph based on the interaction data. To do so, the system can identify pairs of interactions associated with the two entities in the set of interactions. The system can classify the pairs of interactions as outbound and/or inbound interaction pairs. The system can then generate one or more directed links in the directed network graph to represent the outbound and/or inbound interaction pairs. The system can further determine a characteristic of the outbound and/or inbound interaction pairs, automatically detect an anomaly that may be suggestive of malicious activity by one or both entities based on the characteristic, and output an indicator of the detected anomaly.