Unauthorized Access Detection Using Dynamic Activity Embeddings
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing machine-learning models for detecting unauthorized access in online computing environments face challenges due to obsolete training data, limited ability to handle categorical data, and the computational intensity of frequent re-training, leading to inaccurate activity evaluation.
Innovation Solution
A system that converts categorical values into numerical representations using conversion factors based on historical data, generates embedding vectors, and applies a machine-learning model to predict unauthorized access, updating these vectors with new data without full re-training.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a contemporary machine-learning model is trained to evaluate activity within an online computing environment, then the model can detect unauthorized access patterns, but the model becomes obsolete as techniques for unauthorized activity evolve, requiring frequent re-training
Solution Approach 1:
The patent implements dynamic conversion factors that are continuously updated based on recent online activities without requiring full model re-training. The system adapts to evolving unauthorized access techniques by incorporating temporal dynamics through recency-weighted conversion factors, allowing the model to maintain detection accuracy while avoiding the time loss associated with frequent complete re-training cycles.
Solution Approach 2:
The system performs preliminary updates to conversion factors using recent activity data before unauthorized access patterns fully evolve. By continuously incorporating recency information into conversion factors, the model proactively adapts to new threats rather than waiting for complete obsolescence, reducing the time gap between threat emergence and detection capability.
2Ease of operation
If categorical data is represented using arbitrary values in a contemporary model, then the model can process the data, but the arbitrary values fail to represent information related to the categorical data, reducing evaluation accuracy
Solution Approach 1:
The patent transforms categorical data representation from arbitrary static values to dynamic conversion factors that change based on recency and frequency of occurrence. Instead of using fixed arbitrary identifiers, the system computes conversion factors that reflect the temporal and statistical characteristics of categorical values, thereby preserving information content while maintaining ease of numerical processing.
Solution Approach 2:
The system introduces conversion factors as an intermediary layer between categorical data and the machine-learning model. These conversion factors serve as mediators that translate categorical information into numerical form while preserving the underlying information content through recency-weighted computations, rather than using direct arbitrary encoding.
3Reliability
If a contemporary model is frequently re-trained based on rapidly changing security data, then the model maintains up-to-date detection capabilities, but the re-training process is computationally intensive
Solution Approach 1:
Instead of performing complete model re-training, the system applies partial updates to conversion factors using only the necessary recent activity data. This partial action approach updates only the specific components (conversion factors) that need adjustment based on recency information, rather than re-training the entire model, thereby maintaining detection accuracy while significantly reducing computational overhead.
Solution Approach 2:
The system creates updated conversion factors as copies or transformations of historical data weighted by recency, rather than re-training the entire model from scratch. This copying approach allows the system to incorporate new information efficiently by generating updated conversion factors based on recent activities, reducing the computational energy required compared to full re-training.
4Productivity
If a machine-learning model uses only numeric data for activity evaluation, then the model can process data efficiently, but the model cannot accurately interpret categorical data associated with activities
Solution Approach 1:
The patent changes the parameter representation of categorical data from arbitrary numeric codes to recency-weighted conversion factors. This parameter transformation allows the system to maintain numerical processing efficiency while improving categorical data interpretation, as the conversion factors encode meaningful information about the frequency and recency of categorical value occurrences.
Solution Approach 2:
The system uses conversion factors as an intermediary mechanism that bridges categorical and numerical data domains. These intermediaries enable efficient numerical processing while preserving categorical information content through recency-based computations, allowing the model to handle both types of data effectively.
Data Source
AI summary
An online security analysis system determines a categorical value in an online activity and also determines conversion factors that are associated with the categorical value. Based on the conversion factors, the online security analysis system identifies at least one aggregated value for a numerical feature that is associated with previous online activities for the categorical value. In addition, the online security analysis system generates an embedding vector that describes the aggregated value associated with the categorical value. The embedding vector is provided to an online activity analysis model that is trained to generate prediction data for the online activity, based on the aggregated values associated with the categorical value. The prediction data is transmitted to an online system for use in controlling access of a client device to a function of the online system.