Dynamic Session Aggregation via Time Series Slope Ratios
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional methods for grouping cloud activity logs into applicative sessions fail to capture variations in timing and number of actions, leading to incomplete detection of similar sessions in complex cloud environments.
Innovation Solution
The system employs time series analysis to determine optimal session duration by calculating slope ratios from break intervals in session logs, defining new sessions based on cumulative probability and median break duration, and using machine learning for session grouping and risk assessment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional methods (constant timeframes, session ID's, or number of logs) are used for grouping cloud activity logs, then the process is simple and fast, but the detection precision of similar applicative sessions deteriorates
Solution Approach 1:
The patent applies dynamics by transitioning from static session grouping criteria (constant timeframes, fixed session IDs) to dynamic criteria that adapt to actual user behavior patterns. The system calculates statistical parameters (mean, standard deviation, variance) from log sequences and uses these to dynamically determine session boundaries, allowing the grouping method to adapt to varying timing patterns and user behaviors in cloud environments.
Solution Approach 2:
The patent changes the parameters used for session grouping from fixed constants to statistically derived values. By calculating mean break intervals, standard deviations, and variances from actual log data, the system adjusts grouping parameters based on observed patterns. This allows the system to capture variations in timing and number of actions that traditional fixed parameters cannot detect.
2Measurement precision
If machine learning models are trained using conventional approaches (large training datasets, long training cycles), then the detection accuracy improves, but the training time and computational cost increase significantly
Solution Approach 1:
The patent applies preliminary action by pre-processing and organizing log data into structured sequences before training. The system organizes logs into applicative sessions using the dynamic statistical methods described above, creating pre-structured training data that reduces the complexity and time required for actual model training. This preliminary organization of data enables more efficient training cycles.
Solution Approach 2:
The patent substitutes conventional mechanical training approaches (requiring large datasets and long training cycles) with a more efficient statistical analysis approach. By using statistical parameters (mean, standard deviation, variance) to characterize user behavior patterns, the system reduces the computational burden and training time while maintaining or improving detection accuracy for suspicious behaviors.
3Adaptability or versatility
If the network perimeter is extended to the Internet to support mobile users and cloud applications, then the accessibility and versatility improve, but the security risk and complexity increase
Solution Approach 1:
The patent applies feedback by continuously monitoring and analyzing user behavior patterns through log sequences. The system uses statistical analysis to detect anomalies and suspicious activities in real-time, providing feedback that enables dynamic security responses. This feedback mechanism allows the system to adapt to the extended perimeter environment while maintaining security through continuous behavioral analysis.
Data Source
AI summary
Systems and methods for dynamic session aggregation detection include receiving session logs for one of a plurality of machines operating in a cloud-based system; determining a plurality of time intervals between activities based on the session logs; determining a probability of a new log to be received after each time interval of the plurality of time intervals; calculating a slope from a shortest break interval and a slope to a longest break interval for each log of the session logs; calculating a slope ratio for each log of the session logs; and determining an optimal maximum session duration based on the slope ratios. The steps further include defining a new applicative session each time the machine experiences a break larger than the optimal maximum session duration.