Dynamic Table Access Detection via Collaborative Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Corporations face challenges in detecting anomalous access to sensitive data, as existing methods rely on static access lists that require frequent updates and fail to identify insider threats or unauthorized access via legitimate accounts.
Innovation Solution
A system and method using collaborative filtering to calculate the probability of a user accessing a table based on their similarity to other users, determining whether the access is legitimate by analyzing historical access patterns and user relationships, and providing alerts or restrictions as needed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If static access lists are used to control table access, then access control is implemented, but the system cannot detect anomalous access or insider threats and requires frequent manual updates
Solution Approach 1:
The patent transforms static access lists into a dynamic system that automatically adapts to user behavior patterns. The collaborative filtering engine continuously learns from historical access data and updates access probabilities in real-time, eliminating the need for manual list updates while enabling automatic detection of anomalous access patterns that deviate from established user behaviors
Solution Approach 2:
The system implements self-service by automatically detecting anomalous access without human intervention. The collaborative filtering algorithm autonomously analyzes user behavior patterns, calculates access probabilities, and generates alerts for suspicious activities, replacing the need for manual monitoring and updating of access control lists
2Reliability
If collaborative filtering is implemented to detect anomalous access, then the system can dynamically identify insider threats, but computational complexity and data processing requirements increase
Solution Approach 1:
The system performs preliminary action by pre-calculating and storing user similarity metrics and access probability matrices during periods of low load. This allows the collaborative filtering algorithm to quickly evaluate new access requests against pre-computed patterns, reducing real-time computational requirements while maintaining high detection accuracy for insider threats
Solution Approach 2:
The patent introduces an intermediary layer between raw access logs and anomaly detection. The collaborative filtering engine acts as a mediator that processes historical access data to generate user profiles and behavior patterns, which then serve as the basis for detecting anomalies. This intermediary processing layer simplifies the overall computational complexity by organizing data in a structured manner
3Productivity
If access control requires manual updates and monitoring, then simple systems are used, but productivity is reduced due to frequent human intervention
Solution Approach 1:
The system implements self-service by automatically detecting anomalous access without human intervention. The collaborative filtering algorithm autonomously analyzes user behavior patterns, calculates access probabilities, and generates alerts for suspicious activities, replacing the need for manual monitoring and updating of access control lists
Solution Approach 2:
The system implements continuous feedback loops where access decisions and user responses are fed back into the collaborative filtering model. This feedback mechanism allows the system to learn from actual user behavior, refine access probability calculations, and improve anomaly detection accuracy over time, eliminating the need for manual tuning and updates
Data Source
AI summary
A system and method for detecting anomalous access to tables is described. A query for accessing a table from a requesting user is received. A set of users similar to the requesting user is determined. The probability that the requesting user should access the table is calculated. Whether the user should be accessing the table based on the calculated probability is determined.