Endpoint Sensor Agents for Adaptive User Behavior Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing User and Entity Behavior Analytics (UEBA) systems are limited in collecting data from user endpoints outside corporate networks, impacting endpoint performance and failing to effectively detect abnormal user behavior in remote workers.
Innovation Solution
A system and method that optimizes data collection and analysis at endpoints by defining a minimal number of metrics and submission frequency based on historical data and machine learning models, adjusting resource usage dynamically to detect abnormal behavior.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a significant number of metrics are collected from user endpoints to detect abnormal behavior, then detection accuracy is improved, but endpoint performance deteriorates
Solution Approach 1:
The system dynamically adjusts the number and type of metrics collected based on risk assessment. A risk score is calculated for each user based on their behavior patterns, and the metrics collection configuration is adapted accordingly. High-risk users trigger collection of more metrics, while low-risk users have minimal metrics collected, making the system dynamic and adaptive rather than static
Solution Approach 2:
Different metrics are collected for different user groups and contexts. The system applies local quality by tailoring the metrics collection strategy to specific user roles, departments, and risk profiles rather than uniformly collecting all metrics from all users. This allows optimization for each local context
2Speed
If metrics collection frequency is increased to improve detection responsiveness, then detection speed is improved, but resource consumption increases
Solution Approach 1:
The system implements periodic metrics collection with variable intervals based on user risk profiles. Instead of continuous or uniform periodic collection, the system adjusts collection intervals dynamically - high-risk users experience more frequent collection while low-risk users have less frequent collection. This periodic action with adaptive timing resolves the contradiction between responsiveness and resource consumption
3Adaptability or versatility
If comprehensive metrics are collected from all users, then detection coverage is improved, but system complexity increases
Solution Approach 1:
The user base is segmented into different risk groups based on their behavior patterns, roles, and historical data. The system divides users into segments such as high-risk, medium-risk, and low-risk groups, and applies different metrics collection strategies to each segment. This segmentation allows comprehensive coverage for critical users while reducing complexity for lower-priority users
Data Source
AI summary
A system to optimize required resources at an endpoint needed to monitor a user behavior for abnormalities with the endpoint includes a processor processing a plurality of agents running at the endpoint to intercept network traffic metrics, intercept device access metrics, intercept app-specific user-mode metrics, parse intercepted data, and submit the intercepted data to a backend component at a server to collect the intercepted data from the endpoint, predict deviation from a normal profile, in which the backend component assesses available characteristics of a particular endpoint, calculates an endpoint user profile, calculates a degree of variance (DoV) between the user profile and the normal profile, compares the calculated DoV to a predetermined Variance Threshold (VT), and predicts, based on machine learning algorithms, a movement of a trend of the DoV within the VT, creates an adjusted metrics list, and distributes adjusted metrics to a related endpoint.