Enterprise Entity Anomaly Detection via Time-Series Deviation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computing systems face challenges in detecting abnormal behavior among enterprise entities, such as compromised devices or security threats, especially in complex and dynamic environments, often resulting in false positives and inefficiencies in security threat detection.
Innovation Solution
A security system utilizing time-series data analysis and predictive models to establish baseline behavior, applying deviation criteria to identify abnormal behavior in enterprise entities, which includes a prediction engine for extracting and processing time-series data and a detection engine for applying deviation criteria to detect anomalies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional security threat detection methods are used, then detection capability is limited, but false positives increase and detection efficiency decreases
Solution Approach 1:
The patent transforms security threat detection from static rule-based parameters to dynamic time-series behavioral parameters. By monitoring entities over multiple time periods and analyzing behavioral patterns (e.g., login times, resource access patterns, data transfer volumes), the system captures the temporal dynamics of malicious activities while filtering out transient anomalies that cause false positives.
Solution Approach 2:
The system performs preliminary baseline establishment by collecting and analyzing historical time-series data before actual threat detection. This preliminary phase creates expected behavior profiles for each entity, enabling the detection phase to compare current behavior against established baselines and reduce false alarms from normal variations.
2Reliability
If comprehensive monitoring of enterprise entities is implemented, then detection coverage improves, but system complexity increases
Solution Approach 1:
The patent segments the enterprise environment into discrete monitorable entities (users, devices, applications, data) and tracks them independently through standardized time-series metrics. This segmentation allows comprehensive coverage without monolithic complexity, as each entity can be monitored and analyzed separately while contributing to overall security posture.
Solution Approach 2:
The system implements a universal time-series data collection framework that applies the same monitoring approach across diverse entity types. By using consistent metrics (frequency, duration, volume, patterns) for different entities, the system achieves comprehensive coverage with a unified, manageable architecture rather than separate complex systems for each entity type.
3Ease of manufacture
If static baseline behavior is used for detection, then implementation is simple, but adaptability to changing malware patterns is poor
Solution Approach 1:
The patent replaces static baseline behavior with dynamic time-series behavioral patterns. Instead of fixed thresholds, the system continuously updates expected behavior based on historical data and detects deviations from evolving patterns. This dynamic approach automatically adapts to changing malware tactics while maintaining implementation feasibility through standardized time-series analysis.
Data Source
AI summary
A machine-readable medium may store instructions executable by a processing resource to access log data of an enterprise and extract time-series data of an enterprise entity from the log data. The time-series data may include measured feature values of a set of selected features over a series of time periods. The instructions may be further executable to train a predictive model specific to the enterprise entity using the time-series data, wherein the predictive model is to generate, for a particular time period, a predicted feature value for each of the selected features; access actual feature values of the enterprise entity for the particular time period; apply first-level deviation criteria to the actual feature value and the predicted feature value of each selected feature to identify deviant features of the enterprise entity; and apply second-level deviation criteria to the identified deviant features to identify the enterprise entity as behaving abnormally.