Entity Activity Detection Using Temporal Graph Embeddings
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity systems rely on static rules to detect malicious activity, which require significant manual updates and are ineffective against expert threat actors who evade these rules, failing to identify anomalous or malicious activity involving entities until traditional alerts are triggered.
Innovation Solution
A graph-based approach using Temporal Graph Neural Networks (TGNs) processes event data to generate a score for each entity's atypical activity by analyzing node embeddings over time, identifying deviations from historical behavior patterns, thereby flagging potential malicious activity without relying on static rules.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If static rules are used to detect malicious activity, then detection coverage for known attack patterns is improved, but adaptability to new attack methods deteriorates and manual updates are required
Solution Approach 1:
The system transitions from static rules to dynamic behavior modeling using Temporal Graph Neural Networks. The model continuously learns from historical event data to establish baseline behaviors for entities, automatically adapting to new patterns without manual rule updates. This dynamic approach allows the system to detect novel attack methods by identifying deviations from learned behaviors rather than relying on pre-programmed rules.
Solution Approach 2:
The system changes the detection parameters from fixed rule-based thresholds to continuous behavior vectors generated by the TGN model. Instead of checking against static rule sets, the system monitors changes in behavior patterns over time, using temporal embeddings to detect anomalies. This parameter transformation enables automatic adaptation to evolving threat landscapes.
2Reliability
If rule-based alerting is used, then known malicious patterns are detected, but expert threat actors who evade rules are not identified
Solution Approach 1:
The system replaces the mechanical rule-matching approach with a neural network-based statistical model. Instead of mechanically checking events against predefined rules, the TGN model uses learned temporal patterns and graph relationships to identify anomalies. This substitution enables detection of evasive threats that do not conform to known attack patterns by identifying statistically significant deviations from normal behavior.
Solution Approach 2:
The system performs self-learning by continuously processing historical event data to update its behavioral models automatically. The TGN model extracts patterns from past events and uses these to establish baseline behaviors for each entity, enabling the system to detect novel threats independently without human intervention. This self-service capability allows continuous improvement of detection accuracy.
3Measurement precision
If manual rule creation and updates are performed, then detection accuracy for specific scenarios is improved, but operational complexity and time consumption increase
Solution Approach 1:
The system eliminates manual rule creation and maintenance by implementing self-learning through the TGN model. The model automatically processes historical event data, learns entity-specific behavior patterns, and generates detection criteria dynamically. This removes the operational burden of manual rule updates while maintaining high detection accuracy through continuous automated learning from actual system behavior.
Solution Approach 2:
The system incorporates feedback loops where detected events and outcomes are fed back into the TGN model to refine its behavioral predictions. This feedback mechanism allows the model to continuously improve its detection accuracy by learning from actual system behavior and adjustment outcomes, eliminating the need for manual rule refinements based on operational feedback.
Data Source
AI summary
Timestamped events involving entities occurring over a time period are maintained in a graph where each node represents a respective entity and edges connected to a node represent corresponding timestamped events involving the entity represented by the node. A respective array of values corresponding to the edges is created for each node. A number of embedding vectors is created for each node, each comprising numerical values corresponding to a portion of the respective array of values for the node for a portion of the time period of timestamped events involving the entity represented by the node. Similarity is measured in the numerical values of one of the embedding vectors relative to the numerical values of another one or more of the embedding vectors obtained for the node. An action is taken with regard to the entity represented by the node responsive to the measured similarity.