Entity Correlation Risk Scoring for Real-Time Insider Threat Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems lack effective methods for real-time anomaly detection and risk scoring in complex network environments, particularly in cloud and non-cloud compute environments, to identify deviations from typical user behavior and potential insider threats.
Innovation Solution
A data platform is implemented to collect and analyze data from compute assets using agents that monitor node activities, creating polygraphs to model user behavior, and perform real-time anomaly detection and risk scoring based on entity correlation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If real-time anomaly detection and risk scoring are implemented using polygraph modeling, then detection accuracy and security monitoring capability are improved, but system complexity and computational resource requirements increase
Solution Approach 1:
The system segments the monitoring task by creating separate polygraph models for different entity types (users, devices, accounts) and their relationships. Each polygraph module independently tracks specific behavioral patterns, allowing the complex anomaly detection system to be divided into manageable, specialized components that can be processed and analyzed separately.
Solution Approach 2:
The patent introduces a temporal dimension to anomaly detection by continuously updating polygraph models with historical behavior data. The system transforms static monitoring into dynamic, time-based analysis by comparing current activities against established temporal patterns, enabling real-time detection through multi-dimensional data processing.
2Reliability
If continuous monitoring of node activities is performed to detect insider threats, then security coverage is improved, but data processing volume and computational load increase
Solution Approach 1:
The system extracts and isolates specific behavioral patterns and anomalies from the vast amount of monitored data. By identifying and separating only the relevant security-critical events from normal operational noise, the polygraph model focuses computational resources on analyzing only the most pertinent activities, reducing overall processing load while maintaining comprehensive security coverage.
Solution Approach 2:
The continuous feedback loop in the polygraph model allows the system to learn from historical data and automatically adjust its monitoring thresholds and detection criteria. This adaptive feedback mechanism refines anomaly detection over time, reducing false positives and computational waste by focusing resources on high-risk patterns that have been identified through iterative learning.
3Speed
If polygraph models are updated in real-time to reflect current user behavior, then detection responsiveness is improved, but data storage requirements and processing overhead increase
Solution Approach 1:
The polygraph model applies local quality by maintaining detailed, high-resolution behavioral profiles for specific entities and relationships only where needed. Rather than uniformly storing all data, the system concentrates storage resources on critical polygraph nodes and edges that represent significant user behaviors and relationships, optimizing the balance between storage volume and detection accuracy.
Data Source
AI summary
Risk scoring based on entity correlation, including: detecting an event associated with a plurality of entities; calculating a plurality of risk scores based on a plurality of correlated pairs of entities from the plurality of entities and historical activity associated with the plurality of entities; calculating, based on the plurality of risk scores, an overall risk score for the event; and controlling access to one or more resources based on the overall risk score for the event.