Entity Maliciousness Analysis Using Embedding Sampling

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional cybersecurity techniques struggle to detect novel attacks due to reliance on historical data and known attack patterns, and large language models (LLMs) face token limits when analyzing large datasets for malicious activity detection.

Innovation Solution

Utilize AI-based entity maliciousness analysis through embedding and sampling to select a representative sample of logs, identifying potentially and statistically anomalous data, and trigger an AI model with a prompt that includes these descriptions to determine malicious behavior without exceeding token limits.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If all data is included in a single AI prompt for analysis, then detection accuracy is improved, but the prompt size exceeds token limits

Engineering Contradiction:

Improvedetection accuracyVSAvoidprompt size

Core Design Contradiction:

Measurement precisionVSLength of moving object

Solution Approach 1:

The patent segments the large dataset into a representative sample that is submitted to the AI model, rather than submitting the entire dataset. This segmentation allows the system to work within token limits while maintaining detection effectiveness through careful sample selection that preserves key security-relevant patterns.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent extracts only the necessary subset of data (representative sample) from the full dataset and submits this extracted portion to the AI model. The extraction process uses security-relevant criteria to select samples that capture malicious patterns without requiring the entire dataset, thus resolving the token limit constraint.

Inventive Principle:

Principle #2Taking out (Extraction)

2Reliability

If conventional techniques are used for detection, then existing knowledge is leveraged, but novel attacks cannot be identified

Engineering Contradiction:

Improvedetection reliabilityVSAvoiddetection adaptability to novel attacks

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent uses embeddings to create compressed representations (copies) of the data that capture essential security patterns. These embedding representations are then submitted to the AI model for analysis, allowing the system to leverage both historical knowledge and the ability to detect novel patterns through the AI model's reasoning capabilities on the compressed data representations.

Inventive Principle:

Principle #26Copying

Data Source

PatentUS20260006047A1Ai-based entity maliciousness analysis using embedding and sampling

Publication Date: 2026.01.01 MICROSOFT TECHNOLOGY LICENSING LLC

AI summary

Techniques are described herein that are capable of performing AI-based entity maliciousness analysis using embedding and sampling. A representative sample of data associated with an entity is selected by comparing embeddings that represent the data. A potentially anomalous data point is identified in at least a portion of the data based on a proximity of a node, which corresponds to the potentially anomalous data point, in a tree to a root node of the tree. A statistically anomalous data point is identified in representative sample data points, which define the representative sample, as a result of the statistically anomalous data point indicating an unexpected occurrence of an event. An AI model is triggered to determine whether the entity exhibits malicious behavior by providing an AI prompt, including the representative sample and a description of the potentially anomalous data point and the statistically anomalous data point, to the AI model.