Entity Risk Assessment with Semantic-Temporal Embeddings
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity tools rely on hard-coded rules or heuristics to process security signals, failing to encode semantic and temporal information effectively, making it difficult to detect malicious activity from individual events.
Innovation Solution
Generate a string comprising security signal names and timestamps, input it to an embedding model to produce a vector representation, and use this vector to train a machine learning model to predict malicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If hard-coded rules or heuristics are used to process security signals, then the system is simple to implement, but it fails to encode semantic and temporal information effectively
Solution Approach 1:
The patent replaces traditional mechanical rule-based processing with neural network-based semantic encoding. The system uses embedding models to transform security signal names into vector representations that capture semantic relationships, and uses temporal encoding to represent time-based patterns, enabling the machine learning model to detect malicious activity with higher accuracy than hard-coded rules
Solution Approach 2:
The patent transforms discrete security signal data into continuous vector representations through embedding layers. By converting categorical signal names into dense numerical vectors and combining them with temporal encodings, the system creates a rich feature space that allows the machine learning model to learn complex patterns and improve detection precision
2Loss of information
If traditional tabular methods are used to represent security signals, then the data structure is simple, but semantic and temporal information is lost
Solution Approach 1:
The patent replaces tabular data representation with neural network-based embedding vectors. The embedding model transforms discrete signal names into continuous vectors that preserve semantic meaning, while temporal encoding maintains time-based relationships. This substitution ensures that neither semantic nor temporal information is lost during processing
Solution Approach 2:
The patent elevates flat tabular data into multi-dimensional vector space through embedding layers. By mapping discrete signal names to high-dimensional continuous vectors and incorporating temporal dimensions, the system creates a rich representation that preserves both semantic and temporal information, enabling more effective machine learning analysis
3Reliability
If individual security events are analyzed in isolation, then the processing is fast, but malicious activity cannot be detected effectively
Solution Approach 1:
The patent merges multiple individual security signals into unified embedding vectors that capture both semantic relationships and temporal patterns. By combining signal name embeddings with temporal encodings and processing them through a machine learning model, the system effectively detects malicious activity patterns while maintaining processing efficiency through vectorized operations
Data Source
AI summary
A computer-implemented method includes receiving a plurality of security signals relating to at least one entity. A string is generated based on the plurality of security signals, the string including a name of each security signal and a timestamp of each security signal. The string is input to a trained embedding model and in response an embedding vector corresponding to the string is received. The embedding vector is input to a trained machine learning model and in response an output is received, the output being indicative of whether the plurality of security signals is representative of malicious activity.