Entity Risk Assessment Using Timestamped Signal Embeddings
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity tools rely on hard-coded rules and heuristics to process security signals, failing to encode semantic and temporal information effectively, making it difficult to detect malicious activity from individual events.
Innovation Solution
Generate a string comprising security signal names and timestamps, input it to an embedding model to produce a vector representation, and use this vector to train a machine learning model to predict malicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If hard-coded rules and heuristics are used to process security signals, then the system structure is simple and easy to implement, but the system fails to capture semantic and temporal information effectively, reducing detection accuracy
Solution Approach 1:
The patent replaces traditional mechanical rule-based processing systems with embedding models and machine learning models that can capture semantic and temporal information. The embedding model transforms security signal data into vector representations that preserve meaningful relationships, while the machine learning model learns complex patterns from these representations, achieving superior detection accuracy without relying on manual rule configuration.
Solution Approach 2:
The patent changes the parameter representation from discrete rule-based features to continuous embedding vectors. By transforming security signal data into embedding spaces where semantic and temporal relationships are preserved as continuous parameters, the system can capture nuanced patterns that discrete rules cannot detect, significantly improving measurement precision.
2Loss of information
If traditional tabular methods are used to represent security signals, then the data processing is straightforward, but the semantic and temporal information is lost, reducing the ability to detect malicious activity
Solution Approach 1:
The patent replaces manual tabular data processing with automated embedding models that preserve semantic and temporal information. The embedding model automatically transforms structured security signals into rich vector representations that maintain meaningful relationships, eliminating information loss inherent in traditional tabular methods while requiring minimal manual intervention.
Solution Approach 2:
The patent applies preliminary action by pre-training embedding models on large corpora of security data before deployment. This pre-training establishes semantic and temporal relationships in the embedding space beforehand, so that when actual security signals are processed, the model can immediately capture nuanced patterns without requiring complex real-time processing or manual feature engineering.
3Reliability
If individual security events are analyzed in isolation, then the processing is simple and fast, but the system cannot detect malicious activity patterns that require contextual understanding
Solution Approach 1:
The patent merges multiple individual security signals into unified embedding representations that capture their collective meaning. By combining security signals within time windows and transforming them into joint embedding vectors, the system preserves contextual relationships between events, enabling detection of malicious patterns that span multiple individual signals while maintaining computational efficiency.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A computer-implemented method includes receiving a plurality of security signals relating to at least one entity. A string is generated based on the plurality of security signals, the string including a name of each security signal and a timestamp of each security signal. The string is input to a trained embedding model and in response an embedding vector corresponding to the string is received. The embedding vector is input to a trained machine learning model and in response an output is received, the output being indicative of whether the plurality of security signals is representative of malicious activity.