Graph-Based Anomaly Detection in Shared Data Repositories
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional shared data repository systems lack mechanisms to detect anomalous file access behavior, making it difficult to identify suspicious patterns that may indicate corporate espionage.
Innovation Solution
A computer-implemented method that creates a graph of file access patterns, identifies communities of users collaborating on files, and determines anomalous collaboration patterns by comparing user access patterns to community norms, allowing for security actions to be taken when suspicious behavior is detected.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional shared data repository systems are used to allow broad file access, then ease of operation and collaboration are improved, but security against anomalous access patterns deteriorates
Solution Approach 1:
The system continuously monitors file access patterns and provides feedback by comparing current access behavior against historical collaboration patterns. When anomalous patterns are detected (such as a user accessing files outside their normal collaboration circles), the system can trigger alerts or security responses, enabling dynamic adjustment of access controls based on real-time behavior analysis
Solution Approach 2:
The patent introduces an intermediary analysis layer between the file repository and users. This layer uses graph-based community detection to identify normal collaboration patterns and acts as a mediator that can detect and respond to anomalous access attempts without disrupting legitimate user operations, thus maintaining ease of operation while enhancing security
2Device complexity
If no monitoring mechanisms are implemented to preserve system simplicity, then device complexity is reduced, but ability to detect anomalous behavior deteriorates
Solution Approach 1:
The system performs self-service by automatically collecting access logs, constructing collaboration graphs, detecting communities, and identifying anomalous patterns without requiring manual configuration or complex external monitoring infrastructure. The anomaly detection process is self-contained within the existing data repository system
Solution Approach 2:
The patent transforms access control monitoring from a binary permitted/denied parameter to a continuous analysis of collaboration pattern parameters. By representing user relationships as graph structures with vertices and edges, the system can measure and compare collaboration intensities, community memberships, and access frequencies to detect anomalies
3Measurement precision
If detailed access monitoring is implemented to improve security detection, then measurement precision of anomalous behavior is improved, but loss of time for data processing increases
Solution Approach 1:
The system segments the monitoring task by dividing users into communities based on their collaboration patterns. Instead of analyzing all user-file interactions uniformly, the system processes data in community segments, comparing each user's access patterns against their specific community's normal behavior. This segmentation reduces the computational complexity and processing time required for anomaly detection
Data Source
AI summary
The disclosed computer-implemented method for detecting anomalous behavior in shared data repositories may include (i) identifying a shared data repository that comprises files, (ii) monitoring access to the files for a predetermined time period in order to determine which files are accessed by each user, (iii) creating a graph of the access to the files, wherein each vertex represents a user and each edge that connects two vertices represents that one or more files were accessed by both users represented by the two vertices, (iv) deriving, from the graph, a set of communities, wherein each community represents a set of users that collaborated on one or more files during the predetermined time period, and (v) determining that a collaboration pattern of a user does not match a collaboration pattern for the user's community observed during the predetermined time period. Various other methods, systems, and computer-readable media are also disclosed.