Graph-Based ML for Automated User Account Security Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods struggle to effectively identify and mitigate user account activities that violate security policies or indicate malicious behavior, as these patterns can be difficult or impossible to detect through human analysis alone.
Innovation Solution
A machine learning architecture using spatial graphs is employed to link user activities over time, constructing a graph data structure that connects user accounts based on transactions and interactions, allowing for the creation of a trained classifier to automate the identification of undesirable behavior.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If human analysis is used to detect user account activities, then operational control is maintained, but detection capability is insufficient for complex malicious patterns
Solution Approach 1:
The patent replaces manual human analysis with an automated machine learning system that processes user account activities. The system uses trained classifiers to automatically detect malicious patterns, substituting the mechanical human analysis process with an automated computational system that can handle complex detection tasks without human intervention.
Solution Approach 2:
The patent introduces a machine learning classifier as an intermediary between raw user account activity data and security decisions. This intermediary processes the data, extracts features, and generates predictions about malicious behavior, bridging the gap between raw data and actionable security insights without requiring direct human analysis.
2Productivity
If automated machine learning classification is implemented, then productivity increases through automated account classification, but system complexity increases
Solution Approach 1:
The patent segments the account classification process into distinct modular components: feature extraction modules that process different aspects of user activities, multiple specialized classifiers for different types of malicious behavior, and a decision aggregation layer. This segmentation allows each component to be independently developed, trained, and optimized, reducing overall system complexity while maintaining high productivity.
Solution Approach 2:
The patent creates a universal machine learning framework that can handle multiple types of security classification tasks through a single system architecture. The same core infrastructure supports classification of various malicious behaviors (fraud, spam, policy violations), making the system multi-functional and reducing the need for separate specialized systems for each threat type.
3Measurement precision
If comprehensive user activity monitoring is performed, then security detection accuracy improves, but computational resource consumption increases
Solution Approach 1:
The patent applies partial monitoring by focusing computational resources on extracting and analyzing only the most relevant features from user activities that are indicative of malicious behavior. Rather than processing all possible activity data equally, the system selectively monitors and analyzes specific features that provide the highest detection value, reducing overall computational consumption while maintaining detection accuracy.
Solution Approach 2:
The patent performs preliminary feature extraction and filtering before the main classification process. By pre-processing the data to extract only the most relevant features and filter out obviously benign activities early in the pipeline, the system reduces the computational burden on subsequent classification stages while preserving detection accuracy for suspicious activities.
Data Source
AI summary
Machine learning techniques are used in combination with graph data structures to perform automated classification of accounts. Graphs may be constructed using a seed node and then expanded outward to second-degree nodes and third-degree nodes that are connected to a seed user account node via direct interaction between the accounts. Characterization information regarding the interaction between accounts can be stored in the graph (e.g., quantity of interactions, types of interactions) as well as other metrics and metadata. A classifier, using random forest or another technique, may be trained using a number of different graphs that can then be used to reach a determination as to whether a user account falls into one particular category or another. These techniques can identify accounts that may be violating terms of service, committing a security violation, and/or performing illegal actions in a way that is not ascertainable from human analysis.