Groupware Abnormal Behavior Detection via URI Sequence Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional security methods, such as encryption and blocking external access, are insufficient to prevent attackers from accessing groupware using stolen access information, necessitating a more effective way to detect abnormal user behavior.
Innovation Solution
A method and apparatus that acquire and preprocess Uniform Resource Identifiers (URIs) to generate a primitive URI sequence, calculate log probability values based on transition probabilities, and detect abnormal behavior by comparing these values to a threshold, using a processor and memory to execute commands for URI sequence generation, preprocessing, and abnormal behavior detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional security methods (encryption, blocking external access) are used to protect groupware access information, then the security measure implementation is simple, but the security effectiveness is insufficient to prevent attackers from accessing groupware using stolen access information
Solution Approach 1:
The system performs preliminary actions by collecting and analyzing user behavior data before an attack occurs, building a baseline of normal behavior patterns. This preliminary analysis enables the system to detect abnormal behaviors in real-time without requiring complex real-time intervention mechanisms
Solution Approach 2:
The system introduces an intermediary detection layer that monitors user behavior patterns between the user and the groupware system. This intermediary analysis of URI sequences and behavior metrics enables security detection without directly modifying the core security infrastructure or access control mechanisms
2Measurement precision
If detailed user behavior monitoring is implemented to detect abnormal behavior, then the detection accuracy is improved, but the processing complexity and computational resources increase
Solution Approach 1:
The system extracts only the essential and informative features from user behavior data, specifically focusing on URI sequences and their temporal patterns. By extracting only these critical behavioral indicators rather than analyzing all possible user actions, the system achieves high detection accuracy while maintaining processing efficiency
Solution Approach 2:
The system transforms raw behavior data into standardized parameters such as URI sequences, time intervals, and frequency metrics. This parameter transformation enables consistent and accurate comparison of behavior patterns while simplifying the computational complexity of the analysis process
3Speed
If real-time behavior analysis is performed to detect attacks, then the response time is reduced, but the computational load and processing time increase
Solution Approach 1:
The system performs partial analysis by focusing only on the most critical aspects of user behavior, specifically URI sequence patterns and time interval metrics. This selective analysis enables rapid detection of abnormal behaviors with minimal computational overhead, achieving fast response times without excessive energy consumption
Data Source
AI summary
Disclosed is a method of detecting whether a groupware user's behavior is an abnormal behavior. The method includes acquiring a uniform resource identifier (URI) from the user's behavior, generating a URI sequence from the URI on the basis of a predetermined time interval, preprocessing the URI sequence to generate a primitive URI sequence, calculating a log probability value from the primitive URI sequence, and detecting whether the user's behavior is an abnormal behavior on the basis of the log probability value and a predetermined threshold value.