Hierarchical Device Grouping for SaaS Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Anomaly-based detection methods in SaaS platforms face high false-positive rates, particularly in multi-tenant environments due to network patterns being highly reliant on tenants' service patterns, making it difficult to effectively detect network intrusions and user misuse.
Innovation Solution
Implementing a hierarchical grouping of devices using machine learning algorithms based on communication behavior parameters such as destination IP, protocol, data usage, and traffic ratios, combined with feature engineering techniques to segment devices and configure anomaly detection within specific groups.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If anomaly-based detection is used in multi-tenant SaaS environments, then network intrusions and user misuse can be detected, but false-positive rates increase due to network patterns being highly reliant on tenants' service patterns
Solution Approach 1:
The patent segments devices into hierarchical groups (e.g., by organization, department, device type) and applies anomaly detection at multiple levels. This segmentation allows the system to learn normal behavior patterns specific to each group, reducing false positives by contextualizing network traffic within appropriate organizational units rather than analyzing all devices uniformly.
Solution Approach 2:
The patent implements local quality by creating device profiles and group-specific baseline behavior patterns. Each group has its own learned normal behavior characteristics, allowing the system to distinguish between legitimate variations in different tenant environments and actual anomalies, thereby reducing false positives while maintaining detection accuracy.
2Measurement precision
If devices are grouped based on multiple parameters including communication behavior, then detection accuracy improves, but system complexity increases
Solution Approach 1:
The patent divides the complex grouping task into hierarchical levels (e.g., organization level, department level, device type level), where each level handles specific parameters relevant to that level. This segmentation of the grouping process makes the system more manageable and computationally efficient while maintaining high precision through multi-level analysis.
Solution Approach 2:
The patent performs preliminary grouping actions to create device profiles and establish baseline behavior patterns before actual anomaly detection. By pre-computing these group-specific baselines using historical data, the system reduces real-time computational complexity while maintaining high detection precision through the use of pre-learned patterns.
Data Source
AI summary
In one or more embodiments, computer-implemented systems, methods and computer-program products for hierarchical grouping of devices, detecting network intrusions and/or user misuse in a SaaS platform by using grouping of devices, and detecting network intrusions and/or user misuse in a Software as a Service (SaaS) platform by applying feature engineering technique to derived device groups are disclosed.