Hierarchical ML Models for Network Security Breach Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security systems face challenges in efficiently detecting security risks and breaches due to the vast amount of network traffic and noise, making it difficult to identify relevant data and distinguish between normal and malicious activities.
Innovation Solution
The implementation of machine learning methods that learn resource access patterns in networks through unsupervised learning, organizing entity relationships into hierarchical models to generate metrics for identifying abnormalities and triggering alerts for security breaches.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security monitoring systems track every network entity and analyze all network traffic data, then detection coverage is improved, but processing burden and computational resources increase excessively
Solution Approach 1:
The patent segments the network entities and traffic data into hierarchical groups based on similarity in access patterns. Instead of treating every entity individually, the system clusters entities into groups where members share comparable behavior characteristics, reducing the computational scope from individual entity level to group level while maintaining effective detection coverage.
Solution Approach 2:
The system transforms the detection approach by changing parameters from analyzing individual entity attributes to analyzing group-level statistical patterns. By computing metrics such as group entropy, access frequency distributions, and anomaly scores at the group level rather than individual level, the system reduces processing complexity while preserving detection reliability.
2Measurement precision
If the system analyzes massive amounts of network traffic data to identify security risks, then detection accuracy is improved, but noise increases making it difficult to find relevant data
Solution Approach 1:
The patent extracts and focuses on specific discriminatory features from the massive network traffic data that are most indicative of security risks. By identifying and extracting key access pattern characteristics such as temporal patterns, entity relationship structures, and anomaly metrics, the system separates relevant security signals from irrelevant noise while maintaining detection accuracy.
Solution Approach 2:
The system introduces new dimensional perspectives for analyzing network traffic by creating hierarchical groupings and computing multi-dimensional metrics such as group entropy, access frequency distributions, and abnormality scores. This dimensional transformation allows the system to view traffic patterns from aggregated perspectives that reveal security anomalies more clearly while filtering out noise.
3Reliability
If the system identifies novel network connections as potentially risky, then security detection capability is improved, but false alarms increase due to ordinary non-risky behavior being misclassified
Solution Approach 1:
The system performs preliminary classification of network connections by establishing baseline access patterns and hierarchical groupings before evaluating security risks. By pre-computing group memberships, access pattern norms, and expected behavior profiles, the system can quickly evaluate novel connections against established baselines, distinguishing between ordinary variations and genuine security threats, thereby reducing false alarms while maintaining detection capability.
4Measurement precision
If the system tracks every network entity individually to maintain security, then detection precision is improved, but computational resources and time requirements become unsustainable
Solution Approach 1:
The patent merges individual entity tracking into hierarchical group tracking by combining entities with similar access patterns into groups. The system maintains detection precision by monitoring group-level metrics and anomalies while processing data at the group level rather than individual entity level, thereby achieving sustainable processing efficiency without sacrificing detection precision.
Data Source
AI summary
Disclosed is an improved approach for identifying security risks and breaches in a network by applying machine learning methods that learn resource access patterns in the network. Specifically, by observing the access pattern of the network entities (e.g. accounts, services, and hosts) from authorization requests/responses, the model through unsupervised learning, organizes the entity relationships into an ensemble of hierarchical models. The ensemble of hierarchical models can then be leveraged to create a series of metrics that can be used to identify various types of abnormalities in the access of a resource on the network. For instance, by further classifying the access request for a resource using abnormality scores into detection scenarios, the model is able to detect both an abnormality and the type of abnormality and include such information in a corresponding alarm when a security breach happens.