Insider Threat Detection Using RNN Behavior Patterns and Event Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing intrusion detection systems struggle to accurately detect malicious insider threats due to the complexity of handling heterogeneous data types, particularly graph data, and often issue alarms at coarse-grained granularity levels, hindering precise identification of user actions leading to security breaches.
Innovation Solution
An unsupervised machine learning system utilizing a combination of Recurrent Neural Networks (RNN) and Feed-Forward Neural Networks (FFNN) to analyze activity events across multiple interconnected user profiles, enabling detection of malicious activities at an event level by modeling temporal dependencies and leveraging graph embeddings to enhance feature representation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data aggregation is used to reduce noise, then detection robustness is improved, but detection granularity is reduced (e.g., per day instead of per minute)
Solution Approach 1:
The system segments the detection process into two distinct stages: an offline training phase where aggregation occurs to build robust models, and an online detection phase where individual events are evaluated at fine granularity. This segmentation allows each stage to optimize for its specific goal without compromising the other.
Solution Approach 2:
The system performs preliminary data aggregation and pattern learning during an offline training phase before actual intrusion detection. This preliminary action creates pre-computed behavior patterns that enable fine-grained detection without requiring real-time aggregation, thus maintaining both robustness and granularity.
2Measurement precision
If feature engineering is performed to meet performance requirements, then detection accuracy is improved, but system complexity and time consumption increase
Solution Approach 1:
The system employs unsupervised learning algorithms that automatically discover behavior patterns and features from raw data without requiring manual feature engineering. The algorithms self-adapt to each user's behavior patterns, eliminating the need for domain experts to manually design features while maintaining high detection accuracy.
Solution Approach 2:
The system changes the approach from static feature engineering to dynamic parameter adaptation. Behavior patterns are represented as probabilistic models that automatically adjust parameters based on observed user behavior, allowing the system to adapt to changing patterns without manual intervention.
3Ease of manufacture
If existing intrusion detection methods are used, then implementation is simpler, but graph data and heterogeneous features are not supported
Solution Approach 1:
The system implements a universal detection framework that handles multiple data types (numeric, categorical, text, graph) through a unified approach. Graph data is converted to graph embeddings that can be processed alongside other feature types, allowing the system to maintain implementation simplicity while supporting diverse data formats.
Solution Approach 2:
The system introduces graph embeddings as an intermediary representation that bridges graph data and the detection algorithm. This intermediary transformation allows complex graph structures to be processed using standard neural network operations, maintaining ease of implementation while enabling graph data support.
4Adaptability or versatility
If anomaly-based IDS are used to detect new threats, then detection capability is improved, but false positive rate increases
Solution Approach 1:
The system uses dynamic behavior patterns that adapt to each user's normal behavior rather than relying on static anomaly thresholds. By continuously learning what constitutes normal behavior for each user, the system can detect deviations (potential threats) while maintaining low false positive rates through personalized baselines.
Solution Approach 2:
The system changes from fixed anomaly detection thresholds to adaptive probabilistic models. Behavior patterns are represented as probability distributions that naturally account for variability in user behavior, allowing the system to distinguish between benign variations and genuine anomalies, thereby reducing false positives while maintaining new threat detection capability.
Data Source
Figure 1~4
Figure 3
AI summary
The present invention provides a method (100) for intrusion detection to detect malicious insider threat activities within a network (201) of multiple interconnected computerized user profiles (203), comprising: - Determining (103) a behaviour pattern (BP) for each user profile (203) based on multiple activity events (AE), wherein the determination of the behaviour pattern (BP) is executed by at least one trained Recurrent Neural Network (RNN), - Determining (105) normal activity events and abnormal activity events for each for each user profile (203) based on the multiple behaviour patterns (BP), wherein the determination of the normal activity events and the abnormal activity events is executed by a trained Feed-Forward Neural Network (FFNN), - Evaluating (107) whether a recorded activity event (RAE) is a normal activity event or an abnormal activity event based on the behaviour pattern (BP) and the determined normal activity events and abnormal events for that user profile, - Detecting (109) malicious activity for the at least one user profile (203), if the recorded activity event (RAE) is evaluated as an abnormal activity event. The current invention further provides a system (200) configured to execute the method (100).