Insider Threat Detection via Neural Network Activity Prediction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional intrusion detection systems fail to effectively detect malicious insider threats, especially in scenarios where new users join or existing users change roles or departments, as they rely on pre-existing behavior patterns, which are not applicable in these dynamic situations.
Innovation Solution
The implementation of zero-shot learning using graph embeddings to extract user embeddings from LDAP attributes, allowing the system to identify and classify insider threat behaviors without prior training on new user profiles or profiles with changed roles, by transforming nodes into low-dimensional vectors and positioning them in a vector space based on similarity, enabling detection of anomalies in organizational networks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional intrusion detection systems use pre-existing behavior patterns for detection, then detection accuracy for known threats is improved, but the system fails to detect malicious activities by new users or users with changed roles
Solution Approach 1:
The system performs preliminary actions by training the neural network on user profile data and activity patterns before actual intrusion detection occurs. This pre-training enables the system to establish baseline behavior patterns and detection capabilities in advance, allowing it to handle new user profiles and role changes more effectively when they occur.
Solution Approach 2:
The system implements dynamics by continuously adapting to changing user profiles and roles. When a user's role or department changes, the system dynamically updates their profile data and re-trains the neural network to reflect new legitimate behavior patterns, ensuring detection accuracy is maintained despite organizational changes.
2Reliability
If the system collects and processes extensive user profile data and activity data for multiple users, then detection capability for insider threats is improved, but system complexity and data processing requirements increase
Solution Approach 1:
The system replaces complex manual analysis and traditional rule-based detection mechanisms with a neural network-based machine learning system. This substitution automates the processing of extensive user profile data and activity data, reducing the need for manual configuration and simplifying the overall system architecture while improving detection reliability.
Solution Approach 2:
The neural network system performs multiple functions simultaneously: it analyzes user profile data, learns activity patterns, detects anomalies, and adapts to role changes all within a single unified framework. This multi-functionality reduces system complexity by consolidating what would otherwise require multiple separate detection mechanisms.
3Measurement precision
If the system trains on multiple user profiles to predict future activities, then detection of malicious behavior is improved, but training time and computational resources increase
Solution Approach 1:
The system applies partial training by focusing computational resources on training with the most relevant user profiles and activity data. Rather than exhaustively training on all possible user combinations, the system identifies and prioritizes key training samples that provide the most value for detecting insider threats, reducing overall training time while maintaining detection accuracy.
Data Source
AI summary
A method and system for intrusion detection to detect malicious insider threat activities within a network of user profiles. The method includes training a Neural Network on multiple sets of user profile data for multiple user profiles and on multiple sets of activity data of the multiple user profiles of the network, such that the Neural Network is capable of predicting for future dates activities for multiple user profiles. The method includes applying the trained Neural Network on the set of further user profile data of the further user profile, predicting an activity of the further user profile based on the multiple sets of activity data by the trained Neural Network, observing activity of the further user profile, applying the trained Neural Network on the observed activity, and detecting malicious activity for the further user profile by the trained Neural Network, if the observed activity deviates from the predicted activity.