Language Model Enrichment for Prioritizing Anomalous Activity Detections
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Organizations face challenges in identifying malicious cybersecurity attacks due to the overwhelming volume of detections and false positives, making it difficult for analysts to prioritize actual threats from false alarms, especially in communications with agents that may involve malicious actors using automated chat bots.
Innovation Solution
A detection and enrichment system uses Bayesian inference and language models to process text data from communications, determining priority risk indicators by modeling the co-occurrence of detections and enrichments, which are predictive of attacks, and triggering automated responses or prioritized manual reviews.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If automated detection systems process all computer network data and behavior data to detect anomalous activity, then detection coverage is improved, but the volume of false positives and actual detections overwhelming analysts increases
Solution Approach 1:
The patent introduces language models as an intermediary layer between automated detection systems and human analysts. These models process and enrich detection data by extracting meaningful context from communications, prioritizing detections based on linguistic analysis, and filtering out benign cases. This intermediary processing reduces the volume of detections requiring human review while maintaining comprehensive detection coverage.
Solution Approach 2:
The system implements self-service capabilities where language models automatically analyze communications associated with detections, extract relevant context, and prioritize cases without human intervention. The models serve themselves by continuously learning from labeled data and improving their ability to distinguish malicious from benign activity, reducing the burden on security analysts.
2Measurement precision
If language models are used to process text data from communications to determine priority risk indicators, then accuracy in identifying actual attacks is improved, but computing resource requirements increase
Solution Approach 1:
The patent applies partial action by using language models selectively only for prioritizing detections rather than analyzing all communications data from scratch. The models focus computational resources on enriching and prioritizing already-detected anomalies, rather than performing comprehensive analysis on all raw data, thus achieving high accuracy with reduced computing overhead.
Solution Approach 2:
The system performs preliminary action by pre-processing and enriching detection data with language model analysis before presenting it to analysts. Communications data is pre-analyzed for contextual meaning, sentiment, and malicious indicators, so that when detections are generated, they are already enriched with relevant linguistic context, improving accuracy without requiring intensive real-time computing during incident response.
3Reliability
If comprehensive enrichment of detections with language model analysis is performed, then false positives are reduced, but processing time and system complexity increase
Solution Approach 1:
The patent segments the enrichment process into distinct modular components: communication data ingestion, language model processing, detection enrichment, and priority scoring. Each component handles a specific aspect of the analysis independently, allowing for targeted optimization and reducing overall system complexity. This modular architecture enables the system to achieve comprehensive enrichment while maintaining manageable complexity through clear separation of concerns.
Data Source
AI summary
A system enriches detections of anomalous computer-related activity with output from a language model. The detection and enrichment system uses Bayesian inference to model the likelihood that a co-occurrence of a detection event and an enriched detection event indicate an actual attack. The detection and enrichment system uses a question answering model, to process text data, such as, but not limited to, transcripts or emails. A language model is trained to detect potential attacks based on labelled training data, such as, but not limited to, transcripts or emails with examples of a type of attack.