LLM Anomaly Detection for Identity Management Risk Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Identity management systems face challenges in identifying new types of security threats and anomalies, making it difficult to determine why a particular user or event was flagged as a security threat.
Innovation Solution
An identity management system utilizes a large language model (LLM) to predict customary user behaviors, compare actual system events to predicted sequences, determine risk levels, and perform remediation actions based on policy thresholds.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Difficulty of detecting and measuring
If traditional security monitoring methods are used, then system complexity remains low, but the ability to identify new security threats and provide detailed insights is insufficient
Solution Approach 1:
The patent introduces a large language model as an intermediary component between traditional security monitoring systems and the detection of new threats. The LLM processes system events, predicts customary user behaviors, and identifies anomalies that would be difficult to detect using conventional methods, thereby resolving the contradiction by adding an intelligent layer without fundamentally redesigning the entire system architecture.
Solution Approach 2:
The patent replaces traditional mechanical/security-rule-based monitoring mechanisms with an AI-based predictive model. Instead of relying on pre-defined security rules and patterns, the system uses an LLM to learn from historical data, predict normal behavior patterns, and detect deviations, substituting the mechanical approach with an intelligent adaptive system.
2Reliability
If detailed analysis of flagged activities is performed, then security posture improves, but time consumption increases
Solution Approach 1:
The system performs preliminary action by continuously predicting customary user behaviors and comparing them against actual system events in real-time. This proactive approach allows the system to identify and flag potential security incidents before they fully manifest, reducing the time needed for detailed analysis by pre-establishing baseline expectations of normal behavior.
Solution Approach 2:
The patent implements a feedback mechanism where the LLM continuously refines its predictions based on observed system behavior. By comparing actual events against predicted patterns and adjusting its model accordingly, the system improves its detection accuracy over time, reducing false positives and the time required for manual investigation of flagged activities.
3Productivity
If automated remediation actions are implemented, then productivity improves, but risk of incorrect actions increases
Solution Approach 1:
The patent applies dynamics by making the remediation system adaptable and configurable. The automated remediation actions are not rigid but can be adjusted based on the specific context, user roles, and organizational policies. The system dynamically determines which actions to take based on the analyzed anomaly and compares them against predefined policies, allowing flexibility while maintaining reliability through policy-based constraints.
Data Source
AI summary
Methods, systems, devices, and computer-readable media for risk and anomaly detection using one or more large language model (LLMs) are described. An identity management system may use an LLM to generate a predicted next system event or sequence of next system events associated with a user of the identity management system. A detected system event associated with the user may be compared to a predicted next system event of the sequence of predicted next system events. Based on a difference between the detected system event and the predicted next system event, a risk level associated with the detected system event may be determined. Based on determining that the risk level satisfies a threat threshold and based on policy information associated with the identity management system a remediation action may be performed.