Unsupervised Logon Anomaly Detection with Feature Contribution Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anomaly detection schemes in computing networks require large amounts of historical data and computing resources, leading to inefficiencies in identifying malicious logon events amidst benign anomalies.
Innovation Solution
The use of an unsupervised machine-learning model to detect anomalies in logon events without historical data, generating labeled data for supervised models to identify features causing anomalies, thereby focusing investigations on potentially malicious events.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional anomaly detection schemes use large amounts of historical data for comparison, then detection accuracy is improved, but computing resources (memory and processing) are excessively consumed
Solution Approach 1:
The patent extracts only the essential features from logon events (e.g., logon time, source IP, destination IP, protocol type) rather than processing complete historical datasets. This selective extraction of critical attributes enables anomaly detection with minimal data storage and processing requirements while maintaining detection effectiveness.
Solution Approach 2:
The system performs preliminary anomaly detection using unsupervised machine learning models on current logon events without requiring historical training data. This preliminary action identifies potential anomalies immediately, and only suspicious cases are then investigated further, eliminating the need to process and compare against large historical datasets for every logon event.
2Reliability
If anomaly detection schemes detect all logon anomalies including benign ones, then comprehensive monitoring is achieved, but investigation time and resources increase significantly
Solution Approach 1:
The system implements feedback through contribution scores that indicate which specific features contributed most to anomaly detection. This feedback mechanism allows investigators to prioritize logon events with high contribution scores (indicating suspicious patterns) and quickly identify the problematic features, reducing investigation time while maintaining comprehensive monitoring capabilities.
Solution Approach 2:
The patent applies local quality by providing detailed feature-level analysis (contribution scores) specifically for anomalous logon events rather than uniform processing of all events. This allows the system to maintain high reliability in detecting all anomalies while investing investigation resources only in events with locally identified suspicious features.
3Use of energy by moving object
If unsupervised machine learning models are used for anomaly detection without historical data, then computing resources are saved, but the ability to distinguish malicious from benign anomalies is reduced
Solution Approach 1:
The system uses contribution scores as an intermediary between unsupervised anomaly detection and malicious intent determination. The contribution score analysis identifies which features drove the anomaly detection, providing investigative guidance that helps distinguish malicious from benign anomalies without requiring supervised training data, thus maintaining low resource consumption while improving identification accuracy.
Data Source
AI summary
A computing system receives unlabeled datasets based on logon event data. Various features are extracted based on the unlabeled datasets. A probability score based on the various features is generated by unsupervised machine-learning models that have been trained using the unlabeled datasets. The probability score indicates whether the logon event data is anomalous. The probability score is used to label the unlabeled datasets to thereby generate labeled datasets. The various features are extracted based on the labeled datasets. A contribution score based on the various features is generated by supervised machine-learning models that have been trained using a subset of the labeled datasets. The contribution score specifies which of the various features are likely to have caused the logon event data to be labeled as anomalous. Output data is generated specifying features that likely caused the logon event data to be labeled as anomalous.