Monitored Computer Anomaly Detection Through Event Profiling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional anomaly detection methods struggle to keep pace with the dynamic and sophisticated nature of modern cyber threats, leading to high false positive rates and an inability to detect novel or zero-day attacks in complex computer systems.
Innovation Solution
A machine learning model is trained using an activity log from an initial period to generate a profile of a monitored computer system, embedding and encoding events to classify subsequent events as anomalous or normal, utilizing a large language model and trainable embeddings.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional anomaly detection methods (statistical models, threshold-based systems, signature-based detection) are used, then the system is simpler to implement, but the false positive rate increases and novel attacks cannot be detected
Solution Approach 1:
The patent replaces traditional mechanical detection systems (statistical models, threshold-based systems, signature-based detection) with a machine learning-based anomaly detection system. The machine learning model processes event data to classify anomalies, substituting conventional detection mechanisms with intelligent algorithms that can adapt to new attack patterns and reduce false positives while maintaining manageable system complexity through automated learning processes.
2Reliability
If machine learning models are used to detect anomalies, then detection accuracy improves and false positives reduce, but the system complexity increases
Solution Approach 1:
The patent segments the anomaly detection process into distinct components: event data collection, machine learning model processing, anomaly classification, and alert generation. This segmentation allows each component to be optimized independently and simplifies the overall system architecture while maintaining high detection accuracy through specialized processing stages.
Solution Approach 2:
The machine learning model performs self-learning and self-adjustment by processing event data and automatically updating its anomaly detection capabilities. This self-service mechanism reduces the need for manual system configuration and maintenance, effectively managing system complexity while improving detection accuracy over time through automated adaptation to new patterns.
3Adaptability or versatility
If traditional detection methods are used in complex computer systems, then the system architecture remains simpler, but the ability to detect sophisticated and dynamic cyber threats decreases
Solution Approach 1:
The patent implements a dynamic anomaly detection system where the machine learning model continuously adapts to changing cyber threat patterns and system behaviors. The model processes event data in real-time and updates its detection parameters dynamically, enabling it to detect sophisticated and evolving threats while maintaining a manageable architecture through automated adaptation mechanisms.
Data Source
AI summary
A computer device and method are provided for detecting anomalies in a monitored computer system by classifying detected events using a machine learning model trained based on an activity log of events detected during an initial activity period. The machine learning model embeds logged events by generating a vector based on a tokenization of the logged event and a categorization of the logged event by a large language model. Events detected during the initial activity period are used to generate a profile of the monitored computer system. Events detected after the initial activity period are compared to the generated profile by a classifier of the machine learning model to classify each detected event as anomalous or normal.