Network Activity Analysis via Iterative Access Event Labeling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security tools are inadequate in detecting malicious activities due to the evolving strategies employed by malicious entities, leading to overwhelming burdens for human analysts in investigating numerous incidents within computer networks.
Innovation Solution
An analysis system that employs an iterative and interactive technique using active learning, combining feature-based and graph-based analysis to identify and label access event items, thereby prioritizing the analysis and reducing the burden on human analysts while effectively detecting malicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a fixed database of heuristic rules is used to detect malicious activity, then the tool can detect known malicious behavior patterns, but it fails to detect all types of malicious activity due to evolving strategies
Solution Approach 1:
The patent implements a dynamic rule generation system that automatically creates new heuristic rules based on observed network traffic patterns and identified malicious activities. Instead of relying on a static database, the system continuously learns from new data and adapts its detection capabilities, allowing it to keep pace with evolving malicious strategies while maintaining detection accuracy for known threats.
2Reliability
If a human analyst manually investigates incidents of possible malicious behavior, then the tool can detect all types of malicious activity, but the analyst becomes burdened by an overwhelming number of incidents
Solution Approach 1:
The patent implements a self-service detection system where the automated rule-generation tool performs the bulk of malicious activity detection without requiring manual analyst intervention for each incident. The system autonomously analyzes network traffic, generates detection rules, and identifies malicious patterns, reserving human analyst involvement only for complex cases that require expert judgment, thereby dramatically reducing analyst workload while maintaining comprehensive detection capability.
3Reliability
If the analysis system presents all AE items to the user for labeling, then complete analysis coverage is achieved, but the user is overwhelmed by the large number of items
Solution Approach 1:
The patent implements a prioritized presentation approach where the analysis system selectively presents only the most suspicious or high-priority AE items to the user for labeling, rather than displaying all items. The system uses automated scoring and filtering to identify items that require human review, presenting a manageable subset that maintains high analysis coverage while avoiding user overload from examining every single item.
4Reliability
If the system uses a large number of heuristic rules to detect malicious activity, then detection comprehensiveness improves, but the complexity of the detection system increases
Solution Approach 1:
The patent implements a segmented rule management system that organizes heuristic rules into hierarchical categories and groups based on threat types, network layers, and detection priorities. The system divides the complex rule set into manageable modules that can be independently configured, executed, and maintained, reducing overall system complexity while preserving comprehensive detection capability through structured organization of detection logic.
Data Source
AI summary
An analysis system is described for identifying potentially malicious activity within a computer network. It performs this task by interacting with a user to successively remove known instances of non-malicious activity, to eventually reveal potentially malicious activity. The analysis system interacts with the user by inviting the user to apply labels to identified examples of network behavior; upon response by the user, the analysis system supplies new examples of network behavior to the user. In one implementation, the analysis system generates such examples using a combination of feature-based analysis and graph-based analysis. The graph-based analysis relies on analysis of graph structure associated with access events, such as by identifying entropy scores for respective portions of the graph structure.