Network Anomaly Detection via Behavioral Cohort Profiling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security systems struggle to effectively detect and attribute anomalous network activity, especially after initial authentication, as they lack real-world identifiers and often generate false positives, making it difficult to identify malicious actors or groups.
Innovation Solution
A computer system and method for anomaly detection and profiling that analyzes network activity logs to identify anomalous behavior, attributes it to known malicious actors or groups using machine learning models, and generates alerts or takes preventative measures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional authentication methods (username and password) are used to prevent unauthorized access, then basic access control is achieved, but the system cannot detect anomalous activity by authenticated users and lacks real-world identifiers for attribution
Solution Approach 1:
The patent introduces an intermediary profiling system that bridges the gap between authenticated user activity and real-world identification. The system creates behavioral profiles that serve as intermediaries, linking network activity patterns to potential malicious actors without requiring direct real-world identifiers during authentication. This intermediary layer enables attribution while maintaining the existing authentication framework.
Solution Approach 2:
The system implements feedback loops where detected anomalous activities are continuously fed back into the profiling mechanism. When anomalous behavior is detected, the system refines its profiles and improves future detection accuracy. This feedback mechanism allows the system to learn from each incident and enhance its ability to attribute activities to specific actors over time, compensating for the initial lack of real-world identifiers.
2Reliability
If comprehensive network monitoring is implemented to detect all anomalous activities, then detection coverage is improved, but false positives increase and system complexity grows
Solution Approach 1:
The patent applies local quality by creating specialized profiling modules针对不同 types of network activities and threat patterns. Instead of a single monolithic monitoring system, the architecture divides detection into specialized components that analyze specific aspects of network behavior. This modular approach improves detection accuracy for particular anomaly types while keeping each component's complexity manageable and allowing selective deployment based on organizational needs.
3Speed
If real-time anomaly detection and attribution is implemented, then response time to network intrusions is improved, but computational resources and processing time are consumed
Solution Approach 1:
The system performs preliminary actions by pre-computing and storing baseline behavioral profiles of legitimate users and known malicious patterns during off-peak periods. These pre-established profiles are then quickly matched against real-time network activities using efficient comparison algorithms. This preliminary preparation dramatically reduces the computational resources required during real-time detection, enabling fast response times without consuming excessive processing power during critical incident response periods.
Data Source
AI summary
A security system detects and attributes anomalous activity in a network. The system logs user network activity, which can include ports used, IP addresses, commands typed, etc., and may detect anomalous activity by comparing users to find similar users, sorting similar users into cohorts, and comparing new user activity to logged behavior of the cohort. The comparison can include a divergence calculation. Origins of user activity can also be used to determine anomalous network activity. The hostname, username, IP address, and timestamp can be used to calculate aggregate scores and convoluted scores. The system extracts features from the logged anomalous network activity, and determines whether the activity is attributable to an actor profile by comparing the extracted features and attributes associated with the actor profile based upon previous activity attributed to the actor.