Recursive Anomaly Detection for Insider Threat Identification

The patent segments the anomaly detection process into multiple hierarchical levels: first-level anomalies (deviations from user baseline), second-level anomalies (deviations from group baseline), and third-level anomalies (deviations from organizational baseline). This segmentation allows the system to filter and prioritize anomalies at different granularities, making the large volume of suspected anomalies manageable by focusing on the most significant deviations at each level.

The patent applies local quality by creating user-specific baseline models that capture individual behavior patterns, then comparing actual behavior against these personalized baselines. This allows the system to detect anomalies with high precision for each user context while maintaining scalability across the organization. The baseline models are constructed with local characteristics (user-specific parameters) rather than applying uniform thresholds to all users.

The patent implements dynamic baseline models that adapt to changing user behavior patterns over time. Instead of static rules, the system continuously updates baseline expectations based on historical data, allowing it to accommodate natural variations in user behavior while still detecting genuine anomalies. This dynamic approach maintains detection accuracy without generating excessive false positives that would overwhelm security analysts.

The patent changes the parameters of analysis by moving from fixed rule-based thresholds to probabilistic baseline models with configurable confidence levels. The system allows dynamic adjustment of detection sensitivity parameters, enabling security teams to balance between detection thoroughness and result manageability. This parameter flexibility allows the same system to serve different organizational contexts and risk tolerances.