Anomaly Detection Using Resampled User Behavior Models
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting anomalies in large data sets, such as in computer network security and healthcare, often fail to classify user behavior as anomalous even if the user has permission to access resources, leading to missed detections and false positives.
Innovation Solution
A data processing system that generates user behavior models by analyzing access patterns over time, using techniques like principal component analysis, singular value decomposition, and topic modeling to identify deviations in resource access, and classifies behavior as anomalous based on differences between initial and resampled models.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional anomaly detection methods are used to detect user behavior anomalies, then the system can identify some obvious anomalies, but it fails to classify user behavior as anomalous even when the user has permission to access resources, leading to missed detections and false positives
Solution Approach 1:
The patent transforms user behavior data into different feature representations by changing parameters such as time aggregation levels, resource access patterns, and behavioral metrics. This allows the system to detect anomalies by comparing multiple parameter representations of the same behavior, improving both reliability and measurement precision in anomaly classification.
Solution Approach 2:
The patent introduces additional dimensions for analyzing user behavior, including temporal dimensions (different time periods), resource dimensions (different types of accessed resources), and comparative dimensions (peer user behavior). This multi-dimensional approach enables more accurate anomaly detection by examining behavior from multiple perspectives simultaneously.
2Measurement precision
If the system analyzes user behavior at a detailed granular level to detect unexpected file type access, then it enhances anomaly detection sensitivity, but it increases computational complexity and data processing requirements
Solution Approach 1:
The patent segments user behavior analysis into distinct components: file type access patterns, temporal access patterns, resource hierarchy patterns, and peer comparison patterns. This segmentation allows the system to process detailed granular data through modular analysis steps, enhancing sensitivity while managing computational complexity through structured processing.
Solution Approach 2:
The patent performs preliminary aggregation and filtering of user behavior data before detailed anomaly analysis. By pre-processing data to identify relevant patterns and normalize behavior representations, the system reduces the computational burden of detailed granular analysis while maintaining high detection sensitivity.
3Reliability
If the system incorporates peer behavior analysis to reduce false positives, then it improves classification accuracy, but it increases the quantity of data that must be processed and stored
Solution Approach 1:
The patent creates universal peer groups that can be applied across multiple users with similar roles or access patterns. Instead of storing and processing individual peer data for each user comparison, the system establishes universal behavioral profiles that serve multiple users, reducing data volume while maintaining the false-positive-reducing benefit of peer analysis.
Solution Approach 2:
The patent uses representative sampling and data aggregation techniques where detailed peer behavior data is copied into summarized statistical representations. This allows the system to incorporate peer behavior analysis for false positive reduction while storing and processing only essential aggregated metrics rather than complete raw behavior logs.
Data Source
AI summary
Methods, systems, and apparatus, including computer programs encoded on computer storage media, for classifying user behavior as anomalous. One of the methods includes obtaining user behavior data representing behavior of a user in a subject system. An initial model is generated from training data, the initial model having first characteristic features of the training data. A resampling model is generated from the training data and from multiple instances of the first representation for a test time period. A difference between the initial model and the resampling model is computed. The user behavior in the test time period is classified as anomalous based on the difference between the initial model and the resampling model.