Risk Entity Graphs for Faster Anomalous Event Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in timely detection of anomalous events due to the voluminous nature of event logs, making it difficult to identify potential security threats or breaches.
Innovation Solution
An event analysis system that utilizes a plurality of models to analyze event logs, detecting different types of anomalous behaviors and providing a graphical representation of risk entities associated with detected events, allowing for visual identification of relationships between these entities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If event logs are stored comprehensively to maintain complete security records, then reliability of security monitoring is improved, but the volume of data makes timely detection of anomalous activity difficult
Solution Approach 1:
The patent segments the large volume of event log data into individual event entries that can be processed and analyzed separately by machine learning models. Each event is evaluated independently for anomalous characteristics, allowing systematic analysis without being overwhelmed by the total data volume. This segmentation enables timely detection while maintaining comprehensive security monitoring.
2Measurement precision
If comprehensive event logs are maintained for all system activities, then measurement precision of security events is improved, but the complexity of analyzing the data increases
Solution Approach 1:
The patent introduces machine learning models as intermediary components between the raw event log data and the security analysis process. These models automatically evaluate events for anomalous characteristics, serving as a mediator that translates comprehensive log data into actionable security insights. This intermediary layer maintains high measurement precision while managing analysis complexity through automated pattern recognition.
3Measurement precision
If all event log entries are manually reviewed to identify anomalies, then measurement precision of anomaly detection is improved, but productivity of security monitoring decreases
Solution Approach 1:
The patent implements self-service anomaly detection through machine learning models that automatically evaluate event log entries without requiring manual review. The system autonomously identifies anomalous events by comparing them against learned patterns of normal and abnormal behavior. This self-service capability maintains high detection precision while dramatically improving security monitoring productivity by eliminating manual analysis bottlenecks.
Data Source
AI summary
One or more event logs are received. The one or more event logs are analyzed using a plurality of models to detect one or more anomalous events. A graphical representation of risk entities associated with at least one of the one or more detected anomalous events is provided. A visual representation of automatically detected relationships between the risk entities associated with the at least one of the one or more detected anomalous events is provided in the graphical representation. Indications of measures of anomaly associated with detected anomalous events are provided for the associated risk entities.