Risk Indicator Determination Using Event Log Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current information handling systems face challenges in accurately determining the risk associated with user accounts, as they often rely on the resources accessible by the accounts rather than the resources actually accessed, leading to inaccurate risk assessments, especially for highly privileged accounts.
Innovation Solution
The system analyzes event logs within a time interval to determine risk indicators based on the resources actually accessed, using a sliding time window and machine learning algorithms to classify resources and calculate cumulative risk indicators, shifting focus from potential access to actual activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If risk determination is based on resources accessible by user accounts, then security coverage is improved, but measurement precision deteriorates due to false positives from legitimate access privileges
Solution Approach 1:
The patent inverts the traditional risk assessment approach by shifting focus from what resources a user account can access (potential risk) to what resources the user account actually accessed (actual risk). This inversion resolves the contradiction by using event log data to determine risk based on real activity rather than theoretical access capabilities, thereby maintaining security coverage while improving measurement precision.
2Speed
If event log analysis is performed continuously, then risk detection speed is improved, but energy consumption increases
Solution Approach 1:
The patent implements periodic action by analyzing event logs at regular intervals rather than continuously. The system retrieves event logs occurring within specific time intervals and processes them periodically, which maintains timely risk detection while reducing energy consumption compared to continuous real-time analysis.
3Measurement precision
If detailed event log analysis is performed, then risk measurement precision is improved, but device complexity increases
Solution Approach 1:
The patent extracts only the essential and relevant features from event logs for risk analysis, rather than processing all possible log details. By focusing on specific event log attributes that are most indicative of risk (such as accessed resources, user actions, and temporal patterns), the system achieves high measurement precision while avoiding the complexity of analyzing every possible log parameter.
Data Source
AI summary
Systems and techniques for determining and displaying risk indicators are described. A set of event logs occurring in a time interval and associated with a user account retrieving may be retrieved from an event log database. For individual event logs in the set of event logs, a context may be determined. A resource associated with the individual log may have an associated classification. An activity risk associated with the individual event log may be determined based at least in part on the first context and, if applicable, on the associated classification. For individual event logs in the set of event logs, a risk indicator may be determined based at least in part on the activity risk. In some cases, a cumulative risk indicator may be determined for the particular time interval based on the risk indicators associated with the individual event logs.