Risk Score Computation Using Weighted Anomaly Scores and Context
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In computing environments, unreliable risk scores generated by existing anomaly detection systems lead to a high number of false alerts, wasting analyst time and potentially causing real issues to be missed, due to the lack of a comprehensive and accurate method for combining anomalous behavior scores from multiple detectors with contextual impacts.
Innovation Solution
A system that computes a risk score by combining anomalous scores from multiple detectors, weighted based on historical performance, and contextual static and dynamic factors, to provide a more reliable indication of risk to the computing environment, using a risk determining engine that integrates event data collectors, anomaly detectors, and impact assessments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing anomaly detection systems generate risk scores, then anomaly detection capability is provided, but the reliability of risk scores deteriorates leading to high false alert rates
Solution Approach 1:
The patent combines multiple anomaly scores from different detectors with contextual impact scores to generate a comprehensive risk score. This merging approach integrates diverse detection perspectives and contextual information, thereby improving overall risk assessment reliability while reducing false alerts through multi-factor validation.
Solution Approach 2:
The system dynamically adjusts the weighting of different anomaly detectors based on their historical performance and relevance to specific contexts. By changing the parameters (weights) assigned to different detection sources, the system optimizes the reliability of risk scores while maintaining sensitivity to genuine anomalies.
2Adaptability or versatility
If multiple anomaly detectors are used to improve detection coverage, then detection comprehensiveness is improved, but system complexity increases
Solution Approach 1:
The risk determination engine serves as a universal component that processes anomaly scores from multiple different detectors and contextual information sources. This multi-functional engine consolidates the complexity of managing multiple detectors into a single coordination point, thereby maintaining detection versatility while managing system complexity through centralized processing.
Solution Approach 2:
The patent introduces a risk determination engine as an intermediary layer between multiple anomaly detectors and the alerting system. This mediator aggregates, weights, and combines scores from various detectors, simplifying the overall system architecture by providing a unified interface that manages the complexity of multiple detection sources.
3Measurement precision
If comprehensive contextual factors are integrated to improve risk assessment accuracy, then measurement precision is improved, but computational requirements increase
Solution Approach 1:
The system applies different weighting strategies to contextual factors based on their local relevance to specific entities and situations. By assigning higher weights to locally relevant contextual factors and lower weights to general factors, the system achieves high assessment accuracy while avoiding unnecessary computation on less relevant data.
Solution Approach 2:
The risk determination engine selectively processes contextual factors based on the specific situation and entity being assessed. Rather than always computing all possible contextual factors, the system applies partial processing to relevant factors, reducing overall computational requirements while maintaining precision where it matters most.
Data Source
AI summary
In some examples, a system receives anomaly scores regarding an entity from a plurality of detectors, produces a weighted anomaly score for the entity based on the anomaly scores and respective weights assigned to the plurality of detectors, the weights based on historical performance of the plurality of detectors, determines an impact based on a context of the entity, wherein the impact is indicative of an effect that the entity would have on a computing environment if the entity were to exhibit anomalous behavior, and computes a risk score for the entity based on the weighted anomaly score and the determined impact.