SaaS UEBA Modeling With Cross-Actor Data for Sparse Behavior Signals
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Implementing user and entity behavior analytics (UEBA) for Software-as-a-Service (SaaS) applications is challenging due to the inherent variability of actor behavior within and across tenant organizations, and the sparsity of data for individual actors, making it difficult to train effective models that capture actor-specific behavior.
Innovation Solution
A multi-perspective UEBA system that leverages SaaS activity data from both the actor and nearby actors within a tenant organization, utilizing distinct modules for different aspects of behavior, such as activity volume, time, type, and location, and dynamically adjusts training data using a directory service to handle sparse data, combining likelihoods through decorrelation and averaging to generate an anomalousness score.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If UEBA models are trained using only individual actor data, then actor-specific behavior accuracy is improved, but model training fails due to data sparsity
Solution Approach 1:
The patent combines training data from multiple actors within the same tenant organization to train UEBA models. By merging datasets across actors, the system overcomes individual data sparsity while maintaining tenant-specific behavior patterns. The federated learning approach aggregates training samples from multiple actors to create sufficient training data for accurate model training.
Solution Approach 2:
The patent introduces a new dimension of data aggregation by utilizing cross-actor data within the same tenant. Instead of relying solely on temporal dimensions of individual actor data, the system adds the cross-sectional dimension of multiple actors, thereby expanding the available training data volume without compromising actor-specific detection accuracy.
2Quantity of substance
If UEBA models are trained using data from multiple actors, then data volume for training is improved, but actor-specific behavior patterns are diluted
Solution Approach 1:
The patent segments the training process into tenant-level aggregation and actor-specific model instantiation. Data from multiple actors is aggregated at the tenant level to establish common behavior patterns, while individual actor models are then trained with their specific data to capture unique behaviors. This segmentation allows the system to benefit from both multi-actor data volume and actor-specific precision.
Solution Approach 2:
The patent applies local quality by customizing UEBA models for each actor within the tenant organization. While the overall system uses multi-actor data for training, each actor receives a tailored model trained on their specific behavior patterns combined with tenant-level insights. This ensures that actor-specific behavior patterns are preserved and detected with high precision despite using aggregated training data.
3Adaptability or versatility
If behavior variability across tenant organizations is accounted for, then generalization capability is improved, but model complexity increases
Solution Approach 1:
The patent creates a universal UEBA model architecture that can function across multiple tenant organizations. The federated learning framework enables a single model structure to be trained and deployed across different tenants, allowing the system to generalize behavior patterns across organizations while maintaining the ability to detect tenant-specific anomalies. This multi-functionality reduces the need for separate models for each tenant.
Data Source
AI summary
A multi-perspective user and entity behavior analytics (UEBA) system (“system”) builds and maintains interchangeable modules for predicting likelihoods of anomalous user behavior at the scope of an actor (i.e., a user or entity) of an organization within time periods. Each module comprises probability models and/or machine learning models as sub-modules that model actor behavior at various levels of granularity with respect to usage of Software-as-a-Service applications. The system generates anomalousness scores by decorrelating likelihoods output by each sub-module and uses the anomalousness scores to monitor and perform corrective action based on anomalous actor behavior to maintain security posture across the organization.