Security Graph Change Detection for Gradual Attack Anomalies
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud-based systems face challenges in detecting gradual malicious activities by hackers, as these attacks often resemble normal user behavior, making it difficult to distinguish between legitimate and malicious actions.
Innovation Solution
A security system monitors and analyzes changes in a security graph representing tenant accounts over time, detecting potential anomalies by evaluating groups of related changes in the graph, and triggering mitigation steps when anomalies exceed a predetermined threshold.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional security monitoring methods are used to detect malicious activities, then the system can identify obvious attacks, but it fails to detect gradual malicious activities that resemble normal user behavior
Solution Approach 1:
The patent segments the detection process into multiple components: individual graph change detections, grouping of related changes, and pattern recognition across multiple snapshots. This segmentation allows the system to break down the complex problem of detecting subtle malicious activities into manageable analytical steps, improving detection precision without overwhelming the system.
Solution Approach 2:
The patent merges multiple individual graph changes into groups of related changes. By combining and analyzing multiple small changes together rather than in isolation, the system can identify patterns indicative of gradual malicious activities that would be invisible when examining single changes, thereby improving detection accuracy.
2Reliability
If the system monitors all changes in the security graph to detect malicious activities, then detection coverage is improved, but false positives increase
Solution Approach 1:
The patent applies local quality by evaluating changes in the context of their specific location within the security graph and their relationships to other changes. Rather than applying uniform detection rules to all changes, the system analyzes each change's local context and its connections to other changes, allowing for more nuanced detection that reduces false positives while maintaining comprehensive coverage.
Solution Approach 2:
The system uses feedback mechanisms where detection results and change patterns inform subsequent analysis. By continuously learning from detected patterns and adjusting detection thresholds based on observed behavior, the system improves reliability while reducing false positives through adaptive decision-making.
3Measurement precision
If the system analyzes multiple snapshots of the security graph over time, then gradual attacks are detected, but processing time increases
Solution Approach 1:
The patent extracts and focuses analysis on specific graph changes and their relationships rather than processing all possible data between snapshots. By taking out only the relevant changes and their interconnections for detailed analysis, the system maintains high detection precision for gradual attacks while minimizing unnecessary processing time.
Solution Approach 2:
The system performs partial analysis by focusing on groups of related changes rather than exhaustively analyzing every possible aspect of each snapshot. This selective approach allows the system to detect gradual attacks effectively without the prohibitive time cost of complete exhaustive analysis.
Data Source
AI summary
Systems, methods, and techniques are directed to detecting potential anomalous activity based on changes in a security graph. In an example, a security system receives a first snapshot of a graph representative of a tenant account of a network-based system corresponding to a first timestamp. The security system receives a second snapshot of the graph corresponding to a second timestamp. The security system determines a first change in the graph based on the first and second snapshots and a second change related to the first change. The security system detects a potential anomaly based on the first and second changes. Responsive to detecting a potential anomaly, the security system causes a mitigation step to be performed with respect to the tenant account. In a further example, the security system determines relationships between a sequence of changes satisfies a cumulative anomaly criterion.