Security Log Pattern Analysis for Accurate User Work Times
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security logs fail to accurately track user activities and work time due to numerous logon/logoff events unrelated to user activity, making it difficult to determine when a user starts and stops working.
Innovation Solution
An analytic server parses security logs to identify logon, logoff, and privileged events, recognizing patterns in event data to determine user work times by analyzing differences between logon and logoff events, and generating a heat map to visualize user activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security logs record all logon/logoff events, then complete security audit trail is achieved, but user activity tracking accuracy deteriorates due to noise from system-generated events
Solution Approach 1:
The patent segments logon/logoff events into different categories: user-initiated events versus system-generated events (Group Policy refreshes, service ticket renewals). By classifying and separating these event types, the system can filter out noise events that do not represent actual user activity, thereby improving user activity tracking accuracy while maintaining complete security audit trails for all events.
Solution Approach 2:
The patent introduces an intermediary analysis layer that processes security log events before presenting user activity information. This intermediary layer applies filtering rules and patterns to distinguish between genuine user activities and system-generated noise, allowing the system to maintain comprehensive logging while providing accurate user activity tracking to users.
2Reliability
If the system monitors all logon events including Group Policy refreshes, then comprehensive security monitoring is achieved, but user work time determination deteriorates due to constant noise events
Solution Approach 1:
The patent applies preliminary filtering rules to security log events before analysis. By pre-defining patterns that identify system-generated noise events (such as Group Policy refreshes occurring every 90 minutes, service ticket renewals), the system can automatically exclude these predictable noise events from user activity calculations, improving work time determination accuracy while maintaining comprehensive security monitoring.
3Reliability
If the security log records every authentication event, then complete security logging is achieved, but difficulty in determining actual user activity increases due to multiple event sources
Solution Approach 1:
The patent extracts and isolates user-initiated logon/logoff events from the comprehensive security log by applying filtering criteria. By taking out only the relevant user activity events and separating them from system-generated events (domain controller logons, file server network logons, service ticket events), the system maintains complete security logging while significantly reducing the complexity of detecting and measuring actual user activity.
Data Source
AI summary
Disclosed herein are embodiments of systems, methods, and products comprises a server for monitoring and tracking user activities based on different events in a security log. The server may retrieve the security log and parse the security log to identify a set of predetermined events for a user based on the event IDs, including logon events, logoff events, and privileged events. Based on the time point when privileged events occur at least partially during the pattern of having more logon events than logoff events, the server may determine when the user starts to work. Based on the time point when the logoff events and logon event starts to show the pattern that there are more logoff events than logon events and the difference increasing into a threshold, the server may determine when the user stops working. The server may generate a heat map indicating different users' work time length.