Self-learning cybersecurity threat detection system for multi-domain data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current user and entity behavior analytics (UEBA) systems rely on human-assigned risk points, which become outdated and lead to risk score inflation as the number of rules grows, making them inefficient in detecting cybersecurity threats in multi-domain data environments.
Innovation Solution
A self-learning system that calculates user session risk scores as a weighted sum of domain risk scores based on learned individual and session-level risk probabilities, using Bayes risk probabilities derived from event and session feature indicators across multiple domains, eliminating the need for human-assigned risk points and reducing risk score inflation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If rule-based threat detection systems are used, then threat detection capability is provided, but risk score inflation occurs as the number of rules grows
Solution Approach 1:
The system changes the parameter for risk assessment from static human-assigned risk points to dynamic probability-based risk scores. Each domain event is assigned a probability value between 0 and 1 representing the likelihood of malicious activity, and these probabilities are continuously updated based on observed behavior patterns, allowing the system to adapt to evolving threats without suffering from rule proliferation
Solution Approach 2:
The system performs self-learning by automatically updating risk probability parameters based on observed domain events and behavior patterns. The machine learning models continuously refine their risk assessments without requiring manual reconfiguration of detection rules, enabling the system to adapt to new threat patterns autonomously
2Adaptability or versatility
If the number of detection rules is increased to cover new threats, then threat detection coverage improves, but system complexity and manual tuning requirements increase
Solution Approach 1:
The system automatically learns and adapts to new threat patterns through machine learning models that process domain events and update risk probability parameters without human intervention. This self-learning capability allows the system to cover emerging threats while maintaining manageable complexity, as the models automatically adjust to new patterns rather than requiring manual rule creation
Solution Approach 2:
The system transitions from a rule-based parameter system to a probability-based parameter system. Instead of maintaining a large number of detection rules, the system uses a smaller set of learnable parameters (risk probabilities for different domain events) that automatically adapt to new threats through observation and statistical learning
3Reliability
If human-assigned risk points are used, then initial threat detection is effective, but manual updates are required as threats evolve
Solution Approach 1:
The system automatically updates risk probability parameters by learning from observed domain events and behavior patterns. The machine learning models continuously refine their risk assessments based on actual threat patterns, eliminating the need for manual updates while maintaining high detection effectiveness as threats evolve
Solution Approach 2:
The system implements feedback mechanisms where observed domain events and threat patterns feed back into the machine learning models to continuously improve risk probability parameters. This feedback loop allows the system to automatically adapt to evolving threats without requiring manual reconfiguration, saving time while maintaining detection effectiveness
Data Source
AI summary
The present disclosure describes a self-learning system, method, and computer program for detecting cybersecurity threats in a computer network based on anomalous user behavior and multi-domain data. A computer system tracks user behavior during a user session across multiple data domains. For each domain observed in a user session, a domain risk is calculated. The user's session risk is then calculated as the weighted sum of the domain risks. A domain risk is based on individual event-level risk probabilities and a session-level risk probability from the domain. The individual event-level risk probabilities and a session-level risk probability for a domain are derived from user events of the domain during the session and are based on event-feature indicators and session-feature indicators for the domain.