Sequence Anomaly Detection Without User Identity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Implementing user behavior analysis in cloud storage environments is challenging due to the lack of explicit user session IDs or account IDs, which hinders the detection of anomalous sequences that may indicate cyber threats, as traditional methods rely on user identity data for differentiating normal from abnormal behavior.
Innovation Solution
A sequence anomaly detection system that extracts ordered event sequences from event logs, vectorizes them, and uses a machine learning model trained on historical data to compute anomaly scores, independent of user identity information, allowing for the detection of anomalous sequences that may indicate cyber threats without relying on user-specific data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional user behavior analysis methods are used, then user-specific security monitoring is improved, but the system cannot detect anomalies in cloud storage environments where user session IDs or account IDs are not explicitly associated with events
Solution Approach 1:
The patent introduces event sequence patterns as an intermediary representation that bridges the gap between raw events and anomaly detection. By transforming events into structured sequences with contextual relationships, the system can detect anomalies without relying on explicit user identification, thus resolving the contradiction between detection accuracy and environment adaptability
Solution Approach 2:
The system changes the parameters of analysis from user-centric (relying on user IDs and session IDs) to event-centric (focusing on event sequences, patterns, and contextual relationships). This parameter transformation enables the same anomaly detection methodology to work effectively in cloud storage environments where traditional user identification is unavailable
2Reliability
If user identity data is required for behavior analysis, then differentiation between normal and abnormal behavior is improved, but the system becomes inapplicable to environments lacking user identity information
Solution Approach 1:
The patent extracts and removes the dependency on user identity data from the anomaly detection process. By focusing solely on event sequences, patterns, and contextual relationships, the system extracts the essential behavioral information needed for anomaly detection while eliminating the requirement for user IDs, session IDs, or other identity-related data
Solution Approach 2:
The event sequence analysis framework achieves universality by being applicable across different environments (traditional systems with user identification and cloud storage systems without user identification). The same core methodology can detect anomalies in diverse contexts, making the system both reliable and broadly compatible
3Measurement precision
If context is added to individual events for better anomaly detection, then detection accuracy is improved, but system complexity increases
Solution Approach 1:
The patent segments the analysis into distinct components: event extraction, sequence formation, pattern identification, and anomaly scoring. By dividing the complex task of contextual analysis into manageable segments, the system achieves high detection precision while keeping each component's complexity controlled and manageable
Solution Approach 2:
The system adds contextual dimensions to event analysis by examining events in sequence rather than isolation, considering temporal relationships and pattern structures. This dimensional expansion from single-event to sequence-based analysis improves precision while the modular architecture prevents exponential complexity growth
Data Source
AI summary
Anomalous sequences are detected by approximating user sessions with heuristically extracted event sequences, allowing behavior analysis even without user identification or session identifiers. Extraction delimiters may include event count or event timing constraints. Event sequences extracted from logs or other event lists are vectorized and embedded in a vector space. A machine learning model similarity function measures anomalousness of a candidate sequence relative to a specified history, thus computing an anomaly score. Restrictions may be placed on the history to focus on a particular IP address or time frame, without retraining the model. Anomalous sequences may generate alerts, prompt investigations by security personnel, trigger automatic mitigation, trigger automatic acceptance, trigger tool configuration actions, or result in other cybersecurity actions.