Session Similarity Identification via Vector Distance Metrics
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for analyzing user and machine cloud activity logs fail to capture similar applicative session groups that vary slightly by timing or the number of actions, leading to inefficiencies in detecting suspicious internal behavior.
Innovation Solution
A system and method that calculate the similarity between historical safe sessions and monitored sessions using a distance metric combining subsequence distance, Euclidean distance of vectorized session representations, and a new action penalty, to define a risk score based on this similarity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional session grouping methods (constant timeframes, session ID's, or number of logs) are used, then the implementation is simple, but they fail to capture similar applicative session groups that vary slightly by timing or by the number of actions
Solution Approach 1:
The patent transforms session data into vector representations where each session is characterized by numerical parameters (action types, timing patterns, frequency metrics). This allows similar sessions with slight variations in timing or action count to be captured as close vector points, resolving the contradiction between detection accuracy and method complexity.
Solution Approach 2:
The patent replaces traditional mechanical/session-based grouping methods with a mathematical vector space model. Sessions are no longer grouped by rigid rules (timeframes, session IDs) but by their positional relationship in a vector space, enabling flexible similarity detection that accommodates natural variations in session behavior.
2Measurement precision
If machine learning techniques are used for session analysis, then detection accuracy improves, but training time and computational cost increase significantly
Solution Approach 1:
The patent uses lightweight vector representations and simple distance calculations instead of heavy machine learning models. Each session is converted to a vector and compared using efficient distance metrics, providing near-real-time analysis without the need for lengthy training processes, thus resolving the time-cost contradiction.
Solution Approach 2:
The patent extracts only the essential features needed for session comparison (action types, timing, frequency) and represents them as compact vectors. This extraction of key characteristics eliminates the need for comprehensive machine learning training while maintaining effective detection capability.
3Measurement precision
If every single activity log is analyzed individually, then detection coverage is complete, but the ability to detect suspicious patterns through context is reduced
Solution Approach 1:
The patent merges multiple individual activity logs into unified session vectors that capture the contextual relationships between actions. By combining logs within sessions and representing them as integrated vectors, the system maintains complete detection coverage while enabling pattern recognition through vector similarity comparisons.
Data Source
AI summary
Systems and methods for session similarity identification include receiving historical sessions for one of a plurality of machines operating in a cloud-based system. The methods can include receiving and manage sessions from any number of machines in the cloud-based system. The system then receives monitored sessions for the machine or plurality of machines, and calculates a similarity between the received historical sessions and the received monitored sessions. After calculating the similarity, the system defines a risk score based on the similarity.