Streaming Event Scoring for Adaptive Security Risk Assessment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security systems face inefficiencies in identifying and managing risk associated with user behavior, as they often apply uniform policies without distinguishing between different types of interactions, leading to inefficient resource utilization and challenges in detecting anomalous or malicious behavior.
Innovation Solution
A method and system for constructing event distributions via a streaming scoring operation, which involves receiving and ingesting a stream of events, extracting features, and generating a streaming scoring value to assess the risk of user behavior in real-time, utilizing a processor, data bus, and non-transitory computer-readable storage medium with executable code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If uniform security policies are applied to all user behavior, then security coverage is comprehensive, but resource utilization becomes inefficient
Solution Approach 1:
The patent implements risk-based security policies that adapt security measures to the specific risk level of each user behavior. High-risk behaviors (e.g., accessing proprietary resources) receive enhanced security scrutiny, while low-risk behaviors (e.g., browsing public websites) receive standard monitoring. This local differentiation of security quality optimizes resource allocation by concentrating security efforts where they are most needed.
2Productivity
If typical security monitoring approaches are used, then system resources are conserved, but detection of anomalous behavior becomes challenging
Solution Approach 1:
The patent transforms security monitoring from static rule-based detection to dynamic risk scoring by changing the parameter from binary compliance checks to continuous numerical risk assessments. The risk score, calculated from multiple behavioral features, enables the system to detect subtle anomalies that deviate from normal patterns, significantly improving detection capability while maintaining efficient resource usage through automated scoring.
3Measurement precision
If detailed analysis of all user events is performed, then detection accuracy is improved, but processing time increases
Solution Approach 1:
The patent performs preliminary feature extraction and risk scoring on user events as they occur, preparing risk assessments in advance before security decisions are required. By pre-calculating risk scores based on extracted behavioral features, the system enables rapid security responses without performing exhaustive analysis at the moment of decision, thus reducing processing time while maintaining detection accuracy.
Data Source
AI summary
A method, system and computer-usable medium for performing a streaming scoring operation, comprising: receiving a stream of events, the stream of events comprising a plurality of events; ingesting the plurality of events; extracting features from the plurality of events to provide extracted features; and, generating a streaming scoring value based upon the extracted features.