Multi-Perspective UEBA for Sparse SaaS User Behavior Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing UEBA systems for SaaS applications face challenges in effectively modeling actor behavior due to variability within and across tenant organizations, particularly when data for individual actors is sparse, making it difficult to train effective models that capture actor-specific behavior.
Innovation Solution
A multi-perspective UEBA system that leverages SaaS activity data from both the actor and nearby actors within a tenant organization, using distinct modules to model aspects of behavior such as activity volume, time, type, and location, and decorrelates likelihoods from these modules to generate an anomalousness score, dynamically adding or removing modules and training data as needed to handle sparse data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If UEBA systems use individual actor data only, then actor-specific behavior modeling is improved, but model training effectiveness deteriorates when data is sparse
Solution Approach 1:
The patent combines individual actor data with organization-level data and nearby actor data to train behavior models. This merging of data sources at multiple granularity levels allows the system to maintain actor-specific behavior modeling while overcoming data sparsity through aggregation, directly resolving the contradiction between precision and reliability.
Solution Approach 2:
The patent introduces a hierarchical data dimension by collecting behavior data at multiple levels: individual actor level, nearby actor level, and entire organization level. This dimensional expansion allows the system to leverage data from broader contexts to improve model training reliability without losing actor-specific precision.
2Measurement precision
If UEBA systems collect data from multiple sources, then behavior modeling accuracy is improved, but data sparsity worsens when individual actor data is limited
Solution Approach 1:
The system merges data from multiple sources including individual actor activity data, nearby actor data, and organization-wide data. This combination increases the quantity of available training data while maintaining the precision needed for accurate behavior modeling through multi-level data aggregation.
Solution Approach 2:
The patent creates a universal data collection framework that gathers behavior data applicable at multiple levels (individual, group, organization). This multi-functional data collection approach ensures sufficient training data is available across all granularity levels, resolving the data sparsity problem.
3Measurement precision
If UEBA systems use multiple behavior perspectives, then anomaly detection accuracy is improved, but system complexity increases
Solution Approach 1:
The patent segments the anomaly detection system into multiple independent behavior perspective modules, each analyzing a specific aspect of user behavior. This segmentation allows the system to achieve high anomaly detection accuracy through comprehensive multi-perspective analysis while managing complexity by organizing functions into distinct, modular components.
Solution Approach 2:
The system adds a behavioral perspective dimension by analyzing user actions from multiple viewpoints (activity volume, activity type, activity time, activity location). This dimensional expansion improves anomaly detection accuracy while the modular architecture manages the resulting system complexity.
Data Source
AI summary
A multi-perspective user and entity behavior analytics (UEBA) system (“system”) builds and maintains interchangeable modules for predicting likelihoods of anomalous user behavior at the scope of an actor (i.e., a user or entity) of an organization within time periods. Each module comprises probability models and/or machine learning models as sub-modules that model actor behavior at various levels of granularity with respect to usage of Software-as-a-Service applications. The system generates anomalousness scores by decorrelating likelihoods output by each sub-module and uses the anomalousness scores to monitor and perform corrective action based on anomalous actor behavior to maintain security posture across the organization.