ML-Based USB Activity Monitoring for Insider Threat Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The widespread use of USB drives within organizations poses challenges in detecting and preventing data leakage and system compromise due to their small size, ease of concealment, and ubiquity, making it difficult to mitigate insider threats effectively.
Innovation Solution
A method and system utilizing a machine learning module to analyze USB activity logs, generate a trained model to detect abnormal user activities, and perform mitigation tasks, such as revoking access, to prevent insider threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If USB drives are widely used for data storage and transfer, then productivity and ease of operation are improved, but the risk of data leakage and insider threat increases
Solution Approach 1:
The system performs preliminary actions by continuously monitoring USB connection events and collecting baseline data about normal usage patterns before threats occur. The machine learning model is trained in advance on historical USB activity data to recognize normal behavior, enabling the system to detect deviations from established patterns and prevent data leakage before it happens.
Solution Approach 2:
The system implements feedback mechanisms by continuously analyzing USB activity logs against the trained machine learning model and adjusting security responses based on detected anomalies. The feedback loop includes monitoring user behavior patterns, comparing them against baseline data, and triggering mitigation tasks when abnormal activity is detected, thereby dynamically responding to evolving threats.
2Difficulty of detecting and measuring
If USB activity monitoring is implemented to detect insider threats, then security detection capability is improved, but system complexity increases
Solution Approach 1:
The patent replaces complex manual security analysis with machine learning algorithms that automatically process and analyze USB activity logs. Instead of requiring complex rule-based monitoring systems, the invention uses ML models that learn from historical data and automatically detect anomalies, simplifying the overall system architecture while improving detection capability.
Solution Approach 2:
The system performs self-service by automatically training machine learning models on historical USB activity data without requiring constant human intervention. The model continuously learns from new data patterns, self-adjusts to changing user behaviors, and autonomously identifies anomalies, reducing the operational complexity of maintaining security monitoring systems.
3Measurement precision
If machine learning models are trained on historical USB data, then detection accuracy is improved, but data processing time and computational resources increase
Solution Approach 1:
The system performs preliminary training of machine learning models on historical USB activity data during off-peak times or in advance, so that the trained models are ready for rapid inference when actual threats occur. This preliminary action separates the time-consuming training process from the real-time detection process, improving detection speed without sacrificing accuracy.
Solution Approach 2:
The system uses partial action by training models on selectively sampled historical data rather than processing every single log entry in detail. The machine learning algorithm identifies and focuses on the most relevant features and patterns from the data, reducing processing time while maintaining detection accuracy through intelligent feature selection and prioritization.
Data Source
AI summary
A method for mitigating insider threat to an organization is disclosed. The method includes retrieving, from a database stored on a computing system of the organization, Universal Serial Bus (USB) logs recording USB activities of users of the organization, generating, based on the USB logs and using a machine learning (ML) module of an insider threat mitigation system, a trained ML model, further retrieving, from the database and in response to generating the trained ML model, subsequent USB logs recording subsequent USB activities of the users, analyzing, based on the trained ML model and using the ML module, the subsequent USB logs to detect an abnormal user activity, and performing, in response to the detected abnormal user activity and using a revoke access module of the insider threat mitigation system, a mitigation task of the computer system.