User Access Anomaly Detection With ML Feedback Loops

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional rule-based security solutions are ineffective against novel threats and generate false alerts, being reactive and unable to detect emerging security breaches early, leading to potential significant damage to companies.

Innovation Solution

A machine learning-based framework using unsupervised and supervised models to detect anomalies in user access behaviors, integrating feedback loops for model tuning and rule adaptation, to identify and mitigate potential threats proactively.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If rule-based solutions are used to detect security threats, then security alerts can be generated based on predefined rules, but the solutions cannot detect novel threats and generate false alerts

Engineering Contradiction:

Improvesecurity threat detection accuracyVSAvoidability to detect novel threats

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The system implements feedback loops where security alerts generated by the machine learning model are analyzed and fed back to refine the model's detection parameters and rules. This continuous feedback mechanism allows the system to learn from both true positives and false positives, improving its ability to detect novel threats while reducing false alerts over time

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The machine learning model is trained in advance on historical security data to establish baseline behaviors and anomaly patterns before deployment. This preliminary training enables the system to proactively detect novel threats by comparing real-time user behaviors against the pre-established patterns, rather than waiting for rule-based triggers

Inventive Principle:

Principle #10Preliminary action

2Reliability

If conventional rule-based solutions are used, then existing security rules can be enforced, but the solutions are reactive and cannot identify threats early

Engineering Contradiction:

Improvesecurity rule enforcementVSAvoidtime to detect security breaches

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system performs preliminary analysis by continuously monitoring user behaviors and establishing baseline patterns before actual security breaches occur. The machine learning model proactively identifies anomalous patterns that may indicate emerging threats, allowing the system to alert security teams before traditional rule-based systems would trigger, thus reducing the time loss for detection

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent replaces the mechanical, static rule-based system with a dynamic machine learning-based system that can adaptively analyze user behaviors. This substitution enables the system to move from reactive rule enforcement to proactive anomaly detection, identifying potential security breaches by detecting deviations from normal user patterns rather than waiting for predefined rule violations

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

3Adaptability or versatility

If machine learning models are used to detect anomalies, then novel threats can be identified, but the system complexity increases

Engineering Contradiction:

Improveability to detect novel threatsVSAvoidsystem architecture complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The system introduces an intermediary layer between raw user behavior data and security alert generation. The machine learning model acts as a mediator that processes complex user behavior patterns and translates them into interpretable anomaly scores and alerts. This intermediary layer manages system complexity by encapsulating the computational complexity within the model while presenting a simplified interface to security analysts

Inventive Principle:

Principle #24Intermediary (Mediator)

4Measurement precision

If multiple machine learning models are deployed, then detection accuracy improves, but computational resources and processing time increase

Engineering Contradiction:

Improveanomaly detection accuracyVSAvoidcomputational resource consumption

Core Design Contradiction:

Measurement precisionVSUse of energy by moving object

Solution Approach 1:

The system segments the anomaly detection task across multiple specialized machine learning models, where each model focuses on detecting specific types of anomalies or user behaviors. This segmentation allows the system to improve overall detection accuracy by dividing the complex detection problem into manageable sub-tasks, while also enabling selective deployment and optimization of individual models to control computational resource consumption

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS20260012472A1Method, apparatus, system, and non-transitory computer readable medium for detecting anomalous user access behaviors

Publication Date: 2026.01.08 CHARLES SCHWAB & CO INC

AI summary

A server for detecting anomalies associated with users accessing a network is caused to receive a dataset including static data and dynamic data. The static data includes location data of resources associated with the network and user data, and the dynamic data includes user access events. The server is further caused to detect, with a plurality of unsupervised machine learning models, an anomaly associated with a user accessing the network based on the static data and the dynamic data, determine whether the detected anomaly is critical, and in response to determining the detected anomaly is critical, generate and transmit a security alert specific to the detected anomaly to a security operation center. Other example servers, systems, apparatuses, methods, and non-transitory computer readable medium for detecting anomalies associated with users accessing a network are also disclosed.