Anomaly Detection in User Activity Correlations
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting anomalous employee behavior focus on either public or private activities but fail to effectively compare and contrast these to detect changes in their correlations, which can indicate potential issues like employee intent to leave or malicious actions.
Innovation Solution
A system that collects both public and private activity data, generates feature pairs, and builds a model to identify anomalies by comparing historical correlations, using either a rules-based or machine-learning approach, such as a one-class support vector machine, to issue alerts for deviations from normal behavior.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing methods focus on detecting anomalies by clustering users with a multi-domain probability model or estimating intent to quit, then anomaly detection capability is improved, but the ability to detect changes in correlation between public and private activities remains insufficient
Solution Approach 1:
The patent segments user activities into distinct public and private domains, creating separate feature vectors for each domain. This segmentation enables independent analysis of each domain while detecting correlations between them, allowing the system to identify anomalies through changes in the relationship between public and private activities rather than analyzing them in isolation.
Solution Approach 2:
The patent introduces a new dimension of analysis by examining the correlation between public and private activity domains. Instead of analyzing activities within a single domain, the system creates a multi-dimensional feature space that includes both public and private activity features, enabling detection of anomalous patterns that emerge from the interaction between these domains.
2Measurement precision
If the system collects and analyzes both public and private activity data, then detection accuracy for anomalous behavior is improved, but system complexity increases
Solution Approach 1:
The patent divides the complex task of analyzing user behavior into separate modules: public activity analysis, private activity analysis, and correlation analysis. Each module processes specific data types independently using standardized feature extraction techniques, then integrates results through correlation computation. This modular segmentation reduces overall system complexity while maintaining high detection accuracy.
Solution Approach 2:
The patent employs universal feature extraction and correlation analysis mechanisms that can handle multiple types of activities (public and private) using the same underlying framework. The generic correlation detection algorithm works across different activity domains, eliminating the need for separate specialized analysis systems and reducing overall complexity.
3Reliability
If the system continuously monitors and compares public and private activities to detect correlation changes, then early detection of employee intent to leave or malicious actions is improved, but computational resources and processing time increase
Solution Approach 1:
The patent performs preliminary feature extraction and correlation baseline establishment during normal operation periods. By pre-computing correlation statistics and storing them as reference profiles, the system enables rapid anomaly detection during critical periods without requiring continuous heavy computational processing, thus reducing real-time resource consumption while maintaining early detection capability.
Solution Approach 2:
The patent implements continuous monitoring of activity patterns with selective deep analysis. The system continuously collects public and private activity data and performs lightweight correlation checks, triggering only intensive correlation change analysis when deviations from baseline patterns are detected. This continuous-action approach with selective deep processing maintains early detection capability while minimizing overall computational resource consumption.
Data Source
AI summary
One embodiment of the present invention provides a system for detecting anomalous correlations between public and private activities of a user. During operation, the system collects public and private activity data associated with the user. The system generates a series of feature pairs, each feature pair including a public feature vector and a private feature vector generated from the activity data. Each respective feature pair corresponds to a respective point in time. The system generates a model to determine whether there is an anomaly in a correlation between the user's public and private activity data. The model is associated with a normal correlation between the user's public and private activity data over a period of time. The system collects additional public and private activity data and applies the model to determine whether there is an anomaly. The system may issue an alert in response to detecting an anomaly.