User Behavior Anomaly Detection Using Multi-Period Probability Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing user and entity behavior analytics (UEBA) technologies struggle to differentiate between sudden and gradual changes in user behavior, leading to potential false anomalies in anomaly detection.
Innovation Solution
An anomaly determining system that generates user probability data for multiple periods, comparing the latest period's data to previous periods to determine if a significant change has occurred, using a trained model incorporating convolutional neural networks (CNN), long short-term memory (LSTM), and feed-forward neural networks (FFNN) to assess the likelihood of anomalies based on log data and statistical analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If one-shot output from trained CNN is used to determine anomaly, then detection speed is improved, but measurement precision deteriorates because it cannot distinguish between sudden and gradual behavior changes
Solution Approach 1:
The patent segments the anomaly detection process into multiple time periods, comparing user probability data across different time windows. Instead of a single one-shot detection, the system divides time into segments and analyzes changes between them, allowing distinction between sudden anomalies (large probability changes) and gradual behavior changes (small probability changes).
Solution Approach 2:
The system performs preliminary analysis by generating user probability data for multiple time periods before making the final anomaly determination. This preliminary action of comparing historical probability data enables the system to contextualize current behavior and avoid false positives from gradual changes.
2Device complexity
If user behavior changes are monitored without time-series comparison, then device complexity is reduced, but reliability deteriorates due to false anomaly determinations
Solution Approach 1:
The patent introduces dynamic time-series comparison into the anomaly detection system. By continuously generating user probability data across multiple periods and comparing changes over time, the system dynamically adapts to gradual behavior changes while maintaining sensitivity to sudden anomalies, thereby improving reliability without requiring overly complex infrastructure.
Data Source
AI summary
An input data generation unit is configured to generate, based on log data indicating a log of a behavior of a user with respect to a given computer resource for each period, input data for the period, which is associated with the log data. A user probability data generation unit is configured to generate user probability data based on output obtained from a trained machine learning model when the input data is input to the trained machine learning model. An anomaly determination unit is configured to determine whether an anomaly has occurred in the behavior of the user during a latest period based on the user probability data generated based on the input data for the latest period and the user probability data generated based on the input data for a period before the latest period.