User Behavior Analysis for Anomalous Cloud Download Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing cloud-based content management systems are vulnerable to malicious insiders exfiltrating sensitive documents due to technological limitations in legacy security approaches, which fail to detect anomalous user behavior effectively.

Innovation Solution

Implement user behavior analysis using feature vectors generated for both a comparison time period and an anomaly time period to identify and detect anomalous downloads by clustering user-to-file interactions and applying weighting based on file sensitivity, ownership, and content, with machine learning to adjust weights.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Object-affected harmful factors

If legacy firewall-level security is implemented, then external attacks are prevented, but internal malicious insider threats cannot be detected

Engineering Contradiction:

Improveexternal attack preventionVSAvoidinternal malicious behavior detection

Core Design Contradiction:

Object-affected harmful factorsVSDifficulty of detecting and measuring

Solution Approach 1:

The security system is segmented into multiple layers: traditional firewall-level security for external threats, and a new user behavior analysis layer for internal threats. The UBA system segments user interactions into fine-grained events (downloads, accesses, shares) and analyzes them individually against behavioral baselines, enabling detection of malicious insiders without compromising external security.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

An intermediary UBA analysis layer is introduced between the content management system and the user. This intermediary continuously monitors user interactions, compares them against learned behavioral patterns, and alerts on anomalies. The intermediary operates transparently to users while providing deep inspection of internal threats that firewalls cannot detect.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Difficulty of detecting and measuring

If comprehensive user behavior monitoring is implemented, then malicious insider detection improves, but system complexity increases

Engineering Contradiction:

Improveanomalous behavior detectionVSAvoidsecurity system complexity

Core Design Contradiction:

Difficulty of detecting and measuringVSDevice complexity

Solution Approach 1:

The system performs preliminary action by continuously learning and storing user behavior baselines before anomalies occur. During the learning phase, the system captures normal interaction patterns (which files users access, when, and how frequently). These pre-established baselines serve as reference points for future anomaly detection, reducing the need for complex real-time analysis during actual threats.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system monitors changes in behavioral parameters over time (download frequency, access timing, file types). Instead of analyzing all possible user actions equally, the system focuses on parameter changes that deviate from established baselines. This parameter-change approach simplifies complexity by filtering out normal variations and focusing only on significant anomalies.

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS20260095472A1Detecting anomalous downloads

Publication Date: 2026.04.02 BOX INC

AI summary

Disclosed is an improved systems, methods, and computer program products that performs user behavior analysis to identify malicious behavior in a computing system.The approach may be implemented by generating feature vectors for two time periods, performing scoring, and then performing anomaly detection.