User Behavior Anomaly Detection Using Multi-Period Probability Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing user and entity behavior analytics (UEBA) technologies struggle to accurately determine anomalies in user behavior changes, as they do not differentiate between sudden and gradual changes, leading to potential false anomaly detections.
Innovation Solution
An anomaly determining system that generates user probability data for each period based on log data, using a trained model to assess the likelihood of anomaly occurrence by comparing probability values across periods, and includes features like statistical data generation and time-series input data to visualize user behavior, allowing for more accurate anomaly detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If one-shot output from trained CNN is used to determine anomaly, then detection speed is improved, but measurement precision deteriorates because gradual behavior changes cannot be distinguished from sudden anomalies
Solution Approach 1:
The system performs preliminary actions by generating probability data for multiple time points in advance and storing them. Before making an anomaly determination, the system has already prepared probability data for comparison, enabling both rapid detection and accurate differentiation between gradual changes and sudden anomalies through historical context.
Solution Approach 2:
The invention adds a time dimension to the anomaly detection by comparing probability data across multiple time points (t-2, t-1, t). This transforms the detection from a single-point assessment to a multi-point temporal analysis, enabling the system to distinguish between gradual changes and sudden anomalies while maintaining detection speed.
2Measurement precision
If probability data from multiple periods is compared, then measurement precision is improved to distinguish sudden from gradual changes, but device complexity increases
Solution Approach 1:
The system segments the probability data into distinct time-point components (t-2, t-1, t) and processes them through separate generation steps. This segmentation allows the complex multi-time-point comparison to be broken down into manageable individual probability generation tasks, reducing overall system complexity while maintaining high measurement precision.
Solution Approach 2:
The trained model serves as an intermediary that automatically processes the complex task of generating and comparing probability data across multiple time points. By delegating this complex computation to the trained model, the system achieves high measurement precision without proportionally increasing device complexity, as the model handles the computational burden.
3Loss of information
If user probability data is generated for multiple periods, then information completeness is improved, but loss of time increases due to additional data processing
Solution Approach 1:
The system performs preliminary action by generating probability data for multiple time points in advance before anomaly determination is needed. This pre-computation stores contextual information from past behavior patterns, allowing the system to make informed anomaly decisions without time-consuming real-time analysis of historical data trends.
Solution Approach 2:
The system creates copies of probability data from previous time points (t-2, t-1) and stores them for later comparison. Instead of reprocessing原始 log data when needed, the system uses these pre-generated probability copies, preserving complete behavioral context information while significantly reducing the time required for anomaly determination.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Provided are an anomaly determining system, an anomaly determining method, and a program which are capable of properly determining occurrence of an anomaly in a behavior of a user. An input data generation unit (42) is configured to generate, based on log data indicating a log of a behavior of a user with respect to a given computer resource for each period, input data for the period, which is associated with the log data. A user probability data generation unit (48) is configured to generate user probability data based on output obtained from a trained machine learning model (20) when the input data is input to the trained machine learning model (20). An anomaly determination unit (52) is configured to determine whether an anomaly has occurred in the behavior of the user during a latest period based on the user probability data generated based on the input data for the latest period and the user probability data generated based on the input data for a period before the latest period.