User Group Definition Sequences for Compromised Account Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current user classification mechanisms are ineffective in identifying malicious user accounts when they perform authorized actions for malicious purposes, such as being taken over by hackers.
Innovation Solution
A classification system that generates group definition sequences using action sequence processing, comparing time-ordered datasets of user actions with known sequences to classify user accounts as malicious or benign based on shared action patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If user classification is based on individual authorized actions, then classification simplicity is maintained, but detection capability for compromised accounts deteriorates
Solution Approach 1:
The patent segments user behavior into discrete action types (e.g., file access, data download, authentication) and analyzes sequences of these actions rather than individual actions in isolation. This segmentation enables detection of malicious patterns like sequential file access followed by data exfiltration, while maintaining manageable complexity through standardized action categorization.
Solution Approach 2:
The system establishes baseline behavior patterns and sequence templates for legitimate users in advance. When a user's action sequence deviates from expected patterns (e.g., accessing restricted files at unusual times or sequences that don't match typical usage), the system triggers classification as compromised. This preliminary establishment of normal behavior enables proactive detection without requiring complex real-time analysis.
2Measurement precision
If classification relies on single action analysis, then processing speed is maintained, but accuracy in identifying compromised accounts deteriorates
Solution Approach 1:
The patent merges multiple action analyses into a unified sequence-based classification approach. Instead of evaluating actions independently, the system combines temporal and contextual information from multiple actions to form comprehensive behavior profiles. This merging enables accurate detection of compromised accounts through pattern recognition while optimizing processing by pre-computing action sequences and using efficient matching algorithms.
3Reliability
If the system only classifies based on obvious malicious actions, then false positives are reduced, but ability to detect sophisticated attacks deteriorates
Solution Approach 1:
The system dynamically adapts its classification criteria based on learned user behavior patterns and contextual information. Rather than relying on static rules that may generate false positives, the system continuously refines its understanding of legitimate user sequences and automatically adjusts detection thresholds. This dynamic approach enables detection of sophisticated attacks that use authorized actions in unconventional sequences while maintaining low false positive rates through adaptive learning.
Data Source
AI summary
Methods and systems are described herein for generating group definition sequences for accounts (e.g., user accounts) using action sequence processing and then classifying accounts using those group definition sequences. A plurality of user account actions and corresponding time that each action was taken may be received and based on that information, a sequence of action types sometimes referred to as a time-ordered dataset of action types (e.g., based on a chronological order of the actions) may be generated. The time-ordered dataset of action types may be compared with known time-ordered sequences for a particular user group or user classification. If the time-ordered dataset of action types matches the time-ordered sequences of the particular user group, the user may be classified into that user group.