User Profile Analytics for Malicious Activity Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data processing system security solutions rely on manually crafted rules and unsupervised machine learning, which struggle to detect unknown or unanticipated malicious attacks, leading to high false positive rates, slow detection, and inability to scale for large volumes of data.
Innovation Solution
A computer-implemented method that generates a user profile based on static and dynamic information, applying analytics to score user activity and generate an aggregate risk score, sending alerts for malicious activity exceeding a threshold, and utilizing semi-supervised machine learning to reduce false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If manually crafted rules and unsupervised machine learning are used for security detection, then the system can operate with simple implementation, but the detection accuracy decreases and false positive rate increases
Solution Approach 1:
The patent combines multiple detection approaches (rule-based systems, unsupervised machine learning, and semi-supervised machine learning) into a unified security detection system. This integration allows the system to leverage the simplicity of rule-based methods while incorporating the adaptive capabilities of machine learning to improve detection accuracy and reduce false positives.
Solution Approach 2:
The system transitions from static rule-based detection to dynamic machine learning-based detection. The semi-supervised learning component continuously adapts to new attack patterns by learning from labeled and unlabeled data, enabling the system to evolve its detection capabilities over time while maintaining operational simplicity through automated learning processes.
2Device complexity
If traditional security detection methods are used, then the system structure remains simple, but the system cannot scale to handle large volumes of data
Solution Approach 1:
The patent replaces traditional mechanical rule-based processing with machine learning-based processing. The semi-supervised learning system automatically processes large volumes of security data by learning patterns from data rather than relying on manually configured rules, enabling scalable processing of big data while maintaining a relatively simple system architecture through automated learning.
3Adaptability or versatility
If unsupervised machine learning is used for anomaly detection, then the system can detect unknown attacks, but the false positive rate increases and detection speed decreases
Solution Approach 1:
The patent implements a feedback mechanism where the semi-supervised learning system receives feedback from both labeled and unlabeled data. The system uses labeled data to verify detection accuracy and unlabeled data to identify potential false positives, creating a feedback loop that continuously refines detection accuracy and reduces false positive rates while maintaining the ability to detect unknown attacks.
4Measurement precision
If comprehensive user profiling with multiple analytics is applied, then the detection accuracy improves, but the processing time increases
Solution Approach 1:
The patent applies preliminary action by pre-processing user activity data and pre-computing baseline behaviors before actual security detection occurs. The system establishes user profiles and normal behavior patterns in advance, allowing the semi-supervised learning system to quickly compare actual activities against pre-established baselines during detection, thereby maintaining high detection accuracy while reducing real-time processing time.
Data Source
AI summary
Detecting malicious user activity is provided. A profile for a user that accesses a set of protected assets is generated based on static information representing an organizational view and associated attributes corresponding to the user and based on dynamic information representing observable actions made by the user. A plurality of analytics is applied on the profile corresponding to the user to generate an aggregate risk score for the user accessing the set of protected assets based on applying the plurality of analytics on the profile of the user. A malicious user activity alert is generated in response to the aggregate risk score for the user accessing the set of protected assets being greater than an alert threshold value. The malicious user activity alert is sent to an analyst for feedback.