Jian Zu Lin

20190347578, Nov 14, 2019

May 10, 2018

15/976463

- Armonk NY, US
Matthew Elsner - Dunwoody GA, US
Jian Lin - Alpharetta GA, US
Matthew Paul Ouellette - Fredericton, CA
Yun Pan - Roswell GA, US

International Business Machines Corporation - Armonk NY

G06N 99/00
H04L 29/06

A machine learning (ML)-based technique for user behavior analysis that detects when users deviate from expected behavior. A ML model is trained using training data derived from activity data from a first set of users. The model is refined in a computationally-efficient manner by identifying a second set of users that constitute a “watch list.” At a given time, a differential data ingestion operation is then performed to incorporate data for the second set of users into the training data, while also pruning at least a portion of the data set corresponding to data associated with any user included in the first set but not in the second set. These operations update the training data used for the machine learning. The machine learning model is then refined based on the updated training data that incorporates the activity data ingested from the users identified in the watch list.

20190349391, Nov 14, 2019

May 10, 2018

15/975799

- Armonk NY, US
Jian Lin - Alpharetta GA, US
Ronald Williams - Austin TX, US
Ilgen Banu Yuceer - London, GB

International Business Machines Corporation - Armonk NY

H04L 29/06
H04L 29/08
G06K 9/62

A machine learning-based technique for user behavior analysis that detects when users deviate from expected behavior. In this approach, a set of user groups are provided, preferably based on information provided from a user registry. A set of training data for each of the set of user groups is then obtained, preferably by collecting security events generated for a collection of the users over a given time period (e.g., a last thirty (30) days). A machine learning system is then trained using the set of training data to produce a model that includes a set of clusters in user behavior model, wherein a cluster is a learned user group that corresponds to a defined user group. Once the model is built, it is used to identify users that deviate from their expected group behavior. In particular, the system compares a current behavior of a user against the model and flags anomalous behavior. The user behavior analysis may be implemented in a security platform, such as a SIEM.