Access Log Analysis for Unauthorized Login Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for detecting unauthorized login attacks, particularly list-based attacks, are ineffective as they rely on counting authentication attempts or failures, leading to a high risk of overlooking such attacks.
Innovation Solution
An analysis apparatus that groups access logs by access source, calculates the similarity of authentication information, and determines the likelihood of a human input based on predetermined criteria to differentiate between human and machine-generated attempts, thereby identifying potential attack sources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional methods count authentication attempts or failures to detect attacks, then detection simplicity is maintained, but detection accuracy deteriorates due to inability to identify list-based attacks
Solution Approach 1:
The patent segments the authentication log analysis into multiple dimensions: grouping logs by access source, calculating similarity of authentication information within groups, and separately evaluating human input probability. This segmentation allows comprehensive attack detection without requiring a single complex detection mechanism, resolving the contradiction between accuracy and complexity.
Solution Approach 2:
The patent introduces a new dimension of analysis by calculating similarity of authentication information (beyond simple count metrics) and evaluating human input probability. This dimensional expansion enables detection of list-based attacks that conventional counting methods miss, improving accuracy while maintaining manageable complexity through modular calculation units.
2Measurement precision
If the system analyzes all authentication logs in detail to improve detection accuracy, then attack detection capability improves, but processing time increases
Solution Approach 1:
The patent divides log processing into independent segments: grouping by access source, similarity calculation within groups, and human input probability evaluation. This segmentation enables parallel processing of different log groups, reducing overall processing time while maintaining comprehensive analysis accuracy for detecting list-based attacks.
Solution Approach 2:
The patent performs preliminary grouping of access logs by access source before detailed analysis. This preliminary action organizes data in advance, allowing subsequent similarity calculations and human input probability evaluations to be performed more efficiently on pre-grouped data, thereby reducing total processing time while maintaining detection accuracy.
Data Source
AI summary
An analysis apparatus analyzes access logs including authentication results and authentication information of users, and includes: a calculation unit that calculates a similarity between pieces of authentication information in two consecutive access logs when access logs of the same access source, from the access logs, are chronologically arranged, and presumes that a piece of authentication information of the access logs of the user has been input by a human if the calculated similarity is equal to or greater than a predetermined value; and a risk determination unit that determines that there is a possibility that the access source in the access logs is being an attack source if an authentication result of any of the two access logs is authentication failure and the calculation unit presumes that any piece of authentication information of the two access logs has not been input by a human.