Access Token Security Using Cluster-Based Malicious Intent Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access token-based authentication systems in cloud resources are vulnerable to malicious operations, with detection of such activities often occurring after substantial harm has been done, and manual intervention is required, leading to inefficiencies and resource wastage.
Innovation Solution
Cluster access requests based on requestor types and access tokens to identify malicious intent, performing security actions such as preventing unauthorized access or alerting administrators, using machine learning and classifiers to analyze access behaviors and predict likelihoods of actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access tokens are used to provide flexibility and security, then authentication capability is improved, but vulnerability to malicious operations increases
Solution Approach 1:
The system performs preliminary actions by clustering access requests into groups based on requestor types and access tokens before malicious operations occur. It predicts likelihoods of actions and identifies potential malicious intent in advance, enabling preventive security measures rather than reactive responses.
Solution Approach 2:
The patent introduces an intermediary security system that sits between the access token authentication mechanism and the cloud resources. This intermediary analyzes access requests, clusters them by requestor type and token, predicts action likelihoods, and mediates whether to grant or block access, thereby adding a security layer without compromising the flexibility of access tokens.
2Measurement precision
If manual intervention is required for security detection, then accuracy of malicious operation detection is improved, but response time and resource consumption increase
Solution Approach 1:
The security system performs self-service by automatically clustering access requests, predicting action likelihoods, and identifying malicious intent without requiring manual intervention. The system uses machine learning models to autonomously analyze access patterns and detect anomalies, enabling real-time response while maintaining high detection accuracy.
Solution Approach 2:
The patent replaces manual security analysis with automated machine learning mechanisms. Instead of human operators manually reviewing access requests, the system uses computational models to cluster requests by requestor type and access token, calculate likelihoods of actions, and automatically identify malicious operations, thereby eliminating manual intervention delays.
3Measurement precision
If access behavior analysis is performed manually, then depth of security analysis is improved, but processing efficiency decreases
Solution Approach 1:
The system substitutes manual security analysis with automated machine learning processing. It uses computational algorithms to cluster access requests by requestor type and access token, calculate likelihoods of actions, and perform deep security analysis at scale, thereby achieving both deep analysis and high processing efficiency simultaneously.
Solution Approach 2:
The patent changes the parameters of security analysis from manual inspection to automated computational analysis. It processes multiple access requests simultaneously by clustering them into groups, calculating aggregate likelihoods, and identifying patterns that would be impossible to detect manually, thereby dramatically improving processing efficiency while maintaining or enhancing analysis depth.
Data Source
AI summary
Techniques are described herein that are capable of performing a security action regarding an access request using a cluster-based determination of malicious intent. Subsets of access requests are clustered into respective clusters, which correspond to respective requestor types, based at least on the access requests in the subsets having respective attributes that indicate the respective requestor types. A determination is made that a received access request, which is associated with a designated requestor type, is malicious based at least on a relationship between an access action, which is requested by the received access request using an access token, and an access behavior associated with a group of access requests in a designated cluster that use the access token. As a result of determining that the received access request is malicious, a security action is performed with regard to the received access request.