Anomalous Administrative Activity Detection via Dynamic Baseline Profiling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security measures in computer networks are ineffective in detecting new and targeted cyber-attacks that involve the misuse or misappropriation of legitimate administrative privileges, as they rely on predefined signatures and fail to recognize suspicious administrative activities amidst normal patterns.
Innovation Solution
A method and apparatus that track and analyze administrative activities requiring elevated privileges across computers in a network, establishing baseline levels and profiles to identify anomalous combinations, using weights to compute scores and initiate preventive actions when thresholds are exceeded, thereby detecting and inhibiting malicious exploitation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If predefined signature-based security measures are used, then detection of known threats is improved, but detection of new and targeted attacks involving legitimate administrative privileges deteriorates
Solution Approach 1:
The system transitions from static signature-based detection to dynamic behavior analysis. It continuously learns and adapts to normal administrative activity patterns for each user and computer, then detects deviations from these dynamic baselines. This allows the system to identify novel attacks that don't match predefined signatures by recognizing abnormal behavioral patterns in real-time.
Solution Approach 2:
The system implements continuous feedback loops where administrative activities are monitored, analyzed, and used to refine baseline profiles. The detection mechanism provides feedback about anomalous activities, which are then incorporated into updated baselines. This adaptive feedback mechanism enables the system to improve its detection capabilities over time while maintaining reliability for known threats.
2Measurement precision
If comprehensive tracking of all administrative activities is implemented, then detection accuracy is improved, but system complexity and processing overhead increase
Solution Approach 1:
The system extracts and focuses specifically on administrative activities that require elevated privileges, rather than monitoring all system events. By filtering and concentrating only on privileged operations such as login attempts, resource access, and configuration changes, the system achieves high detection accuracy while reducing the complexity of data collection and analysis.
Solution Approach 2:
The monitoring system is segmented into modular components: activity collection modules on individual computers, baseline profile storage, analysis engine, and response mechanisms. Each component handles specific tasks independently, reducing overall system complexity while maintaining comprehensive detection capability through coordinated operation of these specialized segments.
3Reliability
If baseline profiles are established for each computer, then false alarm reduction is improved, but initial setup time and computational resources increase
Solution Approach 1:
The system performs preliminary action by automatically collecting and analyzing administrative activities during an initial baseline establishment period. This preliminary phase runs in the background without requiring manual configuration or user intervention, building accurate baseline profiles that reduce false alarms from the start of formal monitoring.
Solution Approach 2:
The system implements self-service by automatically establishing baselines without requiring manual input or configuration. It autonomously collects activity data, analyzes patterns, and generates baseline profiles for each computer and user, eliminating setup time losses associated with manual configuration while maintaining high reliability in false alarm reduction.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method for monitoring includes defining a plurality of different types of administrative activities in a computer system (20). Each administrative activity in the plurality includes an action performed by one of the computers (22, 24) in the system that can be invoked only by a user having an elevated level of privileges in the system. The administrative activities performed by at least a group of the computers in the system are tracked automatically. Upon detecting that a given computer in the system has performed an anomalous combination of at least two of the different types of administrative activities, an action is initiated to inhibit malicious exploitation of the given computer.