Anomaly-Based Access Request Scoring for Compromised Accounts
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control systems fail to efficiently detect compromised or malicious accounts attempting to gain access to production systems, often leading to blind approvals and reduced security, particularly against insider threats, due to a lack of adaptive and informative decision-making processes.
Innovation Solution
Implementing a machine learning-based anomaly detection system that evaluates access requests using historical patterns and provides an anomaly-based risk score, combined with rule-based analytics, to inform authorized approvers and potentially trigger human review or automatic decisions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional access control systems are used, then operational simplicity is maintained, but security detection capability deteriorates due to inability to identify compromised accounts
Solution Approach 1:
The patent introduces an intermediary anomaly-based risk scoring system that sits between the access requestor and the access control decision. This intermediary layer analyzes access requests using machine learning models to generate risk scores, which then inform the access control decision. This resolves the contradiction by adding detection capability without requiring complete system redesign, as the intermediary works within the existing access control framework.
Solution Approach 2:
The patent replaces traditional rule-based mechanical access control decisions with an anomaly-based risk scoring system using machine learning models. Instead of relying on static permissions and manual approval workflows, the system uses dynamic anomaly detection to assess risk and automatically make access decisions. This substitution improves security detection capability while reducing operational complexity by automating the decision-making process.
2Reliability
If manual approval procedures are used for all access requests, then security control is improved, but productivity deteriorates due to increased administrative overhead
Solution Approach 1:
The patent applies local quality by differentiating access request handling based on anomaly risk scores. Low-risk requests receive automatic approval with minimal intervention, while high-risk requests trigger manual review procedures. This resolves the contradiction by applying security control selectively rather than uniformly, improving productivity for routine requests while maintaining security for suspicious requests.
Solution Approach 2:
The patent changes the parameter of access control from binary (approved/denied) to a continuous risk score spectrum. By using anomaly-based risk scoring, the system can dynamically adjust the level of scrutiny applied to each request based on its risk profile. This enables automatic approval for low-risk requests (improving productivity) while maintaining manual review for high-risk requests (maintaining security control).
3Measurement precision
If anomaly-based risk scoring is implemented, then detection precision is improved, but computational resource consumption increases
Solution Approach 1:
The patent applies partial action by using anomaly-based risk scoring selectively rather than for all access requests. The system first performs lightweight preliminary assessment and only applies full anomaly detection and machine learning analysis to requests that warrant closer scrutiny. This resolves the contradiction by reducing computational resource consumption while maintaining high detection precision for requests that require it.
Solution Approach 2:
The patent implements preliminary action by pre-computing user profiles and access patterns during off-peak times, and by performing initial risk assessment before full anomaly analysis. This preliminary preparation reduces the computational burden during actual access request processing, enabling high detection precision without excessive real-time resource consumption.
Data Source
AI summary
Access to secured items in a computing system is requested instead of being persistent. Access requests may be granted on a just-in-time basis. Anomalous access requests are detected using machine learning models based on historic patterns. Models utilizing conditional probability or collaborative filtering also facilitate the creation of human-understandable explanations of threat assessments. Individual machine learning models are based on historic data of users, peers, cohorts, services, or resources. Models may be weighted, and then aggregated in a subsystem to produce an access request risk score. Scoring principles and conditions utilized in the scoring subsystem may include probabilities, distribution entropies, and data item counts. A feedback loop allows incremental refinement of the subsystem. Anomalous requests that would be automatically approved under a policy may instead face human review, and low threat requests that would have been delayed by human review may instead be approved automatically.