Anomaly-Based Access Risk Scoring for Adaptive Approval
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control systems fail to efficiently detect compromised or malicious accounts attempting to gain access to production systems, often leading to blind approvals and reduced security, particularly against insider threats, due to a lack of adaptive and efficient security controls.
Innovation Solution
Implementing a hardware and software combination that uses machine learning-based analytics to evaluate access requests, calculating an anomaly-based risk score and presenting it to authorized approvers, along with informed decision-making tools to enhance security controls.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional access control systems are used, then security perimeter protection is maintained, but adaptive detection of compromised accounts and insider threats is insufficient
Solution Approach 1:
The system dynamically adjusts access approval requirements based on real-time risk scores generated by machine learning models. Instead of static access control policies, the system continuously evaluates access requests against historical patterns and adjusts the level of scrutiny accordingly, making security adaptive to current threats while maintaining reliability
Solution Approach 2:
The system changes the parameter of access approval by introducing risk-based scoring that modifies approval requirements. When risk scores indicate potential threats, the system automatically elevates approval requirements from automatic to manual review, thereby enhancing adaptability without compromising overall security
2Reliability
If manual approval procedures are applied to all access requests, then security is enhanced, but authorization fatigue increases and productivity decreases
Solution Approach 1:
The system applies different quality levels of review to different access requests based on their risk profiles. Low-risk requests receive automatic approval with minimal human intervention, while only high-risk requests require manual review. This localized application of security scrutiny maintains security for critical requests while eliminating unnecessary bottlenecks for routine requests
Solution Approach 2:
Instead of applying full manual review to all requests (excessive action), the system applies partial action by using automated risk assessment for routine requests and reserving manual review only for cases where the risk score warrants it. This partial automation maintains security where needed while improving productivity elsewhere
3Measurement precision
If risk-based approval selection is implemented, then detection of suspicious access attempts is improved, but system complexity increases
Solution Approach 1:
The system introduces a machine learning-based risk scoring intermediary that automatically evaluates access requests and generates risk scores. This intermediary component handles the complex analysis of historical patterns and access request characteristics, providing precise detection while shielding the rest of the system from complexity by presenting simple risk score outputs that drive approval decisions
Data Source
AI summary
Access to secured items in a computing system is requested instead of being persistent. Access requests may be granted on a just-in-time basis. Anomalous access requests are detected using machine learning models based on historic patterns. Models utilizing conditional probability or collaborative filtering also facilitate the creation of human-understandable explanations of threat assessments. Individual machine learning models are based on historic data of users, peers, cohorts, services, or resources. Models may be weighted, and then aggregated in a subsystem to produce an access request risk score. Scoring principles and conditions utilized in the scoring subsystem may include probabilities, distribution entropies, and data item counts. A feedback loop allows incremental refinement of the subsystem. Anomalous requests that would be automatically approved under a policy may instead face human review, and low threat requests that would have been delayed by human review may instead be approved automatically.