Anomaly Prediction Model for Post-Authentication Behavior Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud computing platforms face security threats as malicious entities attempt to access valid user accounts to steal data or exploit computing resources, with existing security measures failing to effectively detect and mitigate anomalous post-authentication behavior.
Innovation Solution
The system analyzes audit logs using an anomaly prediction model to generate an anomaly score, determining if post-authentication behavior is anomalous and triggering mitigation actions such as restricting access or removing user identities from the platform-based identity service.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security measures are used to protect cloud accounts, then basic authentication is provided, but anomalous post-authentication behavior cannot be detected
Solution Approach 1:
The system pre-processes and stores user behavior patterns during normal operations, building a baseline of expected actions. When anomalies occur, the pre-established model can quickly compare against stored patterns without requiring complex real-time analysis, thus improving detection reliability while managing system complexity
Solution Approach 2:
An intermediary anomaly prediction model is introduced between the audit log data and the security response system. This model acts as a mediator that translates raw user behavior data into actionable security insights, enhancing detection capability without directly increasing the complexity of the entire security infrastructure
2Speed
If real-time anomaly detection is implemented, then malicious access is detected faster, but system resources are consumed
Solution Approach 1:
The system applies partial analysis by focusing only on specific post-authentication actions that are most indicative of malicious behavior. Rather than analyzing all user actions equally, the model concentrates computational resources on high-risk operations, achieving fast detection of anomalies while reducing overall resource consumption
Solution Approach 2:
The anomaly prediction model dynamically adjusts its analysis parameters based on the specific context and risk level. For low-risk scenarios, minimal analysis is performed to conserve resources, while high-risk triggers activate more intensive detection parameters, balancing detection speed with resource efficiency
3Measurement precision
If comprehensive audit log analysis is performed, then detection accuracy is improved, but processing time increases
Solution Approach 1:
The audit log analysis is segmented into multiple processing stages: initial filtering of low-risk actions, intermediate analysis of suspicious patterns, and deep analysis of high-risk behaviors. This segmentation allows the system to achieve comprehensive detection accuracy for critical anomalies while quickly dismissing benign activities, thereby reducing overall processing time
Data Source
AI summary
Methods, systems, apparatuses, and computer-readable storage mediums described herein are configured to detect anomalous post-authentication behavior with respect to a user identity. For example, one or more audit logs that specify a plurality of actions performed with respect to the user identity of a platform-based identity service, while the user identity is authenticated with the platform-based identity service, are analyzed. The audit log(s) are analyzed via an anomaly prediction model that generates an anomaly score indicating a probability whether a particular sequence of actions of the plurality of actions is indicative of anomalous behavior. A determination is made that an anomalous behavior has occurred based on the anomaly score. In response to determining that anomalous behavior has occurred, a mitigation action may be performed that mitigates the anomalous behavior.