API Security via ML Anomaly Detection and Obfuscated Databases
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional monitoring systems are ineffective in detecting fraudulent access to remote systems, particularly when attackers have breached the security perimeter and possess trusted credentials, as they cannot inspect encrypted data or access cryptographic keys, allowing attackers to bypass security measures and disrupt or extract sensitive information.
Innovation Solution
A method and system using a database server that employs machine learning models to analyze access sequences and anomaly scores, preventing access if the score exceeds a threshold, and utilizing obfuscated and deep databases to force attackers to perform more reconnaissance, making them more detectable.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional monitoring systems are used to detect attacks, then system simplicity is maintained, but detection capability against insider attacks and encrypted data extraction is insufficient
Solution Approach 1:
The patent introduces an intermediary component that sits between the monitoring system and the cryptographic key management. This intermediary captures and analyzes access patterns to cryptographic keys without requiring direct access to the keys themselves, thereby improving detection capability while maintaining system simplicity through a non-intrusive monitoring approach
Solution Approach 2:
The patent replaces traditional mechanical/security-based monitoring approaches with behavioral analysis and pattern recognition systems. By monitoring access sequences, timing patterns, and query behaviors rather than relying on cryptographic inspection, the system achieves superior detection capability without increasing structural complexity
2Reliability
If cryptographic keys are stored securely in databases, then data protection is improved, but attackers can still extract keys to decrypt stolen data
Solution Approach 1:
The patent implements preliminary detection and prevention measures by monitoring access patterns before key extraction can occur. The system establishes baseline behaviors and detects anomalies in advance, preventing attackers from successfully extracting cryptographic keys even when they have breached the perimeter
Solution Approach 2:
The patent implements a feedback mechanism where access patterns to cryptographic keys are continuously monitored and analyzed. When suspicious patterns are detected, the system can alert administrators or automatically block access, creating a closed-loop security system that actively responds to threats rather than passively storing keys
3Productivity
If trusted credentials are provided to internal systems, then operational efficiency is improved, but insider attacks become more effective
Solution Approach 1:
The patent applies local quality by implementing different monitoring strategies for different access patterns. High-privilege access to cryptographic keys receives enhanced monitoring and stricter anomaly detection thresholds, while routine operations maintain normal efficiency. This localized approach protects against insider attacks without degrading overall operational efficiency
4Reliability
If deep and obfuscated databases are used to force attackers to perform reconnaissance, then detection opportunity is improved, but system complexity and access time increase
Solution Approach 1:
The patent segments the database structure into multiple hierarchical levels with progressive obfuscation. Frequently accessed data and cryptographic keys are placed in clearly defined segments with monitored access patterns, while less critical data uses deeper obfuscation. This segmentation provides detection opportunities for attackers while minimizing impact on legitimate access times
Data Source
AI summary
A method and system for protecting access to remote systems, such as resource databases containing sensitive resources, such as cryptographic keys or personally identifying information, is disclosed. A server can receive a plurality of access requests from a requesting entity. The server can identify an entity profile corresponding to the access requests, as well as a machine learning model corresponding to the entity profile. The access requests can be used to form access sequences, which can be evaluated by the machine learning model. The machine learning model returns an anomaly score that can be compared to a threshold. If the anomaly score exceeds the threshold, the server can prevent further access to the remote system, for example, by revoking a credential associated with the requesting entity.