Application Identity Compromise Detection With ML and Heuristics
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity measures fail to distinguish between human user accounts and application identity accounts, leading to inadequate security for application identity accounts and potential service degradation due to inappropriate access control measures.
Innovation Solution
Implementing a machine learning model tailored for application identity anomaly detection, combined with heuristic rules, to detect and assess compromises in application identity accounts without blocking access, using features like IP addresses, credential types, and historical usage patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing cybersecurity measures are applied to application identity accounts, then security coverage is improved, but false positives increase and service availability deteriorates
Solution Approach 1:
The patent segments security monitoring into two distinct pathways: one for human user accounts and another for application identity accounts. This segmentation allows the system to apply appropriate security measures to each account type without cross-contamination of security policies, thereby improving security coverage while avoiding false positives that would disrupt service availability.
Solution Approach 2:
The patent implements local quality by applying different security analysis criteria and anomaly detection thresholds specifically tailored to application identity accounts versus human user accounts. This localized approach ensures that security measures are optimized for each account type's characteristics, improving overall security coverage while maintaining service availability for application identities.
2Reliability
If human user account compromise detection methods are applied to application identity accounts, then detection coverage is improved, but service disruption increases
Solution Approach 1:
The patent implements dynamic response strategies that adapt to the account type being monitored. For application identity accounts, the system dynamically adjusts anomaly thresholds and response actions based on the service-critical nature of these accounts, allowing detection coverage to remain high while automatically modulating responses to prevent service disruption.
Solution Approach 2:
The patent changes key detection parameters such as anomaly thresholds, confidence levels, and response triggers specifically for application identity accounts compared to human user accounts. These parameter adjustments enable the system to maintain comprehensive detection coverage while reducing false alarms that would otherwise cause service interruptions.
3Device complexity
If generic anomaly detection is used for all accounts, then implementation simplicity is maintained, but detection accuracy for application identities deteriorates
Solution Approach 1:
The patent segments the anomaly detection system into specialized components: a generic anomaly detection engine that handles overall processing, and account-type-specific analysis modules that provide tailored detection for application identities versus human users. This segmentation maintains implementation simplicity at the system level while achieving high detection accuracy through specialized processing for each account type.
Data Source
AI summary
Some embodiments improve the security of service principals, service accounts, and other application identity accounts by detecting compromise of account credentials. Application identity accounts provide computational services with access to resources, as opposed to human identity accounts which operate on behalf of a particular person. Authentication attempt access data is submitted to a machine learning model which is trained specifically to detect application identity account anomalies. Heuristic rules are applied to the anomaly detection result to reduce false positives, yielding a compromise assessment suitable for access control mechanism usage. Embodiments reflect differences between application identity accounts and human identity accounts, in order to avoid inadvertent service interruptions, improve compromise detection for application identity accounts, and facilitate compromise containment and recovery efforts by focusing on credentials individually. Aspects of familiarity measurement, model feature selection, and a model feature engineering pipeline are also described.