Authentication Anomaly Detection for Low-Volume Cyberattacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional techniques for detecting cyberattacks in computing environments using authentication protocols, such as Kerberos, fail to identify attacks that utilize a low number of requests, leading to false positives and inadequate security.
Innovation Solution
A cyberattack detection system that monitors user activity patterns and compares them against a user's historical access profile to identify anomalies, allowing detection of attacks that deviate from the user's typical behavior, even if they involve a low number of requests.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional techniques are used to detect cyberattacks by monitoring authentication requests, then the system can identify attacks with high request volumes, but it fails to detect attacks with low request volumes and generates false positives
Solution Approach 1:
The system changes the detection parameter from request volume threshold to request pattern analysis. Instead of counting the number of requests, the system analyzes the pattern of requests (timing, sequence, target services) and compares it against the user's historical profile to detect anomalies, thereby detecting attacks regardless of request volume.
Solution Approach 2:
The system replaces the mechanical counting approach (request volume threshold) with a behavioral analysis approach. The authentication system monitors and compares request patterns against learned user behavior models, substituting simple quantity measurement with complex pattern recognition to improve detection accuracy.
2Reliability
If the system monitors all user activity to detect anomalies, then attack detection capability improves, but system complexity and computational overhead increase
Solution Approach 1:
The system performs preliminary action by pre-establishing user activity profiles during a learning period before actual attack detection is needed. During this baseline period, the system collects and analyzes normal user behavior patterns and stores them as reference profiles, enabling rapid anomaly detection without requiring complex real-time analysis of all user activity.
Solution Approach 2:
The system creates a copy of normal user behavior patterns in the form of activity profiles. Instead of analyzing every user action in real-time against complex rules, the system compares current activity against pre-stored profiles that represent normal behavior, simplifying the detection process while maintaining high reliability.
Data Source
AI summary
Some embodiments provide techniques for detecting cyberattacks against a software service authentication system that authorizes access to software services. The techniques access a user activity profile specifying values of parameters indicating the user's pattern of requesting access to unique software service(s). The techniques monitor the activity of the user over a time period to obtain software request data indicating request(s) by the user to access software services in the time period. The techniques determine, using the software service request data and the user activity profile, whether computing activity of the user during the time period is anomalous.