User Authentication Graphs for Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current technologies lack effective methods to differentiate between authorized and unauthorized users in a network and to detect inappropriate behavior by authorized users based on authentication events.
Innovation Solution
The use of Person's Authentication Subgraphs (PAS) and statistical models to analyze user authentication activity, comparing attributes against baseline behavior to identify potentially malicious users and compromised computers, with time-constrained graph analysis to differentiate user types and detect deviations from normal behavior.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If centralized network authentication mechanism is used to manage user accounts across multiple systems, then ease of account management is improved, but ability to detect malicious users and inappropriate behavior is worsened
Solution Approach 1:
The patent segments the authentication data into Person's Authentication Subgraphs (PAS), where each PAS represents an individual user's authentication patterns. This segmentation allows the system to analyze each user's behavior independently while maintaining the benefits of centralized authentication management. The segmentation enables detection of anomalies by comparing individual user patterns against established baselines without requiring changes to the centralized authentication infrastructure.
2Loss of information
If user authentication graphs are constructed from authentication events, then insight into user behavior is improved, but complexity of analyzing and differentiating user types is worsened
Solution Approach 1:
The patent extracts specific behavioral attributes from the complex authentication graphs, such as the set of reachable vertices and distance metrics. By extracting these key features, the system reduces the complexity of analyzing entire authentication graphs while retaining the essential behavioral insights. This extraction approach transforms complex graph data into manageable statistical measures that can be efficiently compared against baseline behavior.
Solution Approach 2:
The patent changes the parameters used for analysis by focusing on specific graph attributes (reachable vertices, distance metrics) rather than analyzing the entire graph structure. This parameter transformation converts complex graph theory problems into statistical comparisons, making the analysis more tractable while preserving the ability to differentiate between authorized users and intruders.
3Measurement precision
If statistical models are used to compare user behavior against baseline, then accuracy in detecting malicious activity is improved, but computational resources required are worsened
Solution Approach 1:
The patent applies partial action by using statistical models only for comparison purposes rather than building complex predictive models. The system computes statistical measures (reachable vertices, distance) and compares them against pre-established baseline behavior. This approach achieves accurate detection of malicious activity by focusing computational resources on comparison rather than model building, reducing overall computational requirements while maintaining high detection accuracy.
Data Source
AI summary
Significant and aggregate user authentication activity may be analyzed across a population of users and computers in one or more networks to differentiate between authorized users and intruders in a network, and/or to detect inappropriate behavior by otherwise authorized users. Dynamic graphs and graph models over user and computer authentication activity, including time-constrained models, may be used for the purposes of profiling and analyzing user behavior in computer networks. More specifically, an edge-based breadth first search of graphs may be used that enforces time-constraints while maintaining traditional breadth first search computational complexity equivalence.