Balanced Authentication Event Models for Lateral Movement Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional security mechanisms fail to detect unauthorized use of stolen credentials, allowing lateral movement within networks, as they cannot distinguish between authorized and unauthorized authentication events.
Innovation Solution
A machine-learning based approach is used to train a classifier to differentiate between benign and unauthorized authentication events by balancing skewed training data sets and applying features extracted from event contexts to determine if an authentication event is unauthorized, employing a lateral movement detection system that includes a classifier and a detection engine.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security mechanisms are used to monitor authentication events, then the system is simple and easy to operate, but it cannot detect unauthorized use of stolen credentials
Solution Approach 1:
The patent replaces traditional rule-based security mechanisms with a machine learning-based detection system. A classifier trained on authentication event features automatically identifies unauthorized authentication events, substituting mechanical detection rules with intelligent algorithms that can detect complex patterns of credential theft and lateral movement.
Solution Approach 2:
The patent introduces a machine learning classifier as an intermediary between raw authentication events and security decisions. The classifier processes authentication event features and provides probabilistic assessments of unauthorized events, acting as a mediator that translates complex behavioral patterns into actionable security intelligence.
2Reliability
If machine learning classifiers are trained on skewed authentication data, then the system can learn from real-world data distribution, but the classifier becomes biased toward the majority class and fails to detect minority unauthorized events
Solution Approach 1:
The patent deliberately introduces asymmetry into the training process by applying different sampling strategies to majority and minority classes. Oversampling techniques replicate minority class examples while undersampling techniques reduce majority class examples, creating a balanced training set that counteracts the natural asymmetry in authentication data and enables the classifier to detect rare unauthorized events effectively.
Solution Approach 2:
The patent modifies the distribution parameters of the training data by applying oversampling and undersampling techniques. These parameter changes transform the class distribution from highly skewed to balanced, allowing the classifier to learn equivalent decision boundaries for both authorized and unauthorized authentication events without being biased toward the majority class.
3Reliability
If authentication events are monitored without contextual information, then the processing is fast and simple, but the system cannot distinguish between legitimate and malicious authentication patterns
Solution Approach 1:
The patent segments authentication event analysis into distinct feature dimensions including temporal patterns, source/destination information, authentication methods, and user behavior characteristics. By dividing the complex authentication event into multiple extractable features, the system can process each dimension separately and combine them for comprehensive unauthorized event detection.
Solution Approach 2:
The patent transforms one-dimensional authentication event data into multi-dimensional feature space by extracting temporal, spatial, and behavioral dimensions. This dimensional expansion allows the machine learning classifier to detect unauthorized events by analyzing patterns across multiple dimensions simultaneously, distinguishing legitimate from malicious authentication through holistic pattern recognition.
Data Source
AI summary
In some examples, a system balances a number of positive data points and a number of negative data points, to produce a balanced training data set, where the positive data points comprise features associated with authentication events that are positive with respect to an unauthorized classification, and the negative data points comprise features associated with authentication events that are negative with respect to the unauthorized classification. The system trains a plurality of models using the balanced training data set, wherein the plurality of models are trained according to respective different machine learning techniques. The system selects a model from the trained plurality of models based on relative performance of the plurality of models.