Behavioral Analytics for Real-Time Credential Compromise Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems are inadequate in detecting compromised authentication credentials in real-time, allowing attackers to cause significant harm within compromised networks.
Innovation Solution
Implementing a risk assessment engine that performs real-time behavioral analytics during user authentication, comparing current authentication features with historical data to generate a match score, which is discretized into risk levels based on empirical probabilities of compromise, enabling granular decision-making on user access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If traditional offline detection methods are used to identify compromised credentials, then detection thoroughness can be maintained, but detection speed is too slow (mean time of 197 days)
Solution Approach 1:
The system performs preliminary actions by continuously collecting and analyzing authentication features in real-time before compromise detection is needed. Behavioral baselines are established through ongoing analysis of authentication patterns, device information, location data, and other features, enabling rapid anomaly detection when compromise occurs without requiring lengthy offline investigations
Solution Approach 2:
The patent replaces traditional mechanical offline detection processes with an automated electronic system that continuously monitors authentication events. Machine learning models and algorithms automatically analyze authentication features and detect compromises in real-time, eliminating the need for manual forensic analysis and significantly reducing detection time from 197 days to near-real-time
2Speed
If real-time behavioral analytics are implemented during authentication, then detection speed improves to real-time, but system complexity increases
Solution Approach 1:
The system segments the authentication monitoring function into distinct analytical components that evaluate specific feature types independently. Different authentication features (device information, location, authentication method, behavioral patterns) are analyzed separately by specialized modules, allowing parallel processing and reducing overall system complexity while maintaining real-time detection capability
Solution Approach 2:
The patent introduces an intermediary risk assessment engine that sits between the authentication system and the user access decision. This intermediary component consolidates complex behavioral analytics and presents simplified risk levels to the authentication system, managing complexity by acting as a buffer that translates detailed analytical data into actionable risk assessments
3Measurement precision
If continuous monitoring of authentication features is performed, then detection accuracy improves, but computational resources and processing time increase
Solution Approach 1:
The system applies partial monitoring by focusing computational resources on the most critical authentication features and anomaly indicators. Rather than analyzing every authentication detail with equal depth, the system prioritizes analysis of high-risk features and only intensifies monitoring when anomalies are detected, reducing overall computational resource usage while maintaining high detection accuracy
Solution Approach 2:
The patent dynamically changes monitoring parameters based on risk context. The system adjusts the depth and intensity of feature analysis according to the assessed risk level, user behavior patterns, and authentication context. When low risk is detected, monitoring parameters are reduced to conserve resources; when anomalies occur, parameters increase to enhance detection accuracy
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Methods, systems, and computer program products are provided for real-time compromise detection based on behavioral analytics. The detection runs in real-time, during user authentication, for example, with respect to a resource. The probability that the authentication is coming from a compromised account is assessed. The features of the current authentication are compared with the features from past authentications of the user. After comparison, a match score is generated. The match score is indicative of the similarity of the authentication to the user's history of authentication. This score is then discretized into risk levels based on the empirical probability of compromise based on known past compromised user authentications. The risk levels may be used to detect whether user authentication is occurring via compromised credentials.