Behavioral Intrusion Detection via Characteristic Models
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional authentication methods for computing devices are vulnerable to unauthorized human and machine intrusions due to security weaknesses, such as compromised user passwords and bypassing of authentication systems through application backdoors or holes.
Innovation Solution
An intrusion detection system (IDS) that continuously monitors and analyzes user behavior to detect malicious activity, using characteristic models generated from behavioral data to differentiate between legitimate and unauthorized users, thereby reducing false positives and false negatives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional authentication methods (passwords, biometrics) are used, then user access control is implemented, but security vulnerabilities exist allowing unauthorized intrusion
Solution Approach 1:
The system performs preliminary behavioral analysis during a training phase to establish baseline characteristics of legitimate users before actual authentication occurs. This preliminary action creates a reference model that enables continuous verification without interrupting user workflow, thereby improving security while maintaining ease of access.
Solution Approach 2:
Instead of one-time authentication, the system implements continuous behavioral monitoring and verification throughout the user session. This continuous action maintains constant security validation, detecting intrusions in real-time while preserving legitimate user access without repeated authentication interruptions.
2Measurement precision
If continuous behavioral monitoring is implemented, then false positives and false negatives are reduced, but system complexity increases
Solution Approach 1:
The system automatically collects behavioral data, trains characteristic models, and performs continuous verification without requiring manual configuration or intervention. This self-service approach handles the complexity internally while presenting a simple interface to users, reducing the perceived system complexity despite sophisticated underlying operations.
Solution Approach 2:
The system transforms complex behavioral data into simplified characteristic parameters and scores that can be efficiently compared against baseline models. By changing the representation of behavioral information into standardized metrics, the system achieves high detection precision while managing computational complexity through parameter transformation.
Data Source
AI summary
A non-transitory computer readable storage medium including instructions that, when executed by a computing system, cause the computing system to perform operations. The operations include collecting, by a processing device, raw data regarding a user action. The operations also include converting, by the processing device, the raw data to characteristic test data (CTD), wherein the CTD represents behavior characteristics of a current user. The operations also include identifying, by the processing device, a characteristic model corresponding to the behavior characteristics represented by the CTD. The operations also include generating, by the processing device, a predictor from a comparison of the CTD against the corresponding characteristic model, wherein the predictor comprises a score indicating a probability that the user action came from an authenticated user.