Brute Force Attack Detection Using Adaptive Mixture Models
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Brute force attacks are difficult to detect accurately, often generating a high number of false positives and false negatives due to their transient nature and reliance on thresholding operational parameter values, which can be misleading.
Innovation Solution
A mixture model is used to dynamically update distribution parameters based on observed operational parameter values, employing a finite mixture of distributions to compare time series and reduce false positives while accurately detecting real attacks by analyzing multiple contextually relevant signals, including timing, type, and count of unsuccessful login attempts, and network connections.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If thresholding operational parameter values is used to detect brute force attacks, then detection simplicity is improved, but detection accuracy deteriorates due to high false positives and false negatives
Solution Approach 1:
The patent transforms the detection approach from using fixed threshold values to using dynamic statistical parameters (mean and standard deviation) calculated from historical baseline data. This allows the detection system to adapt to normal variations in login patterns while still identifying anomalous brute force attacks, thereby improving detection accuracy without sacrificing operational simplicity.
Solution Approach 2:
The system implements feedback by continuously updating the baseline statistical parameters based on observed operational data. The mean and standard deviation are recalculated periodically to reflect changing normal patterns, enabling the system to distinguish between legitimate variations and actual attacks more accurately over time.
2Measurement precision
If multiple contextually relevant signals are analyzed, then detection precision is improved, but system complexity increases
Solution Approach 1:
The patent segments the analysis into distinct components: baseline establishment phase and real-time detection phase. Each phase processes specific signals (timing, type, count of unsuccessful logins, network connections) using appropriate statistical methods, reducing overall system complexity while maintaining high detection precision through targeted analysis of each signal type.
Solution Approach 2:
The system employs a universal statistical framework (z-score calculation based on mean and standard deviation) that can be applied uniformly across multiple different signal types. This multi-functional approach allows the same detection mechanism to evaluate timing patterns, login types, connection counts, and other signals without requiring separate complex analysis for each, thereby improving precision without proportionally increasing complexity.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
The disclosed embodiments determine a plurality of anomaly indications for a plurality of corresponding time series. A multi-modal model is defined for each time series. A first distribution is compared against a time series when the time series values fall within a first range and a second distribution is compared against the time series when the time series values fall with a second range. Based on the comparison, an indication of anomaly is generated for the time series. The indicators of anomaly for each time series are then combined using Fishers method in some embodiments. The resulting combined anomaly indication is used to determine whether a network is experiencing a brute force attack.