Credential Attack Pattern Detection With Multi-Stage Log Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems struggle to accurately detect malicious network activity indicating the compromising or attempted compromising of insecurely-stored user credentials, leading to high false positives and false negatives, which can result in system vulnerabilities and unnecessary resource wastage.
Innovation Solution
A method and system that detect an initial stage and a subsequent stage of an attack pattern in server activity logs, using specific identifiers and a search window to identify attempts to locate and compromise credentials, followed by automated or manual security responses to mitigate the threat.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional credential compromise detection methods are used, then detection capability is provided, but false positives increase and detection accuracy decreases
Solution Approach 1:
The attack detection is segmented into multiple distinct stages (initial stage with first identifiers, subsequent stage with second identifiers). Each stage is detected independently using specific identifiers, allowing the system to distinguish between different phases of credential compromise attempts and reduce false positives by requiring multi-stage pattern matching.
Solution Approach 2:
The system performs preliminary detection of the initial stage of attack patterns before the credential is fully compromised. By detecting early-stage identifiers and initiating investigation beforehand, the system can identify potential threats earlier and take preventive actions, improving overall detection accuracy and reducing false positives through proactive monitoring.
2Reliability
If comprehensive monitoring of all credential access attempts is implemented, then detection capability improves, but system resource consumption increases
Solution Approach 1:
The system implements partial monitoring by focusing only on specific identifiers and attack patterns rather than monitoring all credential access attempts. By detecting only the particular first and second identifiers associated with credential compromise, the system achieves effective detection capability while consuming fewer computational resources compared to comprehensive monitoring of all system activities.
3Loss of time
If rapid detection of credential compromise is achieved, then mitigation time is reduced, but detection complexity increases
Solution Approach 1:
The detection system is segmented into distinct stages with specific identifiers for each stage. This segmentation allows the system to process and detect attacks in a structured manner, reducing the time required for analysis by breaking down complex attack patterns into manageable stages rather than analyzing all activities simultaneously, thus balancing rapid detection with controlled complexity.
Data Source
AI summary
Software attacks directed to compromising an insecurely-stored credential on a device may be detected and mitigated by detection of each of an initial stage and a subsequent stage through identifiers within an activity log of the device. Detection of an initial identifier indicating a possible attempt to locate an insecurely-stored credential indicates an occurrence of the initial stage. Detection, within a search window commencing upon detection of the initial stage, of a subsequent identifier indicating a possible attempt to determine context for the insecurely-stored credential indicates an occurrence of the subsequent stage. Responsive to detection of the initial stage and the subsequent stage, a response target associated with the detected identifiers is identified, and a security response associated with the response target is performed to thereby mitigate exploitation of the insecurely-stored credential.