Credential Theft Detection via Segmented Monitoring Modules
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Advanced persistent threats (APTs) pose a significant risk to information security by targeting sensitive credentials, leading to potential data theft and sabotage, with existing systems failing to effectively detect credential theft at early stages of targeted attacks.
Innovation Solution
A system comprising a monitoring module, a corroborating module, and a security module that detects suspicious access to credential stores, gathers primary and corroborating evidence of credential theft, and performs security actions to prevent exfiltration and malicious activities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional security monitoring systems are used to detect credential theft, then system complexity is reduced, but detection precision and reliability are insufficient to identify early-stage targeted attacks
Solution Approach 1:
The detection system is segmented into multiple specialized modules: a credential store monitoring module that detects suspicious access patterns, a module that tracks credential copies throughout the system, and a module that identifies exfiltration attempts. Each module focuses on specific detection tasks, improving overall detection precision without requiring a single complex monolithic system
Solution Approach 2:
The system introduces intermediary detection mechanisms that monitor intermediate states of credential compromise. Instead of only detecting final exfiltration events, the system places monitoring intermediaries at various stages (credential access, copying, propagation) to detect attacks early in the kill chain, enhancing detection precision at multiple points
2Reliability
If comprehensive monitoring of credential stores is implemented to detect all suspicious access, then detection reliability improves, but system performance and productivity deteriorate due to high computational overhead
Solution Approach 1:
The system performs preliminary actions by establishing baseline credential access patterns and monitoring rules before attacks occur. Credential store monitoring is configured in advance to recognize suspicious access characteristics, allowing the system to reliably detect anomalies without requiring intensive real-time analysis of all credential operations
Solution Approach 2:
The system extracts and monitors only the critical attributes of credential access events rather than analyzing complete event data. By focusing on specific indicators of compromise (suspicious access patterns, unusual timing, unauthorized processes), the system maintains high detection reliability while reducing computational overhead and preserving system performance
3Measurement precision
If the system tracks all copies of sensitive credentials throughout the secured computing system, then detection precision improves, but loss of time increases due to extensive tracking requirements
Solution Approach 1:
The tracking system applies local quality by focusing monitoring resources on specific high-risk credential copies and propagation paths rather than uniformly tracking all credentials throughout the system. The system identifies and prioritizes tracking of credentials accessed by suspicious processes or in unusual contexts, improving detection precision while reducing overall tracking time
Solution Approach 2:
The system employs skipping by rapidly processing and filtering credential copy events, rushing through the analysis of large volumes of tracking data to identify only those copies that exhibit suspicious characteristics. This allows comprehensive tracking coverage without excessive time loss, as benign credential propagations are quickly dismissed while suspicious patterns receive detailed analysis
Data Source
AI summary
The disclosed computer-implemented method for detecting credential theft may include (i) monitoring a secured computing system's credential store that may include at least one sensitive credential that may be used to facilitate authentication of a user that is attempting to access the secured computing system, (ii) gathering, while monitoring the credential store, primary evidence of an attempted theft of the sensitive credential from the credential store, (iii) gathering corroborating evidence of the attempted theft of the sensitive credential, and (iv) performing a security action in response to gathering the primary evidence and the corroborating evidence of the attempted theft. The primary evidence of the attempted theft of the sensitive credential may include evidence of any suspicious access of the sensitive credential from the credential store that occurs outside of a procedure of authenticating the user. Various other methods, systems, and computer-readable media are also disclosed.