Cumulative Sum Model for IP Deny List Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing complexity of digital communication and computing systems makes them vulnerable to persistent malicious login attempts by bots and human attackers, which can lead to account compromise and system overload, locking legitimate users out of their accounts.
Innovation Solution
A threat detection system that includes sensors and detectors to identify non-genuine login attempts, identifies the origin of illicit requests, and adds the IP address to a system deny list, using a combination of geotargeting machine-learning models and cumulative sum control charts to flag aberrant behavior, and manages a deny list with an aging protocol to dynamically adjust block times.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a deny list is used to block malicious login attempts, then system security is improved, but legitimate users may be falsely blocked (false positives)
Solution Approach 1:
The patent changes the parameter of deny list management from static to dynamic by implementing an aging protocol. IP addresses are assigned time-based weights that decay over time, allowing the system to adapt to changing threat patterns while reducing the impact of outdated threat data, thereby minimizing false positives against legitimate users
Solution Approach 2:
The deny list is made dynamic through continuous updates based on detected login attempts. The system continuously monitors login patterns and adjusts the deny list in real-time, making it adaptive to new threats while automatically expiring old entries to prevent permanent blocking of legitimate users
2Reliability
If the deny list is updated frequently to respond to new threats, then system security is improved, but system performance deteriorates due to processing overhead
Solution Approach 1:
The system applies partial action by not evaluating every login attempt with the full machine learning model. Instead, it uses a two-stage approach: a lightweight filter for obvious cases and the heavier CUSUM model only for suspicious patterns, reducing overall processing overhead while maintaining security
Solution Approach 2:
The system performs preliminary filtering using simple criteria before applying the more computationally intensive CUSUM analysis. This preliminary action eliminates many obvious benign or malicious cases without requiring full model evaluation, improving system performance
3Measurement precision
If machine learning models are used to detect malicious attempts, then detection accuracy is improved, but device complexity increases
Solution Approach 1:
The detection system is segmented into multiple independent components: geotargeting models, CUSUM analysis, and aging protocol. Each component handles a specific aspect of threat detection and can be independently configured, maintained, and optimized, reducing overall system complexity while maintaining high detection accuracy
Data Source
AI summary
In an example aspect, a method includes receiving a plurality of login attempts from a network address over a length of time, querying log data to determine, for the network address, an average number of login failures of the plurality of login attempts over the length of time, calculating a failure rate metric based on the average number of login failures, determining that, the failure rate metric exceeds a reference number of login failures for the length of time, the reference number of login failures based on a historical average number of login failures for the length of time, and based in part on the determining, adding the network address to a system deny list.