Dormant Account Identifier Using Peer Activity Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Dormant user accounts in enterprise computer networks pose a security risk as they can be exploited by threat actors for accessing sensitive information, often due to miscommunication or delay in account closure procedures.
Innovation Solution
A dormant account identifier system that determines inactive accounts based on their last use date and peer account activity, deprovisioning them and searching for suspicious activities to enhance security posture by identifying and removing dormant accounts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If dormant account identification is based solely on inactivity threshold, then the system is simple to implement, but it generates false positives and reduces accuracy
Solution Approach 1:
The patent segments the account identification process into multiple stages: first identifying inactive accounts based on inactivity threshold, then further analyzing peer account activity to distinguish truly dormant accounts from those with legitimate inactivity. This segmentation allows the system to maintain simplicity in the first stage while adding complexity only where necessary to improve accuracy.
Solution Approach 2:
The patent introduces peer account activity as an intermediary factor to mediate between the inactive account status and the final dormant account determination. By considering the activity patterns of peer accounts (accounts with similar characteristics or roles), the system can accurately distinguish between accounts that are truly dormant and those that are temporarily inactive but still active peers.
2Measurement precision
If the system monitors all account activities to determine dormancy, then identification accuracy improves, but system resources and processing time increase
Solution Approach 1:
The patent applies partial action by not requiring complete monitoring of all account activities. Instead, it monitors only the inactivity status of the target account and the activity patterns of peer accounts, which provides sufficient information to accurately identify dormant accounts without the need to track every single account action in detail, thus reducing processing time and resource consumption.
Solution Approach 2:
The patent changes the parameters from monitoring all account activities to monitoring specific parameters: inactivity duration threshold and peer account activity frequency. This parameter transformation allows the system to maintain high detection precision while significantly reducing the computational burden and time required for verification.
3Reliability
If the system deprovisions accounts quickly, then security is improved, but the risk of closing active accounts increases
Solution Approach 1:
The patent implements feedback mechanisms by continuously monitoring peer account activity and using this information to validate the dormant status determination before deprovisioning. This feedback loop ensures that accounts are only deprovisioned when truly dormant, preventing premature closure of active accounts while maintaining strong security posture.
Solution Approach 2:
The patent applies preliminary action by first identifying inactive accounts and then performing a preliminary verification step by analyzing peer account activity before final deprovisioning. This preliminary action filters out false positives and ensures that only truly dormant accounts are deprovisioned, maintaining both security and accuracy.
Data Source
AI summary
A dormant account identifier is disclosed. An inactive account can be determined based on whether a user activity of the account is outside a threshold amount. A determination can be made as to whether the inactive account is a dormant account based on account activity of a peer account to the inactive account.