Encrypted Traffic Credential Attack Detection Using Statistical Bounds
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security systems are unable to effectively detect credential attacks on computer networks without decrypting network traffic, which compromises security and is inefficient in identifying unauthorized access attempts.
Innovation Solution
A computer-implemented method that aggregates authentication failures from connection attempts by analyzing encrypted packets using a security system, employing a Chebyshev bound and Chernoff bound to determine an upper threshold for authentication failures, thereby generating alerts for potential credential attacks without decrypting the traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If network traffic is decrypted to detect credential attacks, then detection accuracy is improved, but network security is compromised
Solution Approach 1:
The patent uses statistical bounds (Chebyshev and Chernoff) as intermediaries to detect credential attacks without accessing the actual encrypted content. These mathematical bounds serve as a mediator that allows security monitoring while preserving encryption, enabling detection of authentication failure patterns without compromising network security or requiring decryption capabilities
2Object-affected harmful factors
If encrypted packets are analyzed without decryption, then network security is maintained, but detection capability is reduced
Solution Approach 1:
The patent transforms the detection approach by changing from content-based analysis to statistical parameter analysis. Instead of examining packet contents, the system monitors authentication failure counts and their distribution over time, using statistical parameters (mean, variance, bounds) to detect anomalies. This parameter transformation enables effective detection while maintaining encryption
3Reliability
If statistical bounds are used to detect attacks, then false positives are reduced, but computational complexity increases
Solution Approach 1:
The patent applies preliminary action by pre-calculating and storing statistical bounds (Chebyshev and Chernoff bounds) before actual attack detection. These bounds are computed based on historical authentication data and stored for rapid comparison during monitoring. This preliminary preparation reduces real-time computational complexity while maintaining high detection reliability
Data Source
AI summary
Described are techniques including a computer-implemented method of aggregating a number of authentication failures from a plurality of connection attempts for an application or a service that services a plurality of clients, where respective authentication failures are detected by evaluating encrypted packets of the plurality of connection attempts. The method further comprises determining that the number of authentication failures is greater than a upper bound number of authentication failures, where the upper bound number of authentication failures is determined by an anomalous function using the plurality of connection attempts as input, where the anomalous function is defined, at least in part, by a Chebyshev's bound and a Chernoff bound. The method further comprises generating an alert indicating a potential credential attack against the application or the service.