Login Anomaly Detection Using Autoencoder-Classifier Models
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing identity attack detection systems fail to accurately identify suspicious login requests in real-time due to dynamic nature of IAM data, resource-intensive training, and limitations of existing anomaly detection algorithms, leading to potential unauthorized access and data breaches.
Innovation Solution
A real-time anomaly detection system using machine learning (ML) to identify suspicious login requests, employing customer-specific and global models, an ensemble of autoencoders and classifiers, and queue-based feature extraction to learn normal and suspicious login behaviors, enabling real-time remedial actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing anomaly detection algorithms are used to identify suspicious login requests, then detection capability is provided, but accuracy is insufficient and resource consumption is high
Solution Approach 1:
The detection system is divided into two specialized models: an autoencoder model that learns normal login behavior patterns and a classifier model that identifies anomalous patterns. This segmentation allows each model to specialize in specific aspects of anomaly detection, improving overall accuracy while optimizing resource usage by avoiding a single resource-intensive comprehensive model.
Solution Approach 2:
The autoencoder model performs preliminary learning of normal login behaviors before the classifier model is applied. By pre-training the autoencoder on legitimate login patterns, the system establishes a baseline of normal behavior that reduces the computational burden on the classifier, thereby lowering overall resource consumption while maintaining high detection accuracy.
2Loss of time
If real-time detection is implemented to prevent unauthorized access, then response time is reduced, but system complexity increases
Solution Approach 1:
The autoencoder serves as an intermediary component between raw login data and the final classification decision. It transforms input login sequences into encoded representations that capture normal behavior patterns, which then feed into the simpler classifier model. This intermediary structure enables real-time processing by breaking down the complex detection task into manageable stages.
Solution Approach 2:
The system replaces traditional rule-based mechanical detection mechanisms with machine learning models that automatically learn and adapt to login patterns. The autoencoder and classifier models substitute complex manual rule configurations with adaptive computational structures, reducing system complexity while enabling real-time detection through automated pattern recognition.
3Measurement precision
If customer-specific models are trained to improve detection accuracy, then identification precision increases, but training resources increase
Solution Approach 1:
The system applies partial training action by using the autoencoder model to learn general normal login patterns that can be shared across multiple customers, while only the classifier model requires customer-specific training. This partial customization approach achieves sufficient identification precision for each customer without requiring complete retraining of all model components, thereby reducing overall training resource consumption.
Data Source
AI summary
According to one embodiment, a method, computer system, and computer program product for anomaly detection is provided. The embodiment may include receiving login event data of a customer. The embodiment may include labeling each login request of the event data as non-anomalous or anomalous. The embodiment may include performing aggregate feature extraction for each login request. The embodiment may include filtering data of anomalous login requests from data of non-anomalous login requests. The embodiment may include training an autoencoder machine learning model using the data of non-anomalous login requests to learn non-anomalous login request behavior. The embodiment may include passing the data of anomalous login requests through the trained autoencoder ML model to obtain enriched data. The embodiment may include training a classifier model using the enriched data to identify anomalous login requests and output a classification with confidence value.