User Login Anomaly Detection Using Behavior-Based Probability Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing user login systems in cloud-based SaaS services are vulnerable to attacks, such as brute force attacks, leading to compromised authentication and potential network invasions, necessitating improved user-centric and efficient anomaly detection methods.
Innovation Solution
A computer-implemented method for detecting user login anomalies by monitoring successful logins over a period, calculating probability densities and weights for various parameters, and comparing an anomaly score to a threshold, using user-specific bins and weights for TOD, DOW, and GEO parameters.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional login monitoring is used, then security coverage is provided, but detection precision is low due to lack of user-specific adaptation
Solution Approach 1:
The system performs preliminary actions by collecting login data during an observation period before the monitoring period begins. This preliminary data collection enables the calculation of user-specific parameters (mean, standard deviation, bins) that are stored and used during actual anomaly detection, allowing the system to adapt to each user's behavior patterns without adding complexity during real-time monitoring
Solution Approach 2:
The system changes parameters by calculating user-specific statistical parameters (mean login time, standard deviation, custom bins) from collected data and using these dynamic parameters to define anomaly thresholds. Instead of using fixed thresholds, the system adapts parameters like time-of-day bins, day-of-week weights, and geographic location bins based on individual user behavior, thereby improving detection precision while maintaining manageable complexity through automated parameter derivation
2Reliability
If generic anomaly detection thresholds are used, then implementation is simple, but detection accuracy decreases for individual users
Solution Approach 1:
The system applies local quality by implementing user-specific anomaly detection parameters instead of universal thresholds. Each user has customized mean login times, standard deviations, and anomaly thresholds calculated from their individual login patterns. This allows the system to maintain high reliability for each user while the automated parameter calculation process ensures productivity is not significantly compromised
Solution Approach 2:
The system performs self-service by automatically calculating user-specific parameters from collected login data without requiring manual configuration or intervention. The automated process of computing means, standard deviations, and anomaly thresholds from raw login data enables the system to adapt to each user's behavior patterns independently, maintaining both high reliability and operational efficiency
3Measurement precision
If detailed user behavior monitoring is implemented, then anomaly detection capability is improved, but data processing load increases
Solution Approach 1:
The system performs preliminary data processing by calculating user-specific parameters (mean, standard deviation, bins) during an observation period before the monitoring phase begins. This upfront computation reduces the processing load during actual anomaly detection, as the system only needs to compare new logins against pre-calculated thresholds rather than performing complex calculations in real-time
Solution Approach 2:
The system applies partial action by focusing computational resources on calculating only the essential parameters needed for anomaly detection (mean login time, standard deviation, time-of-day bins, day-of-week weights, geographic bins) rather than analyzing every aspect of user behavior. This selective parameter calculation achieves sufficient detection precision while minimizing computational energy consumption
Data Source
AI summary
The invention relates to a method detecting one or more anomalies regarding logins of a user on an authentication system. The method includes at least one iteration of a monitoring phase that includes collecting a log of successful logins of the user on the authentication system, and calculating, for each monitored parameter, a probability density, in the log, of each predetermined value of the parameter. The method also includes calculating, for each parameter, a weight, as a function of the probability density of each predetermined value of the parameter, calculating an anomaly score for the log as a function of the weights and the probability densities; and comparing the anomaly score to a given threshold in order to determine an anomaly in the daily log for the user. The invention also relates to a computer program product and a device configured to carry out the method.