ML Authentication Event Classifier for Lateral Movement Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional security mechanisms fail to detect unauthorized lateral movement within networks, as they cannot distinguish between authorized and unauthorized use of credentials, allowing malicious entities to access sensitive information.
Innovation Solution
A machine-learning based approach is employed to identify and distinguish unauthorized authentication events from benign ones by training a classifier using a dataset of features extracted from event data, enabling the detection of lateral movement and subsequent action to prevent unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security mechanisms are used to authenticate users, then authentication can be performed, but unauthorized lateral movement cannot be detected
Solution Approach 1:
The patent introduces an intermediary detection system that sits between authentication mechanisms and network traffic analysis. This intermediary component collects authentication event data, extracts features, and feeds them to machine learning classifiers to detect lateral movement patterns, thereby adding detection capability without requiring fundamental changes to existing authentication infrastructure
Solution Approach 2:
The patent replaces traditional mechanical security mechanisms (firewalls, intrusion detection systems) with a machine learning-based detection approach. The system uses trained classifiers that analyze authentication event patterns to detect unauthorized lateral movement, substituting conventional rule-based detection with intelligent pattern recognition
2Measurement precision
If machine learning classifiers are trained to detect unauthorized authentication events, then detection accuracy improves, but training time and computational resources increase
Solution Approach 1:
The patent performs preliminary training of machine learning classifiers during system setup or periodic updates. The system pre-trains models on historical authentication data to recognize patterns of unauthorized lateral movement, so that when actual detection is needed, the trained models can quickly classify new authentication events without requiring real-time training
Solution Approach 2:
The patent dynamically adjusts training parameters and model complexity based on the specific detection task requirements. The system selects appropriate feature sets, adjusts classification thresholds, and optimizes model parameters to achieve high detection accuracy while minimizing training time and computational resource consumption
3Reliability
If features are extracted from authentication event data to train classifiers, then detection capability improves, but data processing complexity increases
Solution Approach 1:
The patent extracts relevant features from authentication event data by identifying and isolating key parameters such as source IP addresses, destination IP addresses, authentication methods, and temporal patterns. This extraction process filters out irrelevant information and focuses the machine learning models on the most discriminative features for detecting lateral movement
Solution Approach 2:
The patent segments authentication event data into distinct feature categories (e.g., network connectivity features, authentication parameters, temporal patterns). This segmentation allows the system to process and analyze different aspects of authentication events independently, reducing overall data processing complexity while maintaining comprehensive detection capability
Data Source
AI summary
In some examples, for a given authentication event between a plurality of devices in a network, a system identifies a set of events, at the devices, that are temporally related to the given authentication event. The system applies a classifier on a collection of features associated with the set of events, and determines, based on an output of the classifier, whether the given authentication event is an unauthorized authentication event.