Multi-Level Authentication Anomaly Detection by User Behavior
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional anomaly detection methods are inadequate for identifying specific types of anomalous behavior in user interactions, as they primarily focus on user-level anomalies, failing to track variations in behavior across different authentication levels.
Innovation Solution
Implementing a system that tracks user behavior at multiple authentication levels, building separate usage patterns for each level and identifying anomalous behavior by comparing these patterns, allowing for tailored responses such as account locking or administrator notification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional anomaly detection methods are used, then the detection process is simple, but the detection precision is insufficient for specific types of anomalous behavior
Solution Approach 1:
The patent segments user authentication behavior into multiple authentication levels (e.g., login level, application level, data level). Each level has its own usage patterns and anomaly detection criteria. This segmentation allows the system to detect specific types of anomalous behavior at appropriate granularities, improving detection precision without requiring a completely complex new system.
Solution Approach 2:
The patent introduces authentication level as an additional dimension for analyzing user behavior. Instead of only tracking user-level anomalies, the system now tracks anomalies across multiple authentication dimensions. This dimensional expansion enables more precise detection of specific anomaly types while maintaining a structured approach to complexity.
2Adaptability or versatility
If user behavior is tracked at a single user level, then the tracking process is simple, but the ability to identify specific anomalous behavior is limited
Solution Approach 1:
The tracking system is segmented into multiple authentication level trackers, each monitoring specific behaviors appropriate to that level. For example, login-level tracking monitors authentication attempts, while application-level tracking monitors resource access patterns. This segmentation increases adaptability to different behavior types while keeping each tracker's complexity manageable.
Solution Approach 2:
Each authentication level has its own customized usage patterns and anomaly detection criteria tailored to that level's characteristics. Login levels have different expected patterns than application levels. This local quality approach allows the system to adapt to specific behavior requirements at each level without requiring a completely complex unified tracking system.
Data Source
AI summary
A determination is made to see if a user has authenticated to a computer system using a plurality of authentication levels. For example, the user may have had a first session where the user is authenticated at authentication level one and a second session where the user is authenticated at authentication level two. Behavior of the user is separately tracked at each of the plurality of authentication levels to identify separate usage patterns of the user at each of the plurality of authentication levels. Anomalous behavior of the user is identified based on one or more variations from the separate usage patterns of the user at, at least one of the plurality of authentication levels. An action is taken based on identifying the anomalous behavior of the user. For example, the user's account may be locked, or an administrator may be notified.