Network Authentication Anomaly Detection with Temporal Graphs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Anomaly-based intrusion detection systems in cybersecurity suffer from high false positive rates due to insufficient exposure to temporal patterns and reliance on sub-optimal negative sampling protocols, leading to misclassification of legitimate authentication events as malicious.
Innovation Solution
Anomaly detection framework utilizing both graph snapshots and link streams, combined with a filtered rewiring negative sampling technique, to generate high-quality training instances and capture behavioral heterogeneity, reducing false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If anomaly-based intrusion detection systems use traditional detection methods, then they can detect malicious activity, but they produce high false positive rates due to insufficient exposure to temporal patterns and sub-optimal negative sampling
Solution Approach 1:
The system performs preliminary actions by generating synthetic negative authentication events through filtered rewiring before actual detection occurs. This pre-training with artificially constructed negative samples (authentication events that appear malicious but are actually legitimate) prepares the model to better distinguish true anomalies, thereby reducing false positives while maintaining detection capability
Solution Approach 2:
The system adds a temporal dimension to traditional anomaly detection by incorporating time-series analysis of authentication patterns. By examining authentication events across multiple time points and using temporal graph neural networks, the system captures behavioral heterogeneity and temporal dependencies that single-point detection methods miss, improving reliability without increasing false positives
2Ease of manufacture
If the system uses sub-optimal negative sampling protocols, then training is simpler, but model performance deteriorates due to misclassification of legitimate events as malicious
Solution Approach 1:
The system introduces an intermediary mechanism called filtered rewiring that acts as a bridge between simple random sampling and complex manual labeling. This intermediary process automatically generates high-quality negative samples by rewiring authentication graphs while applying filters to ensure temporal consistency and behavioral plausibility, achieving both training simplicity and model performance
Solution Approach 2:
The system creates copies of legitimate authentication events and modifies them through filtered rewiring to generate synthetic negative samples. By copying real authentication patterns and introducing controlled variations, the system produces training data that maintains the statistical properties of legitimate events while providing clear negative labels for model training
Data Source
AI summary
This patent relates to determining whether network authentication events are legitimate or malicious. One example includes receiving network data relating to past timestamped authentication events between network users and network devices and extracting graphical features from the timestamped authentication events. The example also includes extracting temporal features from the timestamped authentication events and training a temporal graph authentication anomaly detection model with both the extracted graphical features and the extracted temporal features.