Network Activity Detection Using Authentication Failure Metrics
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current techniques for detecting suspicious activity in enterprise networks face challenges due to the lack of explicit user-server communication data and high false alarm rates from standard anomaly detection methods, which often fail to identify risky activities effectively.
Innovation Solution
A method that analyzes network event data to determine the number of distinct servers a user communicates with and fails to authenticate to within a predefined time window, assigning a risk score based on these metrics relative to average behavior during a training period, to identify potentially suspicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If standard anomaly detection approaches are used to detect deviations from regular user activity patterns, then detection sensitivity is improved, but false alarm rate increases
Solution Approach 1:
The patent changes the parameters used for detection from general activity patterns to specific metrics: number of distinct servers communicated with and number of distinct servers failed to authenticate to. This parameter transformation allows the system to maintain detection sensitivity while reducing false alarms by focusing on behaviorally significant metrics that better indicate malicious activity.
Solution Approach 2:
The system dynamically adjusts detection thresholds based on user-specific baseline behavior established during a training period. Rather than using static thresholds, the system adapts to each user's normal communication patterns, allowing sensitive detection of anomalies while reducing false alarms from atypical but benign user behavior.
2Measurement precision
If explicit user-server communication data from packet monitoring is collected, then detection accuracy is improved, but data availability decreases
Solution Approach 1:
The patent uses authentication logs as an intermediary data source instead of directly collecting packet monitoring data. These logs provide sufficient information about user-server communications and authentication outcomes without requiring access to the actual network packets, thus maintaining detection accuracy while ensuring data availability from standard enterprise logging infrastructure.
3Measurement precision
If the number of detection metrics is increased to improve detection accuracy, then detection capability is improved, but system complexity increases
Solution Approach 1:
The patent extracts and focuses on two specific metrics from the complex space of possible communication behaviors: (1) number of distinct servers communicated with, and (2) number of distinct servers failed to authenticate to. By selecting only these two most discriminative metrics, the system achieves high detection accuracy while maintaining simplicity in data collection, processing, and analysis.
Data Source
AI summary
Methods and apparatus are provided for detecting suspicious network activity, such as in an enterprise network. An exemplary method comprises obtaining network event data for a plurality of user-server communications for a given user, determining a number of distinct servers the user communicated with during a predefined time window; determining a number of distinct servers the user failed in authenticating to during the predefined time window; and assigning a risk score to the user based on the number of distinct servers the user communicated with and the number of distinct servers the user failed in authenticating to during the predefined time window. Generally, the risk score provides a measure of an anomalousness of the user communicating with the number of servers during the predefined time window. An absolute score is optionally assigned based on an evaluation of the number of distinct servers the user communicated with during the predefined time window relative to a predefined threshold number.