Network Security Enforcement Engine Detects Compromised Nodes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current User Entity Behavior Analytics (UEBA) techniques face challenges in efficiently detecting compromised nodes due to high false positives, complex data analysis, and the need for substantial training data, which hampers computational speed and reliability in identifying anomalies within enterprise networks.
Innovation Solution
An enforcement engine on a network security device identifies suspicious user behavior by setting thresholds for login failures, new computer connections, and consecutive connection sequences, using metrics like Z-scores, Jaccard indices, and Shannon entropy to classify compromised nodes with minimal parameters and training data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If statistical methods are used to track behavioral changes and determine probabilities for anomaly detection, then detection capability is improved, but false positive rate increases and computational complexity increases
Solution Approach 1:
The patent segments anomaly detection into three distinct behavioral metrics: (1) login failure rate metric comparing actual vs. baseline failure rates, (2) connection rate metric comparing actual vs. baseline connection frequencies, and (3) entropy metric measuring randomness in connection sequences. Each metric is calculated and evaluated independently, then combined to make detection decisions, thereby reducing false positives while maintaining detection accuracy.
2Measurement precision
If profiling is performed for a large number of communication edges to learn normal behavior parameters, then detection accuracy is improved, but data analysis complexity and computational resources increase
Solution Approach 1:
The patent extracts only the essential behavioral characteristics needed for anomaly detection: login failure rates, connection rates, and connection sequence patterns. Instead of profiling all communication edges and their complete interaction histories, the system focuses on these three key metrics per user, dramatically reducing the dimensionality of data analysis while preserving detection accuracy.
Solution Approach 2:
The patent applies different analysis depths to different aspects of user behavior. For login failures, it tracks simple count rates. For connections, it tracks frequency rates. For sequence analysis, it computes entropy metrics. Each metric is tailored to the specific behavioral aspect, optimizing computational efficiency for each type of analysis rather than applying a uniform complex profiling approach to all behaviors.
3Measurement precision
If multiple disparate parameters are combined for anomaly identification, then detection coverage is improved, but false alarms increase
Solution Approach 1:
The patent merges three complementary behavioral metrics into a unified anomaly detection framework. The login failure rate metric detects authentication anomalies, the connection rate metric detects unusual activity frequencies, and the entropy metric detects randomized connection patterns. By combining these metrics with appropriate thresholding and weighting, the system achieves comprehensive detection coverage while reducing false alarms through the complementary nature of the metrics.
Data Source
AI summary
Systems and methods for analyzing user behavior patterns to detect compromised computing devices in an enterprise network are provided. According to one embodiment, an enforcement engine running on a network security device, identifies top users of a network exhibiting a suspicious behavior relating to login failures by determining a first set of users having a number of login failure events during a given time duration exceeding a threshold. The enforcement engine identifies from the first set of computers associated with the top users, a second set of computers exhibiting a suspicious behavior relating to new connections exceeding a threshold. The enforcement engine classifies a third set of computers, representing a subset of the second set exhibiting a suspicious behavior relating to consecutive new connections, as compromised source computers when their respective new connections are in a sequence that results in a Shannon entropy measure exceeding a threshold.