Privileged Access Fraud Detection via Contextual Feature Vectors
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies face challenges in reliably detecting potential fraudulent privileged access attempts by malicious parties impersonating legitimate users, which can compromise secure resources.
Innovation Solution
A method and system that collect multiple access attributes during privileged access, create feature vectors, compute an access score in real-time by comparing the feature vector to typical patterns, and initiate mitigation actions when the score exceeds a threshold, indicating potential fraudulent access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If multiple access attributes are collected and analyzed to improve detection accuracy, then detection performance is improved, but system complexity increases
Solution Approach 1:
The system segments the detection task by collecting multiple access attributes (location, device, network, interaction patterns) separately and then analyzing them through feature vectors. This segmentation allows complex detection to be broken down into manageable data collection and analysis stages, improving detection performance while maintaining system manageability.
Solution Approach 2:
The patent transforms multiple access attributes into feature vectors that represent access patterns in a simplified dimensional space. By converting complex multi-attribute data into feature vector representations, the system achieves better detection performance through pattern recognition while reducing the complexity of processing individual attributes.
2Speed
If real-time access scoring is implemented to detect fraudulent access, then response time is improved, but computational resources increase
Solution Approach 1:
The system performs preliminary action by pre-establishing typical access patterns and feature vectors for legitimate users. During real-time access, the system only needs to compare current access against these pre-established patterns, significantly reducing computational resources needed for detection while maintaining fast response time.
Solution Approach 2:
The patent creates copies of typical access patterns as reference feature vectors. Instead of performing complex analysis from scratch during each access event, the system compares current access against pre-created reference patterns, enabling real-time detection with reduced computational overhead.
3Measurement precision
If access attributes are collected from multiple sources to enhance detection accuracy, then measurement precision is improved, but data processing complexity increases
Solution Approach 1:
The system merges multiple access attributes (location, device, network, interaction patterns) into unified feature vectors that capture access patterns. This merging process consolidates data from multiple sources into a compact representation, improving detection accuracy while reducing processing time by eliminating the need to analyze each attribute separately.
Data Source
AI summary
A method of detecting potential fraudulent privileged user accesses, comprising collecting a plurality of access attributes identified during each of one or more privileged accesses conducted by one or more users using one or more client devices, creating a feature vector for the each privileged access by a restive user based on a combination of at least some of the plurality of access attributes, computing, in real-time, an access score indicative of deviation of the feature vector from one or more typical feature vectors created for the respective user based on a plurality of previous privileged accesses conducted by the respective user, and initiating one or more fraudulent access mitigation actions responsive to determining that the access score exceeds a certain threshold indicative of potential fraudulent privileged accesses. The access attributes relate to location of users, client devices, network environment, and interaction patterns of the users with their client devices.