Privileged Account Breach Detection Using Behavioral Access Patterns
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security systems struggle to adapt quickly to dynamic environments and identify unauthorized access to high-value resources, as they often require thorough testing and cannot effectively distinguish between normal and anomalous behavior, especially in the context of privileged account breaches.
Innovation Solution
A detection engine maps network token/authorization traffic to a multi-dimensional space using a scoring system, generating models based on past activity to identify abnormal or potentially malicious behavior by analyzing relative activity values, and generates alerts for suspicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If machine learning systems map feature data to multi-dimensional space to identify anomalies, then threat detection capability is improved, but the system cannot adapt quickly enough to dynamic environments where employees leave and new employees start regularly
Solution Approach 1:
The patent implements dynamic baseline profiles that automatically update as employees join, transfer, or leave the organization. The system continuously adapts to changing organizational structures and employee movements, allowing the machine learning model to remain accurate in dynamic environments without requiring manual reconfiguration or extensive retraining periods.
2Measurement precision
If security rules are modified or customized to improve threat detection, then detection capability is improved, but strict and thorough testing is required which drastically reduces the speed of adaptation to new threats
Solution Approach 1:
The system automatically generates baseline profiles for each employee based on their observed network behavior patterns. This self-service approach eliminates the need for manual rule creation and extensive testing, as the system autonomously adapts to new employees and organizational changes in real-time, significantly accelerating the speed of adaptation to new threats.
Solution Approach 2:
The patent establishes baseline behavior profiles for employees during their onboarding process or early activity period. This preliminary action creates a reference framework in advance, enabling the system to quickly detect anomalies without requiring lengthy testing periods when new security rules are introduced, thus maintaining both detection accuracy and rapid adaptability.
3Ease of operation
If all accounts are treated equally in authentication methods, then simplicity is maintained, but attackers can focus on high-value/high-privilege accounts without additional protection
Solution Approach 1:
The patent applies different levels of monitoring and anomaly detection sensitivity to different account types based on their privilege levels and value to the organization. High-value accounts receive enhanced scrutiny and more stringent anomaly thresholds, while standard accounts maintain simpler monitoring. This differentiated approach protects critical assets without complicating the authentication process for all users.
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
An approach for detecting potentially malicious activity on a network generates a multi-dimensional activity model based on captured network activity. Additional network activity is captured, and relative activity values are determined therefor. Determination of whether the additional network activity corresponds to potentially malicious activity is obtained by fitting the relative activity values of the additional network activity to the multi-dimensional relative activity model.