Privileged Session Analytics via Activity Pattern Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern computing systems face challenges in managing and securing privileged accounts and sessions, as these accounts are lucrative targets for internal and external attacks, and detecting inappropriate access becomes difficult as the number of resources increases.
Innovation Solution
A privileged account manager is configured to monitor privileged sessions by capturing metadata, generating activity patterns, assigning weights to activities, identifying matching patterns, and determining appropriate actions to prevent unauthorized access, such as warning users or administrators or taking administrative actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the number of resources utilized by an enterprise increases, then the enterprise can access more computing resources and services, but detecting inappropriate access to privileged accounts becomes more difficult
Solution Approach 1:
The patent introduces a privileged account manager as an intermediary system that sits between users and target systems. This manager captures metadata from privileged sessions, generates activity patterns, and compares them against stored patterns to detect inappropriate access. The intermediary handles the complexity of monitoring across multiple resources, making detection feasible even as the enterprise expands its resource footprint.
2Reliability
If privileged accounts are used to provide secure access to computing resources, then access control and security are improved, but these accounts become lucrative targets for internal and external attacks
Solution Approach 1:
The system implements continuous feedback by monitoring privileged sessions in real-time, capturing metadata, and comparing activity patterns against stored patterns. When inappropriate access or anomalous behavior is detected, the system can trigger alerts or automated responses. This feedback loop enhances security by actively detecting and responding to attacks on privileged accounts, making them less attractive targets.
3Measurement precision
If metadata is captured and activity patterns are generated for monitoring privileged sessions, then security detection capability is improved, but the complexity of the monitoring system increases
Solution Approach 1:
The patent creates simplified copies of privileged session activities in the form of activity patterns. Instead of directly analyzing complex raw metadata from multiple privileged sessions, the system generates standardized activity pattern representations that capture essential behaviors. These patterns can be stored, compared, and analyzed more efficiently, reducing the computational complexity while maintaining detection precision.
Data Source
AI summary
A privileged account manager is provided for monitoring privileged sessions on target systems of an enterprise. In an embodiment, the privileged account manager is configured to capture metadata related to a privileged session and generate a first activity pattern for the privileged session based on the captured metadata. The first activity pattern may include a sequence of one or more activities performed by a first user during the privileged session. The privileged account manager may be configured to identify a second activity pattern that comprises at least a subset of the one or more activities performed by the first user during the privileged session and determine an appropriate action to be performed for the first activity pattern based on the identification of the second activity pattern. In some embodiments, the privileged account manager may be configured to transmit the action to a second user on a client device.