RDP Login Anomaly Detection Using User-Specific Baselines
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Organizations face vulnerabilities in Remote Desktop Protocol (RDP) security due to weak passwords and lack of additional security layers, making them susceptible to brute force attacks and network invasions.
Innovation Solution
A method for detecting malicious RDP connections by analyzing user login logs, dividing aspects into bins, calculating probability densities and weights, and applying a customized scoring system to identify deviations from baseline behavior.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If RDP accounts are secured with additional layers of security, then security reliability is improved, but device complexity increases
Solution Approach 1:
The system performs preliminary actions by training anomaly detection models on historical login data before actual security threats occur. This establishes a baseline of normal behavior patterns, enabling the system to proactively identify and alert on anomalous login attempts before they can compromise security, thus improving reliability without adding complex real-time intervention layers
Solution Approach 2:
The patent replaces traditional mechanical security layers (such as multiple authentication factors or complex access control systems) with an information-based detection system that uses machine learning models to analyze login patterns. This substitution maintains security reliability while reducing the physical and operational complexity of security infrastructure
2Measurement precision
If anomaly detection monitoring is implemented on user logins, then detection precision is improved, but loss of time increases
Solution Approach 1:
The system applies partial monitoring during the training period, focusing computational resources on establishing baseline patterns for each user rather than performing full anomaly detection analysis. Once the baseline is established, the system transitions to efficient real-time detection that requires minimal additional time, thus achieving high detection precision without excessive ongoing time loss
Solution Approach 2:
The training period performs preliminary action by pre-processing and analyzing historical login data to establish user-specific baseline patterns before actual security monitoring begins. This upfront investment of time creates a ready-to-use detection model that operates efficiently in real-time, reducing the time penalty for high-precision detection during production use
Data Source
Figure 1
Figure 2
AI summary
The invention concerns a method for detecting malicious connections from remote users into a computer network through Remote Desktop protocol, the method being carried out by a computer having access to login logs of users, the method comprising the following steps: - defining at least three aspects, each divided into several bins as follows: - a day of week aspect comprising n1 bins, - a time of day aspect comprising n2 bins, - a number of logins in a day aspect comprising n3 bins; n1, n2 and n3 being integers, - defining a model based on the aspects and providing a score of log for each user; - defining a baseline of log; - applying the model on each user log to determine a production score of log and comparing the production score of log with respect to the baseline, wherein the model comprising: - calculating a probability density for each bin for each user, - determining a weight for each aspect, - calculating the score of log from the probability density weighted by the determined weight for each user.