Replay Attack Detection Using Action Window Similarity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current behavioral biometric systems are vulnerable to replay attacks, where an impostor can spoof previous user sessions to gain unauthorized access by mimicking similar or identical behavior patterns, which existing systems often fail to detect effectively.
Innovation Solution
A system that splits current and previous sessions into action windows, calculates window similarity scores through pair-wise comparison, aggregates these scores to generate a replay likelihood score, and classifies the current session as a replay attack if the score exceeds a threshold, thereby distinguishing authentic from spoofed behavior.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If behavioral biometric systems compare entire sessions to detect replay attacks, then they can identify overall session similarities, but they fail to detect localized spoofed behavior patterns that differ slightly from authentic sessions
Solution Approach 1:
The patent divides user sessions into discrete action windows representing specific user actions (e.g., clicking, typing, scrolling). Each action window is independently analyzed for similarity between current and historical sessions. This segmentation enables precise detection of localized replayed behaviors while reducing overall system complexity by breaking down the analysis into manageable units.
2Reliability
If the system uses pair-wise comparison of action windows to generate similarity scores, then it can accurately identify replay attacks, but it increases computational complexity and processing time
Solution Approach 1:
By segmenting sessions into action windows, the system performs pair-wise comparisons on smaller, discrete units rather than entire sessions. This reduces the computational burden while maintaining detection reliability, as each action window can be independently and efficiently compared against historical action windows.
Solution Approach 2:
The system calculates similarity scores for action windows selectively, focusing computational resources on comparing only relevant action windows between current and historical sessions. This partial action approach reduces overall computational power requirements while maintaining adequate detection reliability for identifying replay attacks.
3Reliability
If the system aggregates window similarity scores to generate replay likelihood scores, then it can produce a comprehensive security assessment, but it increases the complexity of score interpretation and threshold setting
Solution Approach 1:
The system merges individual action window similarity scores into a single replay likelihood score through aggregation. This combining process simplifies the final security assessment by consolidating multiple granular measurements into one comprehensive metric, making threshold setting and decision-making more straightforward while maintaining reliable security assessment.
Data Source
AI summary
An example system includes a processor to receive a current session and previous sessions associated with an account. The processor can split the current session and the previous sessions into action windows. The processor can calculate a window similarity score for each action window of the current session using a pair-wise comparison with action windows of each of the previous sessions. The processor can aggregate the window similarity scores to generate a replay likelihood score for the current session with respect to each of the previous sessions. The processor can classify the current session as a replay attack in response to detecting that a replay likelihood score of the current session exceeds a threshold.