Security Graph Builder for Privilege Risk Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security measures for computer systems and networks are inadequate in identifying and managing users with administrator equivalent privileges, which can lead to security risks due to the complexity of user rights assignments and access to autostart extensibility points, making it difficult to monitor and control access effectively.
Innovation Solution
A system comprising a security group analyzer, privileges analyzer, ASEP access analyzer, security risk identifier, and security graph builder that identifies users with administrator equivalent privileges and access to autostart extensibility points, building a security graph to illustrate potential security risks and enabling responsive actions such as notifications, monitoring, and credential revocation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional password-based access control is used, then user authentication is simplified, but security is compromised due to stolen or compromised credentials
Solution Approach 1:
The system segments access control into multiple independent factors (knowledge-based passwords, possession-based tokens, inherence-based biometrics). Each factor is evaluated separately by different analyzers (password analyzer, token analyzer, biometric analyzer) before combining results, making the system more reliable while maintaining manageable complexity through modular architecture
Solution Approach 2:
The patent combines multiple authentication factors (passwords, tokens, biometrics) into a composite authentication mechanism. This multi-factor approach creates a more secure access control system where compromise of one factor does not lead to complete system failure, resolving the contradiction between security reliability and operational simplicity
2Measurement precision
If comprehensive user privilege monitoring is implemented, then security risk detection is improved, but system complexity increases due to multiple analyzers and graph building
Solution Approach 1:
The monitoring system is divided into specialized analyzers (security group analyzer, privileges analyzer, ASEP access analyzer) that each handle specific aspects of privilege monitoring. This segmentation allows for precise security risk detection in each domain while keeping individual component complexity low, with the security graph builder integrating results centrally
Solution Approach 2:
The security graph serves as an intermediary data structure that consolidates information from multiple analyzers. Instead of having analyzers directly interact with each other, they all feed into the security graph builder, which creates a unified view of security risks, reducing overall system complexity while maintaining high detection precision
3Adaptability or versatility
If access to autostart extensibility points is allowed, then system functionality is enhanced, but security risks increase due to potential malicious code execution
Solution Approach 1:
The system implements continuous monitoring of ASEP access through the ASEP access analyzer, which tracks who accesses autostart extensibility points and what changes are made. This feedback mechanism allows the system to maintain enhanced functionality while detecting and responding to potential malicious code execution attempts in real-time
Solution Approach 2:
The security graph builder proactively identifies users with access to ASEP entries before malicious code can be executed. By pre-mapping access relationships and privileges, the system can prevent harmful actions by alerting administrators or automatically blocking suspicious access attempts before they result in malicious code execution
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems and methods for identifying a security risk include a security group analyzer that identifies a first set of users belonging to a security group such as a local administrators' group. A privileges analyzer identifies a second set of users having one or more privileges gained from user rights assignments that may pose a security risk. An autostart extensibility point (ASEP) access analyzer identifies a third set of users by identifying users having access to an ASEP entry or an image path identified by an ASEP entry. A security risk identifier identifies security risks by identifying users that are in the second or third set of users but are not in the first set of users. A security handler performs a responsive action in response to the identification of the security risk. A security graph builder uses the identified interrelationships to build a security graph that illustrates the security risks.