Automated Service Account Classification via Behavior Indicators
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for classifying user accounts as service accounts or non-service accounts in IT network security analytics are manual, labor-intensive, and inefficient, often missing undiscovered service accounts and requiring repeated effort as new accounts are added.
Innovation Solution
A computer system tracks network events to calculate behavior indicators for each account, using thresholds to classify accounts as service or non-service based on behaviors like generating many events, connecting to multiple hosts, being always online, or having periodic activities, with ratios determining consistency and classification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual classification methods are used to identify service accounts, then human analysts can review and verify account characteristics, but the process requires significant human effort and is labor-intensive
Solution Approach 1:
The system performs self-service by automatically classifying accounts using behavior indicators and machine learning models without requiring manual analyst intervention. The classification process is autonomous, with the system monitoring network events, calculating behavior indicators, and making classification decisions automatically based on predefined criteria and trained models.
Solution Approach 2:
The patent replaces the mechanical manual classification process with an automated computer-based system that uses algorithms and machine learning models. The mechanical action of manual review and decision-making is substituted by electronic processing of network events, calculation of behavior indicators, and automated classification decisions.
2Reliability
If manual classification is performed, then analysts can apply contextual knowledge and judgment, but the process is laborious and time-consuming
Solution Approach 1:
The system performs preliminary actions by pre-defining behavior indicators, thresholds, and classification criteria before actual classification occurs. Network events are continuously collected and behavior indicators are pre-calculated, so when classification is needed, the system can quickly match pre-computed data against predefined criteria without time-consuming manual analysis.
Solution Approach 2:
The time-consuming manual classification process is replaced by automated computational processes that instantly calculate behavior indicators and make classification decisions based on pre-established algorithms and machine learning models, eliminating the time loss associated with manual review.
3Reliability
If manual methods are used to identify service accounts, then analysts can verify account characteristics against organizational policies, but new accounts require repeated manual review
Solution Approach 1:
The system enables continuous classification by automatically monitoring all network events in real-time and continuously updating behavior indicators. New accounts are immediately classified upon creation, and existing accounts are continuously re-evaluated as their behavior patterns evolve, eliminating the need for repeated manual review of new accounts.
Solution Approach 2:
The repeated manual review process for new accounts is replaced by automated real-time classification that instantly processes new account creation events and applies the same consistent criteria used for existing accounts, ensuring uniform handling of new accounts without repetitive manual intervention.
4Productivity
If behavior-based classification is implemented, then automation reduces human effort, but the system complexity increases with multiple behavior indicators and thresholds
Solution Approach 1:
The complex classification system is segmented into distinct, manageable components: network event collection module, behavior indicator calculation module, threshold evaluation module, and classification decision module. Each component handles a specific aspect of classification independently, making the overall complex system modular and easier to maintain.
Solution Approach 2:
The system achieves universality by using a single unified approach to classify different types of accounts (service accounts, non-service accounts, and potentially other account types) through a common set of behavior indicators and machine learning models, reducing the need for multiple specialized classification systems.
Data Source
AI summary
The present disclosure describes a system, method, and computer program for identifying and classifying service accounts in a network based on account behavior. For each evaluated account in the network, a plurality of behavior indicators are calculated. The behavior indicators correspond to service account behaviors and, for each account, are calculated based on network events associated with the account. Each behavior indicator is compared to a threshold specific to the corresponding behavior. If one or more behavior indicators for an account satisfies the applicable threshold, the account is deemed to display service account behavior. Consistency in which an account displays service account behavior is factored into classifying accounts as service accounts.