Session Attack Mitigation via Layered Confidence Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security measures, such as login rate limiters and blacklists, are ineffective in preventing Session Level Attacks (SLAs) as they can be exploited by attackers to prevent legitimate users from accessing their accounts, and there is a need for a more sophisticated method to differentiate between legitimate and malicious login requests.
Innovation Solution
A security process that calculates confidence scores based on network layer, location data, and application layer indications to automate decision-making and mitigate SLAs, particularly in a cloud native deployment platform, by analyzing login requests and performing mitigation actions such as rate limiting or quarantining based on alert existence and confidence thresholds.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If login rate limiters are implemented to prevent DoS attacks, then network security against flooding attacks is improved, but legitimate users may be incorrectly blocked enabling Session Level Attacks
Solution Approach 1:
The patent applies local quality by analyzing specific characteristics of individual login requests (geolocation, device fingerprint, behavior patterns) rather than applying uniform rate limiting to all users. This allows the system to differentiate between malicious and legitimate requests at the individual request level, blocking only those that exhibit suspicious characteristics while allowing normal users uninterrupted access.
Solution Approach 2:
The system changes parameters by evaluating multiple dimensions of login request characteristics including geolocation data, device identifiers, typing patterns, and session timing. By monitoring changes in these parameters across sequential login attempts, the system can detect anomalies indicative of session hijacking while maintaining access for users with consistent parameter profiles.
2Reliability
If traditional rate limiting and blacklists are used, then account hijacking is prevented, but Session Level Attacks targeting individual users become more feasible
Solution Approach 1:
The patent segments the security analysis into multiple independent evaluation components: geolocation verification, device fingerprinting, behavior pattern analysis, and session timing validation. Each component independently assesses a specific aspect of login legitimacy, and their combined results provide a comprehensive security evaluation. This modular approach enhances detection capability while maintaining manageable system complexity through clear separation of concerns.
Solution Approach 2:
The system introduces an intermediary security layer that sits between the login request and the authentication process. This intermediary evaluates multiple characteristics of the login attempt and makes intelligent decisions about whether to allow, challenge, or block the request. This mediator approach provides sophisticated security without requiring complete redesign of the underlying authentication system.
3Ease of operation
If confidence score thresholds are set low to allow more legitimate users, then user access is improved, but malicious login attempts may slip through
Solution Approach 1:
The patent implements dynamic confidence score thresholds that adapt based on the user's historical behavior, risk profile, and current session context. Rather than using fixed thresholds, the system adjusts the required confidence level dynamically - lower thresholds for trusted users with consistent patterns and higher thresholds for new or suspicious accounts. This dynamic approach allows flexible security that accommodates legitimate users while maintaining protection against attacks.
Data Source
AI summary
A computer method and system for mitigating a Session Level Attack (SLA) upon one or more internet hosted sought user accounts. A login request for a sought user account is received and Layer 3 information regarding the login request is utilized to determine existence of a SLA threat. One or more mitigations actions is performed on the login request to determine if a SLA threat exists based upon the utilization of Layer 3 information. Next, Layer 7 information regarding the login request is utilized to determine existence of a SLA threat wherein the Layer 7 information is only utilized to determine the existence of a SLA threat when no SLA threat was determined through utilization of the Layer 3 information. One or more mitigations actions is performed on the HTTP login request if the existence of a SLA threat exists based upon the utilization of the Layer 7 information.