Special Audit Record Group Tracking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current directory services, such as Windows auditing, lack the ability to efficiently track activities of sensitive user accounts, particularly in large networks, as they only allow individual account tracking and not by group membership, making it difficult to detect malicious activity from users with changing group memberships.
Innovation Solution
A method is introduced to generate special audit records for users belonging to specific groups, using a locally unique identifier to track user activities, which allows for easier identification and correlation with other audit records, enhancing security by monitoring group membership changes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If individual account tracking is used in Windows auditing, then user activities can be recorded, but it becomes difficult to efficiently track activities of sensitive user groups in large networks
Solution Approach 1:
The patent segments audit records by introducing a special field that identifies whether a record belongs to a sensitive user group. This segmentation allows the auditing system to efficiently filter and focus on only the audit records relevant to sensitive groups, rather than processing all user audit records uniformly. The segmentation is achieved through marking audit records with group identifiers during the audit event generation process.
Solution Approach 2:
The patent introduces an intermediary mechanism in the form of a special audit record field that acts as a mediator between the individual user account tracking system and the group-based monitoring requirement. This intermediary field stores group membership information, enabling the system to bridge individual account auditing with collective group monitoring without requiring a complete redesign of the auditing architecture.
2Reliability
If group membership enumeration is performed to track sensitive users, then group activities can be monitored, but the method becomes fragile when group membership changes over time
Solution Approach 1:
The patent applies preliminary action by capturing and storing group membership information at the time of audit event generation, rather than relying on periodic enumeration. When an audit event occurs, the system proactively records the user's current group membership in the special audit field, ensuring that the information is current and accurate regardless of when group membership changes occur. This eliminates the need for continuous enumeration and periodic updates.
Solution Approach 2:
The patent implements feedback by continuously updating the special audit field with current group membership information whenever audit events are generated. This feedback mechanism ensures that the audit records always reflect the latest group membership status, allowing the system to automatically adapt to membership changes without manual intervention or complex enumeration logic.
3Loss of information
If all audit records are generated for every user login, then complete user activity tracking is achieved, but sifting through audit records becomes difficult and time consuming
Solution Approach 1:
The patent extracts the essential group membership information from the complete audit record and places it in a specially designated field. This extraction allows security administrators to quickly identify and filter audit records related to sensitive groups without having to manually examine every audit record in detail. The special field acts as an index that enables rapid retrieval of relevant audit information.
Solution Approach 2:
The patent conceptually applies the principle of color changes by using visually distinct markers (the special audit field with group identifiers) to highlight audit records that are relevant to sensitive groups. This marking system allows administrators to quickly distinguish between routine user activities and potentially significant events involving sensitive users, enabling rapid prioritization and analysis of critical audit information.
Data Source
AI summary
A method of generating a computer user activity log for a user belonging to a specially monitored group includes allowing a user to logon to a local computer. The local computer verifying the user account credentials and creating a user logon session. A token is created by the local computer for identification of any group membership with which the user associated and also having the user access privileges. The group information in the token is compared with a specially monitored group list. The specially monitored group list may be obtained from a domain server or may be configured locally. If the user has membership in the specially monitored group, then a special logon session is created and activities of the user are recorded.