SSH Session Monitoring via Contextual Transaction Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security systems struggle to detect and prevent insider threats and malicious activities within systems/applications, particularly by trusted individuals or those impersonating them, due to valid credentials and the difficulty in monitoring encrypted SSH sessions.
Innovation Solution
Implementing a contextual monitoring system that uses agents integrated into application code to track and analyze transactions in real-time, employing machine learning for anomaly detection and taking proactive measures such as blocking or diverting suspicious activities, while also monitoring SSH sessions across user accounts and hosts seamlessly.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Difficulty of detecting and measuring
If agents are integrated into application code to monitor transactions in real-time, then detection capability is improved, but device complexity increases
Solution Approach 1:
The monitoring system is divided into separate components: agents embedded in application code, a transaction monitoring service, and a machine learning anomaly detection service. This segmentation allows each component to perform its specific function independently, improving detection capability while managing complexity through modular architecture.
Solution Approach 2:
A transaction monitoring service acts as an intermediary between the agents embedded in application code and the machine learning anomaly detection service. This intermediary layer processes transactions from multiple agents, filters relevant information, and passes it to the ML service, thereby reducing the complexity burden on individual components while maintaining comprehensive monitoring.
2Measurement precision
If machine learning is used for anomaly detection, then detection accuracy is improved, but processing time increases
Solution Approach 1:
The system performs preliminary actions by continuously training machine learning models on historical transaction data to establish baseline behavior patterns. Once trained, these models can quickly identify anomalies in real-time transactions without requiring complex analysis during the actual detection moment, thus improving accuracy while minimizing processing time delays.
Solution Approach 2:
The system implements feedback mechanisms where detected anomalies and their outcomes are fed back into the machine learning models for continuous refinement. This feedback loop allows the models to learn from real-world data and improve their detection accuracy over time, while the iterative training process optimizes processing speed by removing unnecessary computational steps.
3Reliability
If comprehensive monitoring is implemented across all transactions, then security coverage is improved, but system performance decreases
Solution Approach 1:
The monitoring system applies local quality by tailoring monitoring intensity and depth to the specific characteristics of different transactions and data types. Critical transactions undergo comprehensive monitoring with deep analysis, while routine transactions receive lighter monitoring, thereby maintaining high security coverage for important operations while minimizing performance impact on overall system throughput.
Solution Approach 2:
The system dynamically changes monitoring parameters based on transaction context, risk level, and detected patterns. For high-risk transactions, the system increases monitoring intensity by adjusting parameters such as analysis depth, data points collected, and validation strictness. For low-risk transactions, parameters are reduced to maintain performance, thus achieving comprehensive security coverage without uniformly degrading system performance.
Data Source
AI summary
An SSH module is executed as part of a host computing machine, where code for an secure shell (SSH) agent is integrated with code of the SSH module. Incoming and outgoing host computing machine transactions are collected using the SSH agent which transmits the collected host computing machine transactions to an SSH context agent external to the SSH module. The collected host machine transactions are transmitted to a monitoring server for anomalous transaction detection. The monitoring server returns instructions to perform an action based on an anomalous transaction detection.