Time-Based Baseline Access Distributions for Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern digital computer systems face challenges in securely managing user access, particularly in remote access scenarios where unauthorized access attempts, such as brute-force password attacks, can occur.
Innovation Solution
An access analysis system that collects data on user access requests and generates time-based baseline access distributions to evaluate the normality of subsequent access requests, allowing for real-time anomaly detection and adaptive authentication measures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional credential-based access control is used, then authentication is simplified, but security against unauthorized access deteriorates
Solution Approach 1:
The system performs preliminary action by establishing baseline access distributions before security incidents occur. It continuously learns and adapts to legitimate user access patterns, enabling proactive detection of anomalies rather than reactive response to known threats
Solution Approach 2:
The system implements feedback mechanisms where access requests are continuously monitored and compared against established baselines. The feedback loop adjusts access decisions in real-time based on deviation from normal patterns, automatically tightening security when anomalies are detected
2Reliability
If access control is tightened to prevent unauthorized access, then security improves, but false positives increase
Solution Approach 1:
The system applies dynamics by making access control policies adaptive rather than static. It continuously updates baseline distributions based on changing user behavior patterns, ensuring that security measures automatically adjust to accommodate legitimate variations in access behavior while maintaining detection of genuine anomalies
Solution Approach 2:
The system changes parameters by monitoring multiple dimensions of access behavior including time, location, device, and frequency. It analyzes deviations across these parameters to distinguish between normal variations and security threats, improving measurement precision through multi-factor analysis
3Measurement precision
If multiple time scales are used for access analysis, then detection capability improves, but system complexity increases
Solution Approach 1:
The system applies segmentation by dividing access analysis into distinct time-based layers. It maintains separate baseline distributions for different time scales (e.g., hourly, daily, weekly patterns), allowing independent analysis and optimization of each temporal dimension without overwhelming complexity
Data Source
AI summary
An access analysis system obtains data about user requests to access particular applications, such as identifiers of the particular user and application involved, the time of the request, and (optionally) additional contextual data, and uses that data to generate user access distributions that quantify the distribution of a given user's requests to access applications over time. After one or more distributions have been generated for a particular user, when that user submits a new access request for an application, the access analysis system can compare the request to the previously-generated access distributions to determine whether (or to what degree) the request is anomalous. If the request is sufficiently non-anomalous, it can be granted with little or no additional actions required by the user or the user's device; if, however, the request is sufficiently anomalous, it can be denied, or additional information—such as additional user authentication factors—can be required.