Network Traffic Characterization for Adaptive Access Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security systems are vulnerable to AI/ML-based attacks and identity theft due to the inefficacy of abnormal behavior detection and single sign-on systems, leading to increased exposure of authentication means and reduced convenience.
Innovation Solution
A network access control system utilizing AI/ML to generate user-specific traffic character templates through time-series feature extraction and comparison, performing enhanced authentication when deviations are detected, and updating the model with abnormal data to improve accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If frequent authentication requests are made to ensure security, then user trust is improved, but convenience deteriorates and authentication means are more exposed
Solution Approach 1:
The system performs preliminary authentication once to create a long-term access token, eliminating the need for frequent re-authentication. This preliminary action establishes security baseline while maintaining user convenience throughout the session.
Solution Approach 2:
The system continuously monitors network traffic patterns and provides feedback by comparing real-time traffic against the learned user profile. When anomalies are detected, the system can revoke access or trigger enhanced authentication, maintaining security without requiring frequent user actions.
2Reliability
If AI/ML-based abnormal behavior detection is used, then security is improved, but detection accuracy deteriorates against intelligent attacks
Solution Approach 1:
The system performs self-service by continuously learning from the user's own network traffic patterns to build a personalized profile. This self-adaptation allows the system to distinguish between normal variations in user behavior and actual anomalies, improving detection accuracy against intelligent attacks.
Solution Approach 2:
The user profile is dynamically updated continuously as the system learns new traffic patterns. This dynamic adaptation allows the detection mechanism to respond to changing user behaviors and attack vectors, maintaining high accuracy against evolving intelligent attacks.
3Ease of operation
If single sign-on system is used, then convenience is improved, but security deteriorates due to token theft vulnerability
Solution Approach 1:
The system introduces network traffic pattern analysis as an intermediary security layer between the access token and the actual resource access. Even if tokens are stolen, the intermediary traffic pattern verification prevents unauthorized access, maintaining both convenience and security.
Solution Approach 2:
The system performs preliminary traffic pattern learning during the initial authentication phase, establishing a baseline before any resource access occurs. This preliminary security setup enables continuous verification without disrupting the convenient single sign-on experience.
Data Source
AI summary
Provided is a system for network access control. The system includes an authentication server configured to perform a basic authentication procedure for a user by communicating with at least one user terminal, a service server configured to provide a service to at least one user terminal passing through the basic authentication procedure, a collection device configured to acquire traffic data of the at least one user terminal passing through the basic authentication procedure from at least one of the service server and a network interface connected to the service server, acquire a traffic dataset by refining the acquired traffic data in accordance with correlation, and extract time-series feature points of the traffic dataset, and an artificial intelligence (AI) management device configured to train at least one AI model to define a traffic character template of the user on the basis of the time-series feature points.