User Activity Tracking During Logon Sessions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for detecting security risks in IT networks are inadequate in identifying unknown attack patterns and cannot effectively track user activity during logon sessions, especially when attackers impersonate legitimate users or switch accounts and devices.
Innovation Solution
A system that builds behavior models for users based on their interactions, compares user events to these models, and calculates a risk assessment by identifying anomalies, including account and device switches, to detect and assess security risks in real-time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If administrators build queries against IT database to determine security risks, then security risk detection is possible, but the system cannot detect unknown attack patterns or impersonation threats
Solution Approach 1:
The system performs preliminary actions by building behavior models for users based on their historical interactions with the network before actual security incidents occur. These models capture normal user behavior patterns including device usage, access times, and interaction sequences, enabling the system to detect anomalies and unknown attack patterns by comparing current activity against established baselines
Solution Approach 2:
The system implements feedback mechanisms by continuously monitoring user behavior and comparing it against behavior models, then using this information to detect security risks. The system provides real-time feedback on detected anomalies and updates behavior models based on new data, creating a closed-loop system that improves detection capability over time while adapting to new attack patterns
2Reliability
If the system tracks user activity during logon sessions, then impersonation threats can be detected, but the complexity of tracking across device switches and account changes increases
Solution Approach 1:
The behavior model serves as a universal tracking mechanism that works across multiple devices, user accounts, and session types. Instead of implementing separate tracking systems for each device or account scenario, the system uses a single behavior model framework that can identify impersonation threats regardless of whether the attacker switches devices, changes accounts, or both, thereby reducing overall system complexity
Solution Approach 2:
The behavior model acts as an intermediary layer between raw user activity data and security risk detection. Rather than directly tracking and analyzing complex device switches and account changes, the system uses behavior models to mediate this process, translating raw data into meaningful security assessments and simplifying the detection logic
3Adaptability or versatility
If behavior models are built for each user based on interactions, then unknown attack patterns can be detected, but the time and computational resources required increase
Solution Approach 1:
The system applies partial action by focusing behavior model building and comparison on the most relevant user interactions and key behavior indicators rather than analyzing every single user action in detail. This selective approach captures sufficient information to detect unknown attack patterns while significantly reducing the computational time and resources required compared to comprehensive analysis of all user activities
Data Source
AI summary
The present disclosure is directed to a system, method, and computer program for tracking user activity during a logon session, including tracking device access and any user account switches during the logon session. In response to receiving an event log for an IT event in the network, the system determines whether to filter the event, associate the event with an existing user logon session, or associate the event with a new user logon session. The system executes one or more rules to determine whether an event represents a user account switch or the continued use of an account by a user currently logged onto the network. If so, the event is associated with an existing logon session. If not, the system determines whether the event satisfies criteria for a new user logon session.