Dynamic User Identity Tracking via Metadata Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current SIEM systems face challenges in identifying and tracking users and IoT devices through log events due to varying metadata types, which hinders effective detection of network security breaches and physical item theft.
Innovation Solution
A system dynamically allocates reporting rates of log events from distributed nodes, parses metadata to expose identity context, and compares current user or device locations to historical trends to detect anomalies, triggering security actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If different metadata types are collected from various log events, then the ability to identify users and IoT devices is improved, but the complexity of merging and analyzing this diverse metadata increases
Solution Approach 1:
The system segments the metadata merging process by creating separate identity contexts for different event types (DHCP, authentication, device registration) and handling each type through dedicated processing logic. This allows complex diverse metadata to be managed through modular, type-specific handling rather than a monolithic approach.
Solution Approach 2:
The system creates a universal identity context structure that can accommodate multiple types of metadata from different event sources. This multi-functional framework allows the same basic identity context mechanism to handle diverse data types (IP addresses, MAC addresses, user names, device identifiers) through a common processing paradigm.
2Reliability
If dynamic IP addresses are used for users, then network flexibility and security are improved, but the ability to track user locations consistently deteriorates
Solution Approach 1:
The system performs preliminary actions by establishing identity contexts and tracking user profiles before location changes occur. When a user logs in from a new location, the system compares the new location against the stored profile and historical data to detect anomalies, enabling consistent tracking despite IP address changes.
Solution Approach 2:
The system implements feedback mechanisms where location and behavior data from each login event feed back into the user profile. This continuous feedback loop allows the system to learn and adapt to legitimate location patterns while detecting deviations that indicate security breaches or device theft.
3Reliability
If user names are changed between different services, then user flexibility and security are improved, but the ability to consistently identify users across services deteriorates
Solution Approach 1:
The system introduces an intermediary mechanism in the form of a centralized identity context management system that acts as a mediator between different services. This intermediary maintains a unified view of user identity across services, resolving the issue of inconsistent user names by providing a common reference point that all services can use to identify users consistently.
Data Source
AI summary
Network identity to User Identity and location mapping information can be found in various logs (such as Active Directory logs, DHCP logs, VPN logs, and WLAN authentication logs) and certain files such as router Layer 2 or 3 forwarding tables. For a large organization, this mapping can be dynamic. Accurate user identity and location information is crucial to assessing the security risk associated with a host and take corrective action. This invention discloses a distributed in-memory user database update methodology for keeping track of large scale dynamically updating network to user identity mappings. The technique is further configurable for specific users, specific devices or for specific attributes in the metadata.