User-Level Packet Tracing for Reliable UEBA Threat Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing user and entity behavior analytics (UEBA) systems are ineffective when authentication logs are inaccurate or manipulated, leading to false positives or missed threats due to compromised authentication protocols like NTLM, Kerberos, and SAML, which can be exploited by attackers.
Innovation Solution
A system and method for attacker interdiction using user-level network trace and tracking, leveraging verified authentication objects as metadata tags on network packets to create dependency graphs, analyze temporal dynamics, and implement SOAR workflows for detection and response.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If authentication logs are used for UEBA analysis, then user behavior can be tracked and analyzed, but the reliability and accuracy of detection deteriorates when authentication protocols are compromised or manipulated
Solution Approach 1:
The patent introduces network packet capture and authentication object verification as an intermediary layer between the authentication protocols and UEBA analysis. By capturing raw network packets and verifying authentication objects (Kerberos tickets, SAML assertions, OAuth tokens) independently of the potentially compromised authentication logs, the system creates a trusted data source that mediates between the untrusted authentication infrastructure and the UEBA engine, thereby maintaining detection accuracy despite authentication protocol compromises
2Ease of manufacture
If traditional UEBA systems rely on authentication logs, then implementation is straightforward, but false positives and missed threats increase when authentication protocols are abused
Solution Approach 1:
The patent merges multiple data sources and verification methods into a unified UEBA system. It combines network packet capture, authentication object verification (checking cryptographic signatures of Kerberos tickets, SAML assertions, OAuth tokens), and traditional authentication log analysis. This merged approach maintains implementation feasibility while significantly improving threat detection reliability by cross-validating data across multiple channels and reducing false positives through corroborating evidence
3Reliability
If authentication protocols are verified for integrity, then data reliability improves, but system complexity and processing overhead increase
Solution Approach 1:
The patent performs preliminary verification of authentication objects by pre-computing and caching expected cryptographic signatures, validation rules, and trusted entity certificates before actual authentication events occur. By preparing verification criteria in advance and establishing trusted baselines beforehand, the system reduces the complexity and processing overhead of real-time verification while maintaining high reliability in authentication data validation
Data Source
AI summary
A system and method for attacker interdiction using user-level network trace and tracking which leverages the uniqueness of verified authentication objects as metadata tags on captured network packets to gain insight at the user-level of how a network and various applications interact. The tagged network packets may be tracked, and the resulting data formed into a trace and track dataset to create one or more user-level dependency graphs alongside captured temporal dynamics. The trace and track dataset may be enriched with application trace information and runtime instruction data to improve the dependency graphs and provide deeper insight into application and user security on a given network. Attacks may be detected by analyzing the dependency graphs, and attacker interdiction may be implemented by actively orchestrating network security and IT devices using SOAR workflows.