Web Access Anomaly Detection with IP Clustering and Resource Similarity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cloud security systems struggle to accurately detect malicious IP addresses due to their dynamic nature and high cardinality, leading to ineffective origin-based access rules and high false positive rates, especially when servers from trusted entities access new resources.
Innovation Solution
A system that clusters IP addresses based on similarity criteria such as ownership and geographic location, and uses a collaborative filtering algorithm on connection history data to predict the legitimacy of access requests, employing a connection legitimacy prediction engine to determine if the request is anomalous.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If origin-based access rules are used to block malicious IPs, then security detection capability is improved, but false positive rate increases and trusted servers are incorrectly blocked
Solution Approach 1:
The patent segments the monolithic IP address into multiple hierarchical components (country code, network portion, host portion). Instead of treating each IP as a single atomic unit, the system divides it into manageable segments that can be independently analyzed and matched against access rules, enabling more nuanced security decisions.
Solution Approach 2:
The patent applies different levels of segmentation and matching strictness to different portions of the IP address based on local requirements. Country code segments are matched with lower strictness to allow geographic flexibility, while network and host portions can be matched with higher strictness for precise access control, optimizing both security and false positive reduction.
2Device complexity
If IP addresses are used as atomic units for access control, then implementation simplicity is maintained, but adaptability to dynamic IP allocation and spoofing decreases
Solution Approach 1:
The patent segments the monolithic IP address into multiple hierarchical components (country code, network portion, host portion). Instead of treating each IP as a single atomic unit, the system divides it into manageable segments that can be independently analyzed and matched against access rules, enabling more nuanced security decisions.
Solution Approach 2:
The patent implements dynamic matching strictness that can be adjusted per segment and per access rule. The system can adapt the level of segmentation and matching rigor based on the specific security requirements of different resources, allowing flexible response to dynamic IP allocation and spoofing attempts.
3Reliability
If strict IP matching is applied to all access requests, then security enforcement is strengthened, but false positives increase and legitimate access is blocked
Solution Approach 1:
The patent applies different levels of segmentation and matching strictness to different portions of the IP address based on local requirements. Country code segments are matched with lower strictness to allow geographic flexibility, while network and host portions can be matched with higher strictness for precise access control, optimizing both security and false positive reduction.
Solution Approach 2:
The patent implements dynamic matching strictness that can be adjusted per segment and per access rule. The system can adapt the level of segmentation and matching rigor based on the specific security requirements of different resources, allowing flexible response to dynamic IP allocation and spoofing attempts.
Data Source
AI summary
A system for dynamically determining the legitimacy of a source internet protocol (IP) address requesting access to a target resource includes an address classifier, a resource similarity identifier, and a connection legitimacy prediction engine. The IP address classifier classifies the source IP address into a relevant address group selected from among a plurality of address groups. Each of the address groups consist of IP addresses that satisfy at least one address similarity criterion. The resource similarity identifier identifies a group of similar resources for the target resource based commonalities in a first subset of the address groups that have previously accessed the target resource and subsets of the address groups that have accessed each of the similar resources. The connection legitimacy prediction engine compute a probability of receiving a legitimate new request to access the target resource from the relevant address group based on connection history data associated with the relevant address group and each of the similar resources. The system denies the request to access the target resource in response to determining that the probability falls below a defined threshold.