Anomaly Detection for Workload Identity Post-Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud computing platforms face challenges in detecting and mitigating anomalous post-authentication behavior for workload identities, which can be exploited by malicious entities for data exfiltration and environment compromise.
Innovation Solution
The system analyzes audit logs for actions associated with workload identities during authentication periods, using a model for anomaly prediction to generate an anomaly score. Based on this score, the system determines if anomalous behavior has occurred and performs mitigation actions to address it.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the system analyzes audit logs using anomaly prediction models to detect post-authentication behavior, then security detection capability is improved, but compute resource consumption increases
Solution Approach 1:
The system pre-computes and stores baseline behavioral patterns for workload identities during normal operations. These pre-established baselines are then used for rapid comparison against actual post-authentication behavior, eliminating the need for complex real-time analysis and reducing compute resource consumption during security detection
Solution Approach 2:
The system uses lightweight anomaly scoring mechanisms that generate disposable, single-use security assessments for each post-authentication behavior event. These lightweight evaluations provide adequate security detection without the computational overhead of persistent, complex monitoring models
2Measurement precision
If the system monitors all actions performed with respect to workload identity after authentication, then detection precision is improved, but system complexity increases
Solution Approach 1:
The system extracts and monitors only specific critical actions performed with respect to workload identities after authentication, such as credential management operations and permission changes. By focusing on extracting only the most security-relevant actions rather than monitoring all system activities, the system achieves high detection precision while maintaining manageable complexity
Solution Approach 2:
The system applies different monitoring intensities and analysis methods to different types of post-authentication actions based on their security significance. High-risk actions receive detailed scrutiny while routine actions receive lighter monitoring, optimizing detection precision across different operational contexts without uniformly increasing system complexity
Data Source
AI summary
Methods, systems, apparatuses, and computer-readable storage mediums described herein are configured to detect anomalous post-authentication behavior/state change(s) with respect to a workload identity. For example, audit logs that specify actions performed with respect to the workload identity of a platform-based identity service, a causing state change(s), while another identity is authenticated with the platform-based identity service, are analyzed. The audit log(s) are analyzed via a model for anomaly prediction based on actions. The model generates an anomaly score indicating a probability whether a particular sequence of the actions is indicative of anomalous behavior/state change(s). A determination is made that an anomalous behavior has occurred based on the anomaly score, and when anomalous behavior has occurred, a mitigation action may be performed that mitigates the anomalous behavior.