Network authentication evaluation
This patent relates to determining whether network authentication events are legitimate or malicious. One example includes receiving network data relating to past timestamped authentication events between network users and network devices and extracting graphical features from the timestamped authentication events. The example also includes extracting temporal features from the timestamped authentication events and training a temporal graph authentication anomaly detection model with both the extracted graphical features and the extracted temporal features.
1 . A device-implemented method comprising:
receiving network data as a bipartite graph relating to past timestamped authentication events between network users and network devices in which each edge represents an individual past timestamped authentication event between an individual user and an individual device;
extracting graphical features from the past timestamped authentication events;
extracting temporal features from the past timestamped authentication events;
synthesizing fake malicious authentication events by changing the graphical features in individual past timestamped authentication events and by changing the temporal features in other individual past timestamped authentication events;
training a temporal graph authentication anomaly detection model with both the graphical features and the temporal features of the past timestamped authentication events and with the synthesized fake malicious authentication events; and,
supplying a subsequent timestamped authentication event to the trained temporal graph authentication anomaly detection model to determine whether the subsequent timestamped authentication event is a legitimate authentication event or a malicious authentication event.
2 . The method of claim 1 , wherein the bipartite graph comprises a dynamically-evolving bipartite graph.
3 . The method of claim 2 , wherein the dynamically-evolving bipartite graph includes relative orders that the past timestamped authentication events occur.
4 . The method of claim 1 , wherein extracting temporal features comprises extracting temporal features relating to date, day, and time of individual past timestamped authentication events.
5 . The method of claim 4 , wherein changing the temporal features in synthesized fake malicious authentication events comprises changing the date, the day, and/or the time of other individual past timestamped authentication events.
6 . The method of claim 1 , wherein synthesizing negative timestamped authentication events comprises filtered rewiring.
7 . The method of claim 6 , wherein the training comprises training the temporal graph authentication anomaly detection model with both the past timestamped authentication events and the synthesized fake malicious authentication events.
8 . The method of claim 1 , further comprising receiving an indication from the trained temporal graph authentication anomaly detection model that the subsequent timestamped authentication event is a malicious authentication event.
9 . The method of claim 8 , further comprising taking an action to protect network security based upon the indication of the malicious authentication event from the trained temporal graph authentication anomaly detection model.
10 . The method of claim 1 , wherein supplying a subsequent timestamped authentication event comprises monitoring network authentication events in real-time and implementing a network security protocol responsive to the malicious authentication event.
11 . A system, comprising:
hardware; and,
an anomaly detection framework configured to receive network data relating to past timestamped authentication events between network users and network devices on a network, extract graphical features relating to network users and network devices from the past timestamped authentication events, extract temporal features from the past timestamped authentication events relating to date, day, and time of the past authentication events, synthesize malicious authentication events utilizing filtered rewiring by changing either the network users or the network devices of individual past timestamped authentication events but maintaining temporal features and synthesize other malicious authentication events by changing the temporal features of other individual past timestamped authentication events but maintaining the network users and the network devices, train a temporal graph authentication anomaly detection model with the past timestamped authentication events, the synthesized malicious authentication events and the other synthesized malicious authentication events, supply a subsequent timestamped authentication event to the trained temporal graph authentication anomaly detection model to determine whether the subsequent timestamped authentication event is a legitimate authentication event or a malicious authentication event, receive an indication from the trained temporal graph authentication anomaly detection model whether the subsequent timestamped authentication event is a legitimate authentication event or a malicious authentication event, and control the network based on the received indication that the subsequent timestamped authentication event is a legitimate authentication event or a malicious authentication event.
12 . The system of claim 11 , wherein the anomaly detection framework includes the temporal graph authentication anomaly detection model or wherein the anomaly detection framework communicates with the temporal graph authentication anomaly detection model.
13 . The system of claim 11 , wherein the anomaly detection framework is configured to generate time-respected local sub-streams and aggregated graph snapshots for each past timestamped authentication event and for each synthesized malicious authentication event.
14 . A system, comprising:
a storage configured to store:
an anomaly detection framework configured to accomplish:
receive past authentication events relating to a network, the past authentication events including a user linked to a machine with a temporal component, treating the past authentication events as positive authentication training events, employing filtered rewiring on the past authentication events to synthesize malicious negative authentication training events by changing the user or the machine that are linked in individual past authentication events and maintaining the temporal component and changing the temporal component of other individual past authentication events and maintaining the user and the machine,
train an anomaly detection model with the positive authentication training events and the synthesized malicious negative authentication training events, and
analyze a subsequent authentication event with the trained anomaly detection model to determine whether the subsequent authentication event is a legitimate authentication event or a malicious authentication event.
15 . The system of claim 14 , wherein the anomaly detection framework is further configured to perform dual history extraction on the positive authentication training events and the synthesized negative training events to generate stream-based views and aggregated graph-based snapshot-based views.
16 . The system of claim 14 , further comprising allowing or disallowing the subsequent authentication event based upon output of the trained anomaly detection model.