Detection of anomalous key material
In representative embodiments, architectures to improve security through use of an anomaly score are disclosed. A set of cryptographic key material is used to create a model based on a dimensionality reduction and a density estimation that captures the expected behavior of the set of cryptographic key material. An anomaly score for presented cryptographic key material is calculated based on the model. The anomaly score represents the divergence from expectations for the presented cryptographic key material. The anomaly score can be used by a relying system to determine whether to trust the presented cryptographic key material. In this way, cryptographic key material that is valid can be tested to determine whether the cryptographic key material should be trusted even though it is valid.
1. A method for testing for anomalous cryptographic key material comprising:
obtaining a set of cryptographic key material, each cryptographic key material in the set having a set of attributes, the number of attributes in the set of attributes defining a dimensionality of the set of cryptographic key material;
creating an anomalous scoring model based on an estimated density derived from the set of cryptographic key material;
receiving cryptographic key material from a relying system;
calculating an anomaly score for the cryptographic key material based on the anomalous scoring model; and
returning the anomaly score to the relying system, the relying system using the anomaly score to determine whether to honor a request associated with the cryptographic key material.
2. The method of claim 1 , wherein creating the anomalous scoring model comprises at least the operations of:
receiving a bias vector defining relative importance of the set of attributes;
receiving a target dimension defining a dimensionality of an intermediate representation of the set of cryptographic key material;
reducing the dimensionality of the set of cryptographic key material to the target dimension utilizing a first selected numerical method to form the intermediate representation; and
creating the estimated density using the intermediate representation and a second selected numerical method.
3. The method of claim 2 wherein the first selected numerical method comprises at least one of:
independent component analysis; and
principle component analysis.
4. The method of claim 2 wherein the second selected numerical method comprises at least one of:
parzen window;
vector quantization;
multivariate histograms; and
kernel density estimation.
5. The method of claim 2 further comprising:
receiving a second bias vector; and
creating a second model based on the second bias vector and the set of cryptographic key material.
6. The method of claim 1 further comprising deploying the model to a second system.
7. The method of claim 1 , further comprising sending the model to a second system in order to update a model on the second system.
8. A machine-readable medium having executable instructions encoded thereon, which, when executed by at least one processor of a machine, cause the machine to perform operations comprising:
obtain a set of cryptographic key material, each cryptographic key material in the set having a set of attributes, the number of attributes in the set of attributes defining a dimensionality of the set of cryptographic key material;
create an anomalous scoring model based on an estimated density derived from the set of cryptographic key material;
receive cryptographic key material from a relying system;
calculate an anomaly score for the cryptographic key material based on the anomalous scoring model; and
return the anomaly score to the relying system, the relying system using the anomaly score to determine whether to honor a request associated with the cryptographic key material.
9. The medium of claim 8 , wherein creating the anomalous scoring model comprises at least the operations of:
receive a bias vector defining relative importance of the set of attributes;
receive a target dimension defining a dimensionality of an intermediate representation of the set of cryptographic key material;
reduce the dimensionality of the set of cryptographic key material to the target dimension utilizing a first selected numerical method to form the intermediate representation; and
create the estimated density using the intermediate representation and a second selected numerical method.
10. The medium of claim 9 wherein the first selected numerical method comprises at least one of:
independent component analysis; and
principle component analysis.
11. The medium of claim 9 wherein the second selected numerical method comprises at least one of:
parzen window;
vector quantization;
multivariate histograms; and
kernel density estimation.
12. The medium of claim 9 further comprising:
receive a second bias vector; and
create a second model based on the second bias vector and the set of cryptographic key material.
13. The medium of claim 8 further comprising deploying the model to a second system.
14. The medium of claim 8 , further comprising deploy the model to a second system in order to update a model on the second system.
15. A system comprising:
a processor and executable instructions accessible on a machine-readable medium that, when executed, cause the system to perform operations comprising:
obtain a set of cryptographic key material, each cryptographic key material in the set having a set of attributes, the number of attributes in the set of attributes defining a dimensionality of the set of cryptographic key material;
create an anomalous scoring model based on an estimated density derived from the set of cryptographic key material;
receive cryptographic key material from a relying system;
calculate an anomaly score for the cryptographic key material based on the anomalous scoring model; and
return the anomaly score to the relying system, the relying system using the anomaly score to determine whether to honor a request associated with the cryptographic key material.
16. The system of claim 15 , wherein creating the anomalous scoring model comprises at least the operations of:
receive a bias vector defining relative importance of the set of attributes;
receive a target dimension defining a dimensionality of an intermediate representation of the set of cryptographic key material;
reduce the dimensionality of the set of cryptographic key material to the target dimension utilizing a first selected numerical method to form the intermediate representation; and
create the estimated density using the intermediate representation and a second selected numerical method.
17. The system of claim 16 wherein the first selected numerical method comprises at least one of:
independent component analysis; and
principle component analysis.
18. The system of claim 16 wherein the second selected numerical method comprises at least one of:
parzen window; and
kernel density estimation.
19. The system of claim 16 further comprising:
receive a second bias vector; and
create a second model based on the second bias vector and the set of cryptographic key material.
20. The system of claim 15 further comprising deploying the model to a second system.