User login anomaly detection method and system
The invention relates to a method detecting one or more anomalies regarding logins of a user on an authentication system. The method includes at least one iteration of a monitoring phase that includes collecting a log of successful logins of the user on the authentication system, and calculating, for each monitored parameter, a probability density, in the log, of each predetermined value of the parameter. The method also includes calculating, for each parameter, a weight, as a function of the probability density of each predetermined value of the parameter, calculating an anomaly score for the log as a function of the weights and the probability densities; and comparing the anomaly score to a given threshold in order to determine an anomaly in the daily log for the user. The invention also relates to a computer program product and a device configured to carry out the method.
1 . A method for detecting one or more anomalies regarding logins of a user on an authentication system, wherein said method is configured to be implemented by a computer comprising a processor, wherein said authentication system comprises a local authentication system or a remote authentication system comprising a remote Active Directory (AD) authentication system, said method comprising:
at least one iteration of a monitoring phase for said user, said monitoring phase comprising collecting a log of successful logins of said user on said authentication system over a monitoring period by requesting said log of successful logins from the authentication system, wherein
said log comprises, for each successful login, measured values of several monitored parameters;
each measured value of each monitored parameter corresponds to a predetermined value among several predetermined values, wherein said several predetermined values comprise bins, previously defined for said each monitored parameter;
calculating, for said each monitored parameter, a probability density, in said log, of each predetermined value of said several predetermined values of said each monitored parameter;
calculating, for said each monitored parameter, a weight, as a function of said probability density of said each predetermined value of said each monitored parameter;
calculating an anomaly score for said log as a function of said weight of said each monitored parameter and said probability density of said each monitored parameter;
comparing said anomaly score to a given threshold in order to determine an anomaly in said log for said user, wherein
when said anomaly score is smaller than the given threshold, then no anomaly is detected and another iteration of said monitoring phase is carried out, and
when said anomaly score is equal to or greater than the given threshold, then said anomaly is detected; and
when said anomaly is detected, one or more of
stopping the anomaly by denying access to the user,
reporting the anomaly by emitting an alert to the user or to an administrator.
2 . The method according to claim 1 , wherein the monitoring period is a day.
3 . The method according to claim 1 , wherein, for said each successful login, the several monitored parameters comprise at least one of
a time of day (TOD) of the each successful login,
a day of week (DOW) of the each successful login, and
a geographical location (GEO) of the each successful login.
4 . The method according to claim 3 , wherein the bins are
TOW: 8 h-12 h; 12 h-16 h; 16 h-20 h; 20 h-24 h;
TOW: Monday; Tuesday; Wednesday; Thursday; Friday; Saturday; Sunday.
5 . The method according to claim 1 , wherein the probability density, P a (b), of a bin “b” of said bins of a parameter “a” of said several monitored parameters is calculated according to a formula comprising
P
a
(
b
)
=
T
L
+
1
T
L
U
+
B
a
Relation
1
with:
P a (b): the probability density of the bin “b” of the parameter “a”;
TL: a total number of logins for the user during the monitoring period for said bin “b”;
TLU: a total number of logins for the user during the monitoring period across all Bins B a ; and
B a : a total number of bins for said parameter “a”.
6 . The method according to claim 1 , wherein a weight W a of a parameter “a” of said several monitored parameters is calculated according to a formula comprising
W
a
(
c
)
=
∑
b
∈
a
[
P
a
(
b
❘
"\[LeftBracketingBar]"
c
)
*
log
B
(
a
)
[
1
P
a
(
b
❘
"\[LeftBracketingBar]"
c
)
]
]
Relation
2
with said user “c”:
P a (b|c): the probability density of a bin “b” of said bins of said parameter “a”; and
B a : a total number of bins for said parameter “a”.
7 . The method according to claim 1 , wherein the anomaly score, S, is calculated according to a formula comprising
S
=
1
-
(
∏
a
=
1
A
P
a
(
b
❘
"\[LeftBracketingBar]"
c
)
W
a
)
1
W
Relation
3
with for said user “c”:
W a : the weight of a parameter “a” of said several monitored parameters;
W: a sum of weights of all of the several monitored parameters; and
P a (b): the probability density of a bin “b” of said bins of said parameter “a”.
8 . A non-transitory computer program comprising instructions, which when executed by a computer, cause the computer to carry out a method for detecting one or more anomalies regarding logins of a user on an authentication system, wherein said method is configured to be implemented by said computer comprising a processor, wherein said authentication system comprises a local authentication system or a remote authentication system comprising a remote Active Directory (AD) authentication system, said method comprising:
at least one iteration of a monitoring phase for said user, said monitoring phase comprising
collecting a log of successful logins of said user on said authentication system over a monitoring period by requesting said log of successful logins from the authentication system, wherein
said log comprises, for each successful login, measured values of several monitored parameters;
each measured value of each monitored parameter corresponds to a predetermined value among several predetermined values, wherein said several predetermined values comprise bins, previously defined for said each monitored parameter;
calculating, for said each monitored parameter, a probability density, in said log, of each predetermined value of said several predetermined values of said each monitored parameter;
calculating, for said each monitored parameter, a weight, as a function of said probability density of said each predetermined value of said each monitored parameter;
calculating an anomaly score for said log as a function of said weight of said each monitored parameter and said probability density of said each monitored parameter;
comparing said anomaly score to a given threshold in order to determine an anomaly in said log for said user, wherein
when said anomaly score is smaller than the given threshold, then no anomaly is detected and another iteration of said monitoring phase is carried out, and
when said anomaly score is equal to or greater than the given threshold, then said anomaly is detected; and
when said anomaly is detected, one or more of
stopping the anomaly by denying access to the user,
reporting the anomaly by emitting an alert to the user or to an administrator.
9 . A device comprising:
a computerized device comprising a processor configured to carry out a method for detecting one or more anomalies regarding logins of a user on an authentication system,
wherein said authentication system comprises a local authentication system or a remote authentication system comprising a remote Active Directory (AD) authentication system,
wherein said method comprises
at least one iteration of a monitoring phase for said user, said monitoring phase comprising collecting a log of successful logins of said user on said authentication system over a monitoring period by requesting said log of successful logins from the authentication system, wherein
said log comprises, for each successful login, measured values of several monitored parameters;
each measured value of each monitored parameter corresponds to a predetermined value among several predetermined values, wherein said several predetermined values comprise bins, previously defined for said each monitored parameter;
calculating, for said each monitored parameter, a probability density, in said log, of each predetermined value of said several predetermined values of said each monitored parameter;
calculating, for said each monitored parameter, a weight, as a function of said probability density of said each predetermined value of said each monitored parameter;
calculating an anomaly score for said log as a function of said weight of said each monitored parameter and said probability density of said each monitored parameter;
comparing said anomaly score to a given threshold in order to determine an anomaly in said log for said user, wherein
when said anomaly score is smaller than the given threshold, then no anomaly is detected and another iteration of said monitoring phase is carried out, and
when said anomaly score is equal to or greater than the given threshold, then said anomaly is detected; and
when said anomaly is detected, one or more of stopping the anomaly by denying access to the user,
reporting the anomaly by emitting an alert to the user or to an administrator.