Enhancing security using anomaly detection

1. A computer-implemented method comprising:

generating certificate usage data that

identifies a process configured to authenticate to a computing system based on a certificate, and

represents historical certificate usage corresponding to the process;

detecting an authentication attempt by the process, the authentication attempt including the certificate;

determining that the authentication attempt is anomalous based on the certificate usage data; and

generating an alert control signal representing an alert based on the determining that the authentication attempt is anomalous.

2. The computer-implemented method of claim 1 , wherein generating the certificate usage data comprises:

generating certificate-specific usage data that

identifies a plurality of processes, each process, in the plurality of processes, configured to authenticate to the computing system based on the certificate, and

represents historical certificate usage by each process in the plurality of processes.

3. The computer-implemented method of claim 2 , and further comprising:

generating a stability signal indicating that the certificate-specific usage data has a threshold level of stability;

in response to the stability signal, generating a certificate-specific usage model that represents the certificate-specific usage data; and

determining that the authentication attempt is anomalous based on the certificate-specific usage model.

4. The computer-implemented method of claim 3 , and further comprising:

determining that the certificate-specific usage data has a threshold level of stability based on a determination that the certificate-specific usage data has less than a threshold number of changes within a period of time.

5. The computer-implemented method of claim 2 , and further comprising:

identifying, in near real time, each process in the plurality of processes, as the process authenticates to the computing system;

identifying, in near real time, the certificate that each process, in the plurality of processes, uses to authenticate to the computing system; and

executing an automated remediation process based on the determining that the authentication attempt is anomalous.

6. The computer-implemented method of claim 2 , and further comprising:

generating the certificate-specific usage data based on one or more event logs that indicate which processes authenticated to the computing system using the certificate.

7. The computer-implemented method of claim 1 , and further comprising:

accessing a master certificate identifier file that identifies authorized certificates for the computing system; and

based on a determination that the certificate is not identified in the master certificate identifier file, generating a new certificate anomaly signal and providing the new certificate anomaly signal to an alerting system.

8. The computer-implemented method of claim 1 , and further comprising:

detecting repeated authentication failures associated with the process;

generating an authentication failure anomaly signal representing the repeated authentication failures;

generating a severity level associated with the authentication failure anomaly signal; and

generating a near real time alert based on the severity level.

9. The computer-implemented method of claim 1 , and further comprising:

receiving feedback data indicative of an accuracy of anomaly detection based on the certificate usage data and performing machine learning to modify the anomaly detection based on the feedback data.

10. A computing system comprising:

at least one processor; and

memory storing instructions executable by the at least one processor, wherein the instructions, when executed, cause the computing system to:

generate certificate usage data that

identifies a process configured to authenticate to a computing system based on a certificate, and

represents historical certificate usage corresponding to the process;

detect an authentication attempt by the process, the authentication attempt including the certificate;

determine that the authentication attempt is anomalous based on the certificate usage data; and

generate an alert control signal representing an alert based on the determination that the authentication attempt is anomalous.

11. The computing system of claim 10 , wherein the instructions, when executed, cause the computing system to:

generate certificate-specific usage data that

identifies a plurality of processes, each process configured to authenticate to the computing system based on the certificate, and

represents historical certificate usage by each process in the plurality of processes.

12. The computing system of claim 11 , wherein the instructions, when executed, cause the computing system to:

generate a stability signal indicating that the certificate-specific usage data has a threshold level of stability;

in response to the stability signal, generate a certificate-specific usage model that represents the certificate-specific usage data; and

determine that the authentication attempt is anomalous based on the certificate-specific usage model.

13. The computing system of claim 12 , wherein the instructions, when executed, cause the computing system to:

determine that the certificate-specific usage data has a threshold level of stability based on a determination that the certificate-specific usage data has less than a threshold number of changes within a period of time.

14. The computing system of claim 11 , wherein the instructions, when executed, cause the computing system to:

identify, in near real time, each process in the plurality of processes, as the process authenticates to the computing system;

identify, in near real time, the certificate that each process, in the plurality of processes, uses to authenticate to the computing system; and

execute an automated remediation process based on the determination that the authentication attempt is anomalous.

15. The computing system of claim 11 , wherein the instructions, when executed, cause the computing system to:

generate the certificate-specific usage data based on one or more event logs that indicate which processes authenticated to the computing system using the certificate.

16. The computing system of claim 10 , wherein the instructions, when executed, cause the computing system to:

detect repeated authentication failures associated with the process;

generate an authentication failure anomaly signal representing the repeated authentication failures;

generate a severity level associated with the authentication failure anomaly signal; and

generate a near real time alert based on the severity level.

17. The computing system of claim 10 wherein the instructions, when executed, cause the computing system to:

receive feedback data indicative of an accuracy of anomaly detection based on the certificate usage data and perform machine learning to modify the anomaly detection based on the feedback data.

18. A computing system comprising:

at least one processor; and

memory storing instructions executable by the at least one processor, wherein the instructions, when executed, implement:

a certificate usage tracking system configured to:

generate certificate usage data that

identifies a process configured to authenticate to a computing system based on a certificate, and

represents historical certificate usage corresponding to the process;

a certificate usage anomaly detection system configured to:

detect an authentication attempt by the process, the authentication attempt including the certificate;

determine that the authentication attempt is anomalous based on the certificate usage data; and

an alert generation system configured to generate an alert control signal representing an alert based on the determination that the authentication attempt is anomalous.

19. The computing system of claim 18 , wherein the certificate usage tracking system is configured to:

generate certificate-specific usage data that

identifies a plurality of processes, each process, in the plurality of processes, configured to authenticate to the computing system based on the certificate, and

represents historical certificate usage by each process in the plurality of processes.

20. The computing system of claim 19 , wherein the instructions implement:

stability identifying logic configured to:

determine that the certificate-specific usage data has a threshold level of stability based on a determination that the certificate-specific usage data has less than a threshold number of changes within a period of time;

generate a stability signal indicating that the determination that the certificate-specific usage data has the threshold level of stability; and

a model generation system configured to:

in response to the stability signal, generate a certificate-specific usage model that represents the usage data.