PROBE-BASED RISK ANALYSIS FOR MULTI-FACTOR AUTHENTICATION
A system for probe-based risk analysis for multi-factor authentication having a multi-dimensional time series data server configured to monitor and record a network's traffic data and to serve the traffic data to other modules and a directed computational graph module configured to probe connection destinations for a response, analyze any received responses, and determine a verification score needed before granting access based at least in part on the analysis of the received responses. A plurality of verification methods build up a user's verification score to required level to gain access.
1 . A computer system configured to execute software instructions stored on nontransitory machine-readable storage media, wherein the software instructions comprise instructions that:
receive traffic data from a network; and
upon identifying, from the received traffic data, a connection attempt from a user device of the network to a destination external to the network with unknown risk potential:
transmit a plurality of probe packets to the destination of the connection attempt;
receive a plurality of response packets from the destination of the connection attempt; and
determine a required verification score for granting access from the user device to the destination based at least in part on analysis of the received response packets.
2 . The system of claim 1 , wherein a plurality of verification methods is used to build up a user's verification score to the required verification score in order for the user to gain access to the intended address.
3 . The system of claim 1 , wherein the verification score is based at least in part on stored knowledge pertaining to the user.
4 . The system of claim 3 , wherein the stored knowledge pertaining to the user comprises at least knowledge of user access privileges to resources on the local network.
5 . The system of claim 2 , wherein at least a portion of the verification methods verifies visual media pertaining to the user.
6 . The system of claim 2 , wherein at least a portion of the verification methods checks and verifies biometric features of the user.
7 . The system of claim 2 , wherein at least a portion of the verification methods used are based on information obtained from untrusted parties.
8 . The system of claim 2 , wherein at least a portion of the verification methods used are based on information pertaining to the user's device.
9 . A computer-implemented method comprising the steps of:
receiving traffic data from a network; and
upon identifying, from the received traffic data, a connection attempt from a user device of the network to a destination external to the network with unknown risk potential:
transmitting a plurality of probe packets to the destination of the connection attempt;
receiving a plurality of response packets from the destination of the connection attempt; and
determining a required verification score for granting access from the user device to the destination based at least in part on analysis of the received response packets.
10 . The method of claim 9 , further comprising the step of requiring the user to use a plurality of verification methods to earn enough verification score in order to gain access to the intended destination.
11 . The method of claim 9 , wherein the verification score is based at least in part on stored knowledge pertaining to the user.
12 . The method of claim 11 , wherein the stored knowledge of the user comprises at least knowledge of user access privileges to resources on the local network.
13 . The method of claim 10 , wherein at least a portion of the verification methods verifies visual media pertaining to the user.
14 . The method of claim 10 , wherein at least a portion of the verification methods checks and verifies biometric features of the user.
15 . The method of claim 10 , wherein at least a portion of the verification methods used are based on information obtained from untrusted parties.
16 . The method of claim 10 , wherein at least a portion of the verification methods used are based on information pertaining to the user's device.