Computer security and usage-analysis system

• US 10,581,977 B2
• Filed: 06/02/2016
• Issued: 03/03/2020
• Est. Priority Date: 06/02/2015
• Status: Active Grant

• Current Assignee: Altr Solutions, Inc.
• Original Assignee: Altr Solutions, Inc.
• Inventors: Goldfarb, Scott Nathaniel, Beecham, James Douglas, Struttmann, Christopher Edward, Martin, Gordon Earl, Martin, Peter Reuben
• Primary Examiner(s): Srivastava, Vivek
• Assistant Examiner(s): Raza, Muhammad
• Application Number:
  US15/171,347
• Publication Number:
  US 20190075168A1
• Time in Patent Office: 1,370 Days
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70

Abstract

Provided is a private and secure network that uses an authentication mechanism with a uniquely assigned private IP address and network credentials issued as part of a VPN certificate exchange. A first layer of authentication establishes a secure tunnel between user and VPN server, and a second layer of authentication connects that secure tunnel to the web site or resource, without passing the VPN certificate. Once authenticated, interaction between website or resource and user are automatically monitored for abnormal or malicious behavior and, if required, automatic verification and authentication response is generated.

Claims

1. A method of authenticating a user, the method comprising:

obtaining, with one or more processors, a log of user interactions with one or more client computing devices;

training, with one or more processors, an anomaly detection model based on the log of user interactions;

after training the anomaly detection model, with one or more processors, receiving a stream of events indicating user interactions with a given client computing device;

classifying, with one or more processors, the stream of events as indicating anomalous behavior based on the trained anomaly detection model; and

in response to the classification, adjusting, with one or more processors, network access privileges of the given client computing device, wherein;

training the anomaly detection model comprises;

determining candidate parameter values of the anomaly detection model;

comparing predictions of the anomaly detection model based on the candidate parameters to the log data to determine a measure of mismatch; and

adjusting the candidate parameters based on the measure of mismatch to reduce an amount of the mismatch;

classifying the stream of events as indicating anomalous behavior based on the trained anomaly detection model comprises determining a risk score and comparing the risk score to a threshold;

adjusting network access privileges of the given client computing device comprises;

sending a command to the given client computing device configured to cause the given client computing device to prompt the user for a credential value;

receiving the credentials from the given client computing device; and

determining that the credential value is incorrect and, in response, terminating network access to the given client computing device to at least some resources; and

classifying the stream of events as indicating anomalous behavior based on the trained anomaly detection model comprises comparing received events to predictions of time-series machine learning model.

2. The method of claim 1, wherein classifying the stream of events as indicating anomalous behavior based on the trained anomaly detection model comprises performing steps for monitoring user interaction with computer resources to detect malicious or inappropriate user behavior.

3. The method of claim 1, wherein

the time-series machine learning model comprises a hidden Marhov Markov model.

4. The method of claim 1, wherein the time-series machine learning model comprises a recurrent neural net.

5. The method of claim 1, wherein the time-series machine learning model comprises a long-short term memory (LSTM) model.

6. The method of claim 1, wherein the time-series machine learning model comprises a trained decision tree.

7. The method of claim 1, wherein the time-series machine learning model comprises a convolution neural net.

8. The method of claim 1, wherein the time-series machine learning model comprises an unsupervised machine learning model.

9. The method of claim 1, wherein the time-series machine learning model comprises a clustering model.

10. The method of claim 1, wherein the time-series machine learning model comprises a density based clustering model.

11. A tangible, non-transitory, machine-readable medium storing instructions that when executed by one or more processors effectuate operations comprising:

obtaining, with one or more processors, a log of user interactions with one or more client computing devices;

training, with one or more processors, an anomaly detection model based on the log of user interactions;

after training the anomaly detection model, with one or more processors, receiving a stream of events indicating user interactions with a given client computing device;

classifying, with one or more processors, the stream of events as indicating anomalous behavior based on the trained anomaly detection model; and

in response to the classification, adjusting, with one or more processors, network access privileges of the given client computing device, wherein;

training the anomaly detection model comprises;

determining candidate parameter values of the anomaly detection model;

comparing predictions of the anomaly detection model based on the candidate parameters to the log data to determine a measure of mismatch; and

adjusting the candidate parameters based on the measure of mismatch to reduce an amount of the mismatch;

classifying the stream of events as indicating anomalous behavior based on the trained anomaly detection model comprises determining a risk score and comparing the risk score to a threshold;

adjusting network access privileges of the given client computing device comprises;

sending a command to the given client computing device configured to cause the given client computing device to prompt the user for a credential value;

receiving the credentials from the given client computing device; and

determining that the credential value is incorrect and, in response, terminating network access to the given client computing device to at least some resources; and

classifying the stream of events as indicating anomalous behavior based on the trained anomaly detection model comprises comparing received events to predictions of time-series machine learning model.

12. The medium of claim 11, wherein classifying the stream of events as indicating anomalous behavior based on the trained anomaly detection model comprises performing steps for monitoring user interaction with computer resources to detect malicious or inappropriate user behavior.

13. The medium of claim 11, the time-series machine learning model comprises a hidden Markov model.

14. The medium of claim 11, wherein the time-series machine learning model comprises a recurrent neural net.

15. The medium of claim 11, wherein the time-series machine learning model comprises a long-short term memory (LSTM) model.

16. The medium of claim 11, wherein the time-series machine learning model comprises a trained decision tree.

17. The medium of claim 11, wherein the time-series machine learning model comprises a convolution neural net.

18. The medium of claim 11, wherein the time-series machine learning model comprises an unsupervised machine learning model.

19. The medium of claim 11, wherein the time-series machine learning model comprises a clustering model.

20. The medium of claim 11, wherein the time-series machine learning model comprises a density based clustering model.