Preventing unauthorized access to secure information systems using advanced pre-authentication techniques

Patent metadata

Field	Value
Publication number	US-10965675-B2
Application number	US-201815920549-A
Country	US
Kind code	B2
Filing date	Mar 14, 2018
Priority date	Mar 14, 2018
Publication date	Mar 30, 2021
Grant date	Mar 30, 2021

Abstract

Aspects of the disclosure relate to preventing unauthorized access to secured information systems using advanced pre-authentication techniques. A computing platform may receive, from a local traffic manager, a first enriched access request associated with a first remote computing device. Then, the computing platform may apply a pre-authentication classification model to the first enriched access request associated with the first remote computing device. Thereafter, the computing platform may determine that the first enriched access request associated with the first remote computing device is likely malicious. Then, the computing platform may generate one or more first pre-authentication response commands directing client portal server infrastructure to process the first enriched access request associated with the first remote computing device as a malicious request. Subsequently, the computing platform may send the one or more first pre-authentication response commands to the client portal server infrastructure.

First claim

What is claimed is:

1. A computing platform, comprising:
at least one processor;
a communication interface communicatively coupled to the at least one processor; and
memory storing computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
receive, via the communication interface, from a local traffic manager, a first enriched access request associated with a first remote computing device;
based on receiving the first enriched access request associated with the first remote computing device from the local traffic manager, apply a pre-authentication classification model to the first enriched access request associated with the first remote computing device;
based on applying the pre-authentication classification model to the first enriched access request associated with the first remote computing device, determine that the first enriched access request associated with the first remote computing device is likely malicious;
based on determining that the first enriched access request associated with the first remote computing device is likely malicious, generate one or more first pre-authentication response commands directing client portal server infrastructure to process the first enriched access request associated with the first remote computing device as a malicious request; and
send, via the communication interface, to the client portal server infrastructure, the one or more first pre-authentication response commands directing the client portal server infrastructure to process the first enriched access request associated with the first remote computing device as a malicious request,
wherein receiving the first enriched access request associated with the first remote computing device from the local traffic manager comprises receiving, from the local traffic manager, one or more hypertext transfer protocol (HTTP) headers originating from a first access request received by the local traffic manager from the first remote computing device and additional enrichment information generated by the local traffic manager based on the first access request received by the local traffic manager from the first remote computing device, and
wherein applying the pre-authentication classification model to the first enriched access request associated with the first remote computing device comprises:
using a dependent probability machine learning model to calculate a probability that the first enriched access request associated with the first remote computing device is likely malicious based on the one or more HTTP headers originating from the first access request received by the local traffic manager from the first remote computing device and based on the additional enrichment information generated by the local traffic manager; and
based on the probability calculated using the dependent probability machine learning model exceeding a predetermined threshold, determining that the first enriched access request associated with the first remote computing device is likely malicious.

2. The computing platform of claim 1 , wherein sending the one or more first pre-authentication response commands directing the client portal server infrastructure to process the first enriched access request associated with the first remote computing device as a malicious request causes the client portal server infrastructure to deny access to the first remote computing device.

3. The computing platform of claim 1 , wherein sending the one or more first pre-authentication response commands directing the client portal server infrastructure to process the first enriched access request associated with the first remote computing device as a malicious request causes the client portal server infrastructure to connect the first remote computing device to a honeypot site in which actual user account information is not accessible.

4. The computing platform of claim 1 , wherein sending the one or more first pre-authentication response commands directing the client portal server infrastructure to process the first enriched access request associated with the first remote computing device as a malicious request causes the client portal server infrastructure to throttle communications associated with the first remote computing device.

5. The computing platform of claim 1 , wherein sending the one or more first pre-authentication response commands directing the client portal server infrastructure to process the first enriched access request associated with the first remote computing device as a malicious request causes the client portal server infrastructure to require step-up authentication credentials from the first remote computing device.

6. The computing platform of claim 1 , wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
prior to receiving the first enriched access request associated with the first remote computing device from the local traffic manager:
receive a known legitimate request reference dataset comprising HTTP header information associated with verified legitimate requests;
receive a known malicious request reference dataset comprising HTTP header information associated with verified malicious requests;
generate the pre-authentication classification model based on the known legitimate request reference dataset and the known malicious request reference dataset; and
store the pre-authentication classification model generated based on the known legitimate request reference dataset and the known malicious request reference dataset.

7. The computing platform of claim 1 , wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
after sending the one or more first pre-authentication response commands to the client portal server infrastructure, update the pre-authentication classification model based on determining that the first enriched access request associated with the first remote computing device is likely malicious.

8. The computing platform of claim 7 , wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
receive, via the communication interface, from the local traffic manager, a second enriched access request associated with a second remote computing device;
based on receiving the second enriched access request associated with the second remote computing device from the local traffic manager, apply the pre-authentication classification model to the second enriched access request associated with the second remote computing device;
based on applying the pre-authentication classification model to the second enriched access request associated with the second remote computing device, determine that the second enriched access request associated with the second remote computing device is likely not malicious;
based on determining that the second enriched access request associated with the second remote computing device is likely not malicious, generate one or more second pre-authentication response commands directing the client portal server infrastructure to process the second enriched access request associated with the second remote computing device as a legitimate request; and
send, via the communication interface, to the client portal server infrastructure, the one or more second pre-authentication response commands directing the client portal server infrastructure to process the second enriched access request associated with the second remote computing device as a legitimate request.

9. A method, comprising:
at a com

Assignees

• Bank Of America

Inventors

• Zhang Xianhong
• Pasumarthi Kalyan V
• Jacoby Jeffrey
• Shah Hitesh
• Agrawal Archie
• Toth Michael E
• Fu Yu

Classifications

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L63/1491

  using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment · CPC title

• H04L63/10 Primary

  for controlling access to devices or network resources · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title