Detecting anomalous post-authentication behavior for a workload identity

Patent metadata

Field	Value
Publication number	US-12259968-B2
Application number	US-202217708855-A
Country	US
Kind code	B2
Filing date	Mar 30, 2022
Priority date	Feb 11, 2022
Publication date	Mar 25, 2025
Grant date	Mar 25, 2025

Abstract

Methods, systems, apparatuses, and computer-readable storage mediums described herein are configured to detect anomalous post-authentication behavior/state change(s) with respect to a workload identity. For example, audit logs that specify actions performed with respect to the workload identity of a platform-based identity service, a causing state change(s), while another identity is authenticated with the platform-based identity service, are analyzed. The audit log(s) are analyzed via a model for anomaly prediction based on actions. The model generates an anomaly score indicating a probability whether a particular sequence of the actions is indicative of anomalous behavior/state change(s). A determination is made that an anomalous behavior has occurred based on the anomaly score, and when anomalous behavior has occurred, a mitigation action may be performed that mitigates the anomalous behavior.

First claim

What is claimed is:

1. A computing system, comprising:
at least one memory that stores program code; and
a processing system, comprising one or more processors, configured to receive the program code from the at least one memory and, in response to at least receiving the program code, to:
receive activity log information corresponding to state change actions taken in a services platform for a workload identity of a service principal that is executed in the services platform, where the state change actions
take place during an associated authentication to the workload identity, and
involve workload identity credentials in an identity service of the services platform;

generate, for state change actions in a sequence combination of state change actions, probability values indicative of a likelihood that a particular state change action in the sequence combination of state change actions occurs after a state change action in the sequence combination of state change actions immediately preceding the particular state change action;
generate an anomaly score, via an action model, for the sequence combination of the state change actions by aggregating the probability values;
determine an anomalous state change has occurred based at least on satisfaction of a threshold condition associated with the anomaly score; and
perform a remedial action against the anomalous state change and within the services platform.

2. The computing system of claim 1 , wherein the associated authentication to the workload identity is an authentication of a user identity via user credentials;
wherein the processing system, in response to at least receiving the program code, is configured to:
receive an authentication score indicative of a risk assessment for the authentication of the user identity; and
combine the authentication score with the anomaly score to generate a combined score;

wherein satisfaction of the threshold condition associated with the anomaly score comprises the combined score satisfying the threshold condition.

3. The computing system of claim 2 , wherein the action model is a machine learning model that is trained based at least on first features of prior state change actions associated with the workload identity and second features of prior authentication scores associated with at least the user identity to determine probabilities of the prior state change actions occurring in their respective prior sequence combinations; and
wherein the machine learning model is an unsupervised machine learning model or a neural network-based machine learning model.

4. The computing system of claim 3 , wherein the first features comprise at least one of:
a respective identifier for each of the prior state change actions associated with the workload identity;
a respective time stamp indicating a time at which a respective one of the prior state change actions associated with the workload identity occurred; or
a respective network address from which a respective one of the prior state change actions associated with the workload identity was initiated.

5. The computing system of claim 1 , wherein said perform the remedial action includes at least one of:
to remove and replace one or more active credentials of the workload identity;
to audit administrator access to the workload identity; or
to restrict a permission to a web application programming interface (API) of the workload identity.

6. The computing system of claim 1 , wherein the anomaly score, generated for the sequence combination of the state change actions, indicates the anomalous state change as at least one of:
a deviation in an access pattern of the workload identity;
a creation of a new workload identity by the workload identity;
a self-signed certificate being added to the workload identity, the workload identity previously having only one or more certificates from a single certificate authority;
a user adding at least one first credential to the workload identity, the workload identity previously having any credentials added only by other users;
a second credential with an atypical validity lifetime being added to the workload identity;
a third credential being added to the workload identity that includes the workload identity in a new group, that includes the workload identity in a new directory role, or that elevates privileges of the workload identity; or
the workload identity utilizing a plurality of different credentials at least partially concurrently from at least two different network addresses to acquire one or more tokens.

7. The computing system of claim 1 , wherein said aggregating the probability values comprises:
determining an average negative log likelihood of the probability values.

8. A method performed by a computing system, the method comprising:
receiving activity log information corresponding to state change actions taken in a services platform for a workload identity of a service principal that is executed in the services platform, the state change actions
taking place during an associated authentication to the workload identity, and
involving workload identity credentials in an identity service of the services platform;

generating, for state change actions in a sequence combination of state change actions, probability values indicative of a likelihood that a particular state change action in the sequence combination of state change actions occurs after a state change action in the sequence combination of state change actions immediately preceding the particular state change action;
generating an anomaly score, via an action model, for the sequence combination of the state change actions by aggregating the probability values;
determining an anomalous state change has occurred based at least on satisfaction of a threshold condition associated with the anomaly score; and
performing a remedial action against the anomalous state change and within the services platform.

9. The method of claim 8 , wherein the associated authentication to the workload identity is an authentication of a user identity via user credentials;
the method further comprising:
receiving an authentication score indicative of a risk assessment for the authentication of the user identity; and
combining the authentication score with the anomaly score to generate a combined score;

wherein satisfaction of the threshold condition associated with the anomaly score comprises the combined score satisfying the threshold condition.

10. The method of claim 9 , wherein the action model is a machine learning model that is trained based at least on first features of prior state change actions associated with the workload identity and second features of prior authentication scores associated with at least the user identity to determine probabilities of the prior state change actions occurring in their respective prior sequence combinations; and
wherein the machine learning model is an unsupervised machine learning model or a neural network-based machine learning model.

11. The method of claim 10 , wherein the first features comprise at least one of:
a respective identifier for each of the prior state change actions associated with the workload identity;
a respective time stamp indicating a time at which a respective one of the prior state change actions associated with the workload identity occurred; or
a respective network address from which a respective one of the prior state change actions associated with the workload identity was initiated.

12. The method of claim 8 , wherein the remedial action includes at least one of:
removing and replacing one or more active credentials of the workload iden

Assignees

• Microsoft Technology Licensing Llc

Inventors

• Cambric Shinesa Elaine
• Calvo Maria Puertas
• Xu Ye
• Basseri Etan Micah
• Zambrano Sergio Romero
• Sakowicz Jeffrey Thomas

Classifications

• G06F2221/034

  Test or assess a computer or a system · CPC title

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06F21/34

  involving the use of external additional devices, e.g. dongles or smart cards · CPC title

• G06F21/55

  Detecting local intrusion or implementing counter-measures · CPC title

• H04W12/12

  Detection or prevention of fraud · CPC title