Session Duration Analysis
Definition
Analyzing the duration of user sessions in order to detect unauthorized activity.
How it works
Detecting unauthorized user sessions by comparing the duration of a user logon session with a baseline behavior model. The behavior model comprises historical user session duration times. Abnormalities between session duration and the behavior model may indicate suspicious activity.
Considerations
- Potential for false positives from anomalies that are not associated with malicious activity.
- Attackers may not differentiate their session duration enough to trigger an alert.
References
The following references were used to develop the Session Duration Analysis knowledge-base article.
(Note: the consideration of references does not imply specific functionality exists in an offering.)
Method and Apparatus for Network Fraud Detection and Remediation Through Analytics
MITRE Comments
This patent describes determining a confidence score to detect anomalies in user activity based on comparing a user's behavior profile with current user activity events. The following types of events are used to develop a user entity profile:
- logon and logoff times and locations
- starting or ending applications
- reading or writing files
- changing an entity 's authorization
- monitoring network traffic
User events that deviate from the entity profile over a certain threshold trigger a remedial action.
System, method, and computer program product for detecting and assessing security risks in a network
MITRE Comments
This patent describes calculating a risk score to detect anomalies in user activity based on comparing a user's current session with a user behavior model. The user behavior model is comprised of a number of histograms including:
- client devices from which the user logs in
- servers accessed
- data accessed
- applications accessed
- session duration
- logon time of day
- logon day of week
- geo - location of logon origination
The system has an initial training period with x number of days (e. g., 90 days) in which session data is recorded in behavior models before behavior analysis begins.The histograms are then used to determine anomalies between current session activity and a user's behavior model. Values for a histogram category are along one axis and the number of times the value is received for the category is along another axis. If a data point value associated with the current user session is over an anomaly threshold, an alert is generated.