Choosing the right features
Following a predictive approach in order to detect possible user account violations, translates into the choice of the correct features to monitor. These vary according to the threats that we believe may be more likely to occur.
In the case of the prevention of attacks that are conducted through brute forcing user credentials (user ID and password), it may be sufficient to monitor the number of failed access attempts (logins) and detect their growth rate and variations over time In other cases, the monitored element could be the frequent number of password changes, failed logins, password recovery, and so on.
More difficult is the detection of possible stealth-mode attacks conducted by attackers who have the correct ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access