Harmonisation of privileged accounts : leveraging AI models for anomaly detection in enterprise environments

Abstract

In enterprise environments, there are various kinds of resources such as laptops, servers, compute resources, services etc. They are given with different levels of permissions to access. And these permission entries are managed by services called Active Directory. Manually reviewing large amounts of Active Directory data requires more human resource and are error prone in large enterprises. Anomalies, unusual permissions, or misconfigurations are not easily detectable in these environments as the permission entries often look normal. Privileged accounts have high access rights and are very critical for smooth functioning of organisation. Therefore, they are often the honeypot for attackers. This requires automated and modern framework to identify these unusual access patterns.

This thesis proposes an AI based framework for harmonising privilege account management and identifying anomalous patterns in accounts within enterprise environment. The real-time data is collected from the organisation’s Active Directory. The required attributes for machine learning model training such as object, ObjectClass, IdentityReference, Trustee, Access, Inherited, ApplyTo and Permission are collected. These raw data are fed to a pipeline where the data is cleaned, transformed as structured feature representations, modelled and trained. Among the modelling methods, Isolation Forest and KMeans clustering were finalised for framework as it suited all the requirements. Isolation Forest detects unusual permissions entries and trustee patterns whereas KMeans is used to detect trustees that have uncommon profiles. The pipeline also performs various types of detections such as ACE-level anomaly detection, Trustee-level anomaly detection, Trustee permission-token pattern detection and KMeans trustee clustering.

FastAPI-based monitoring dashboard was integrated to the framework to display results and make reviews and collaboration for security analysts easier. The dashboard displays anomalies on organisation and sub organisational levels for all models. Analysts can collaborate, review, and add comments about the found anomalies. These decisions and data are stored in SQLite database which provides data persistence. The dashboard also provides ability to download a local copy for storage and reviewing offline.

As the fully labelled anomaly data was not available due to the time constraints and scope of the thesis, uses two level of evaluation one is the domain-informed proxy rules such as Rare permission, Deny entries, ApplyTo scopes, higher ACE counts, high permission diversion and high ApplyTo diversity and the other is Operational feasibility.

This framework improves visibility and management of privileged accounts across organisational and sub organisational units. This research contributes to development of consistent and secure governance practice by solving practical problems in anomaly detection in large enterprise.