Leveraging Machine Learning for Behavior-Based Access Control

Enterprises today need to be able to interact dynamically and share information with the right people at the right time. As a result, organizations continually add more interconnected systems to their network to allow information to be readily accessible to those that need it.  

However, while this interconnectedness is crucial for modern businesses to thrive, it also leaves them vulnerable to cyberattacks. And as enterprise environments become more complex, it’s becoming clear that traditional approaches to access control and threat monitoring simply aren’t sufficient in an increasingly severe cyber threat landscape. But some leading cybersecurity researchers think there could be a better way – Behavior-Based Access Control (BBAC).  

What Is Behavior-Based Access Control (BBAC)?

In simple words, Behavior-Based Access Control is a way of analyzing actor behavior and assessing the trustworthiness of information in real-time using machine learning algorithms. But before we can truly understand BBAC, we first have to understand how enterprises tackle these issues today.  

The Current State of Access Control

Companies currently use a combination of different technologies and methodologies to monitor their systems and grant access to information. 

The way we approach access control has evolved considerably over time and now includes methods like role-based (RBAC), team-based (TMAC), attribute-based (ABAC), context-based (CBAC), and Situation-Based (SitBAC) access control, among others. But while these approaches do a decent job of locking down information to authorized users, they’re not without drawbacks.  

Crucially, most current access control methods are grounded in static policies governed by access control rules. And this presents some significant security risks. For example, what happens if a bad actor steals an access card? Or if an insider performs illegitimate actions within their privilege realm? With traditional access control methods, bad actors can potentially go undetected for a considerable amount of time, exfiltrating data or wreaking havoc on the network.  

Misuse of information should be a top priority for any modern enterprise. Still, the situation becomes especially serious for companies that deal with highly sensitive data, like those in the healthcare, finance, and government sectors. And companies in these sectors (or sufficiently large companies in any industry) are increasingly moving towards large-scale distributed systems, where various components are spread across multiple computers on a network. But these systems are often as complex as they are large. As a result, managing access control at scale quickly becomes unmanageable, and errors often slip through the net.  

The Current State of Threat Monitoring

On the monitoring side, companies leverage technologies like the Snort or Bro network intrusion detection system or the Host-Based Intrusion Detection System (HIDS). And while these cybersecurity monitoring systems help safeguard corporate systems, they have several limitations. Namely, these types of solutions are typically signature-based and narrowly focused on specific parts of the overall systems. Signature-based monitoring can’t account for sophisticated attacks, like zero-day attacks, where signatures are yet unknown.  

Lastly, while companies today often collect vast amounts of useful security such as server logs, they don’t analyze this data in real-time. Instead, this data is used for offline forensics, potentially days, weeks, or even months after a security event. By this time, attackers have likely already completed their nefarious activities and are long gone.  

How BBAC Works

BBAC leverages machine learning to dynamically analyze actors’ intent and assess the trustworthiness of information within the system. But how?  

BBAC uses a combination of rule-based behavior signatures with statistical learning methods to create a more robust and flexible way of assigning and managing trust. So, for example, BBAC can analyze patterns in the network and adjust access over time and as needed. It can also respond to potential security events in real-time. For example, the machine learning algorithm can create a baseline for expected user behavior by using historical and real-time data. Anything that falls outside of this could be considered suspicious and warrant immediate action, either manually or through automation.  

This is contrary to how isolated traditional rule-based systems work, whereby once an actor gains access, they can essentially operate with impunity within their access rights.  

The idea here is that BBAC can diminish the risk of misplaced trust and deter the abuse of authorized privileges by continuously monitoring behavior. It analyzes observable behaviors on several different layers in real-time to check for intricate patterns that would otherwise go unnoticed. And by employing this type of sophisticated analysis, IT teams eliminate the need for draconian deny rules at specific layers in the system.   

At the same time, user-based BBAC can help alleviate some of the problems companies face when defining access. For example, let’s say a particular policy is set up to deny access to specific files if a user isn’t in an approved location. The machine learning model might detect that users continually request this type of access and alert the security team. Armed with this information, businesses can adjust their policies to allow more flexibility within certain contexts.  

The Nuts & Bolts of BBAC

So, what’s actually going on here? How does this machine learning thing really work? Machine learning is all about getting computers to “learn” and make decisions without explicit instructions. And for a machine-learning algorithm to learn, it needs to process vast amounts of data.  

For BBAC, the significant data comes in the form of network flow information (TCP and UDP), Higher-level transport protocols like (HTTP, XMPP, and SMTP), audit records (like those produced by web and DNS servers), and application-level content like PDF documents or email and chat messages.  

So, that’s the data that feeds the model, but what about the model itself? BBAC models are still in their infancy, but current examples use a combination of supervised and unsupervised machine learning to achieve full BBAC functionality.  

Supervised learning leverages labeled datasets designed to train or supervise the algorithm in classifying data and accurately predicting outcomes. So, for example, the algorithm becomes competent at separating data into specific categories, like expected network traffic and unexpected network traffic. This is called classification. The regression supervised learning method can also be used to understand the relationship between dependent and independent variables, which can be useful for predicting outcomes using numerical data.  

By contrast, unsupervised learning uses unlabeled datasets and allows the algorithm to discover hidden patterns without human intervention.  

Wrapping Up

Behavior-based access control has enormous potential to make enterprise environments more secure, flexible, and responsive. And as we progress through the 2020s, we expect to see more research in this area and likely adoption of this technology by reputable firms. The Department of Defense is actively interested in BBAC, so that should tell you something about where this approach is heading!