Differentiating user authentication graphs

Abstract

Authentication using centralized methods is aprimary trust mechanism within most large-scale, enterprisecomputer networks. This paper proposes using graphs torepresent user authentication activity within the network. Usingthis mechanism over a real enterprise network dataset, we findthat non-privileged users and users with system administrationprivileges have distinguishable graph attributes in terms of sizeand complexity. In addition, we find that user authenticationgraphs provide intuitive insights into network user behavior.We believe that understanding these differences in even greaterdetail will lead to improved user behavior profiling and theelusive detection of authentication credential misuse. © 2013 IEEE.