Enhancing security using anomaly detection

A computer implemented method, comprising:

• detecting a set of processes that authenticate to the computing system using a certificate;
• generating process/certificate usage data identifying each of the processes in the set of processes and the certificate;
• generating a certificate-specific usage model representing the process/certificate usage data;
• detecting that a given process is attempting to authenticate to the computing system using the certificate;
• accessing the certificate-specific usage model for the certificate to determine whether the attempted authentication is anomalous;
• if so, generating a certificate usage anomaly signal indicative of the anomalous attempted authentication;
• and
• generating an alert control signal to generate a near real time alert based on the certificate usage anomaly signal.

A computing system, comprising:

• a processor;
• a certificate usage tracking system that detects a set of processes that authenticate to the computing system using a certificate and generates process/certificate usage data identifying each of the processes in the set of processes and the certificate;
• a model generation system that generates a certificate-specific usage model representing the process/certificate usage data;
• a certificate usage anomaly detection system that detects that a given process is attempting to authenticate to the computing system using the certificate and accesses the certificate-specific usage model for the certificate to determine whether the attempted authentication is anomalous and, if so, generates a certificate usage anomaly signal indicative of the anomalous attempted authentication;
• new certificate identifying logic configured to access a master certificate identifier file that identifies authorized certificates for the computing system to determine whether the certificate is identified in the master certificate identifier file and if not, to generate a new certificate anomaly signal and provide it to the alerting logic;
• authentication failure detection logic configured to detect repeated authentication failures by the process and generate an authentication failure anomaly signal and provide it to the alerting logic;
• and
• alerting logic that generates an alert ranking based on the certificate usage anomaly signal, the new certificate anomaly signal and the authentication failure anomaly signal, and an alert control signal, based on the alert ranking, to generate a near real time alert.