A Method for Estimating the Trustworthiness of a Group of Users Accessing Accounts During Authentication

As the use of information technology (IT) in the business operations of organizations such as companies is progressing, and the online services of the organizations become increasingly prevalent in employees of companies, etc., threats such as abuse of online services by third parties and attacks on the network and servers have emerged. To reduce the risk of such threats, it is necessary to estimate the degree of the trustworthiness of users who have accessed online service accounts and to understand what threats exist for each individual user's access. Furthermore, to grasp the overall picture of threats to the network and online services, it would be useful and effective to estimate the percentage of users who have accessed online service accounts in a certain period with the intent to attack. This paper proposes and evaluates a method to estimate the trustworthiness of a group of users who have accessed online service accounts in a certain period as the percentage of accesses from the users associated with their accounts among all accesses that include those with the intent to attack. The method also uses only information on each user's behavior observable while the network is operational, apart from the authentication results. The results show that the proposed method can estimate the percentage of accesses from the users associated with their accounts with an error of a few percent and be effective at controlling the strength of security measures, including the strength of authentication, in the operation of the network and online services, depending on the increase or decrease in the percentage of accesses from the users associated with their accounts.