Post-intrusion detection of cyber-attacks during lateral movement within networks

A system for detecting a cyber-attack within east-west traffic of a network, comprising:

• a processor;
• and
• a memory communicatively coupled to the processor, the memory comprises
• a data analyzer configured, when executed by the processor, to conduct one or more analyses of an object extracted from network traffic propagating between a first network device and a second network device within the network, the one or more analyses producing results including a plurality of indicators, and
• indicator detection logic communicatively coupled to the data analyzer, the indicator detection logic including software that is configured to, when executed by the processor, (i) identify a plurality of weak indicators within the plurality of indicators, (ii) assemble one or more groups of weak indicators from the plurality of weak indicators, and (iii) compare one or more patterns or sequences of indicators associated with known malware or cyber-attacks to the one or more groups of weak indicators to detect whether any of the one or more groups of weak indicators constitutes a strong indicator representing that a cyber-attack has occurred on the first or second network device.

A method for detecting a cyber-attack after infiltration and during lateral movement within a network, comprising:

• conducting one or more analyses of an object extracted from network traffic propagating from a first network device to a second network device within the network, the one or more analyses producing results including a plurality of indicators;
• identifying a plurality of weak indicators from the plurality of indicators, each weak indicator of the plurality of weak indicators corresponds to data that, by itself, is not definitive as to whether the data is associated with a cyber-attack;
• assembling one or more groups of weak indicators from the plurality of weak indicators;
• comparing one or more patterns or sequences of indicators associated with known malware or cyber-attacks to each of the one or more groups of weak indicators to detect whether any of the one or more groups of weak indicators constitutes a strong indicator representing that a cyber-attack has occurred on a compromised computing system;
• and
• generating an alert at least in response to detection of the strong indicator formed by a group of weak indicators of the one or more groups of weak indicators.

A cyber-attack analysis system to detect cyber-attacks by analyzing client-server traffic, the system comprising:

• a network interface including one or more network ports including circuitry needed to establish a connection to a network, the network interface to receive client-server traffic propagating in a network traffic including a plurality of communications between a client network device and a server network device;
• analysis logic to analyze communications within the received network traffic to identify a set of indicators;
• correlation logic to assemble one or more groups of weak indicators, each group including a plurality of weak indicators, from the set of indicators wherein a weak indicator corresponds to data that, by itself, is not definitive as to a cyber-attack, each of the one or more groups of weak indicators sharing a relatedness factor in accordance with one or more grouping rules, wherein the correlation logic conducts an analysis to determine whether each of the one or more groups of weak indicators is correlated with known malicious patterns or sequences of indicators, thereby producing at least one strong indicator and determining that a cyber-attack is being conducted based on presence of one or more strong indicators, and
• a reporting logic to report, via an input/output interface, the determination of the cyber-attack.