# US 11,030,311 B1 · Detecting and protecting against computing breaches based on lateral movement of a computer file within an enterprise > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,030,311 B1 - Document ID: US11030311B1 - Status: Granted - Kind: B1 - Application number: 16/125,397 - Filed: 2018-09-07 - Granted: 2021-06-08 - Earliest claimed: 2018-09-07 - Assignees: CA, Inc. - Applicants: CA, Inc. - Inventors: Alejandro Mosquera Lopez - Web page: https://patentgrep.com/patent/US11030311B1 ## CPC - G06F 21/552: {involving long-term monitoring or reporting} - G06F 11/3006: {where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50)} - G06F 11/302: {where the computing system component is a software system} - G06F 11/3051: {Monitoring arrangements for monitoring the configuration of the computing system or of the computing system component, e.g. monitoring the presence of processing resources, peripherals, I/O links, software programs (verification or detection of system hardware configuration G06F11/2247)} - G06F 11/323: {Visualisation of programs or trace data} - G06F 11/34: Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation {; Recording or statistical evaluation of user activity, e.g. usability assessment} - G06F 18/21: Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation - G06F 21/554: {involving event detection and direct action} - G06F 21/565: {by checking file integrity} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06N 20/00: Machine learning - G06N 20/20: Ensemble learning - G06F 2201/81: Threshold - G06F 2201/835: Timestamp - G06F 2201/865: Monitoring of software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract Detecting and protecting against computing breaches based on lateral movement of a computer file within an enterprise. A method may include obtaining data associated with an existence a computer file in a first computing device and a second computing device of an enterprise, detecting a pattern of lateral movement of the computer from the first computing device to the second computing device over a predetermined period of time, based on the data, calculating a likelihood score that the computer file is malicious based on the detected pattern, determining that the likelihood score satisfies a predetermined breach threshold, and in response to determining that the likelihood score satisfies the predetermined breach threshold, initiating remedial action on the computer file to protect the enterprise against the computer file. ## Claims ### Claim 1 A computer-implemented method for detecting and protecting against a computing breach based on lateral movement of a computer file within an enterprise, at least a portion of the method being performed by a computing device comprising one or more processors, the method comprising: obtaining data associated with an existence a computer file in a first computing device and a second computing device of an enterprise; detecting a pattern of lateral movement of the computer file from the first computing device to the second computing device over a predetermined period of time, based on the data; generating a file movement graph comprising a first node and a second node, wherein the first node is associated with a first device and a first timestamp representative of when the computer file was determined to be associated with the first device, and wherein the second node is associated with a second device and a second timestamp of when the computer file was determined to be associated with the second device; calculating a likelihood score that the computer file is malicious based on the detected pattern and the file movement graph; determining that the likelihood score satisfies a predetermined breach threshold; and in response to determining that the likelihood score satisfies the predetermined breach threshold, initiating remedial action on the computer file to protect the enterprise against the computer file. ### Claim 2 (depends on 1) The method of claim 1, further comprising: calculating a context score using the detected pattern; determining that the context score satisfies a predetermined context threshold; and in response to determining that the context score satisfies the predetermined context threshold, providing context information about the computer file to a user, where the context information is in addition to data associated with the movement of the computer file. ### Claim 3 (depends on 1) The method of claim 1, wherein initiating remedial action on the computer file further comprises one or more of: deleting the computer file, quarantining the computer file, blocking the computer file from transfer to another device, or communicating the likelihood score to a user, or some combination thereof. ### Claim 4 (depends on 1) The method of claim 1, wherein obtaining data associated with the movement of the computer file further comprises one or more of: detecting a creation of the computer file, detecting update of the computer file, or detecting execution of the computer file, or some combination thereof. ### Claim 5 (depends on 1) The method of claim 1, wherein detecting and protecting against the computing breach, further comprises: detecting and protecting against computing malware. ### Claim 6 (depends on 1) The method of claim 1, wherein the first node includes a first identifier associated with the first device, and the second node includes a second identifier associated with the second device. ### Claim 7 (depends on 6) The method of claim 6, wherein: the second node further includes a third identifier associated with a third device. ### Claim 8 (depends on 1) The method of claim 1, further comprising: extracting at least one feature associated with the computer file from the file movement graph; and determining the likelihood score by training a machine learning model on the at least one extracted feature. ### Claim 9 (depends on 8) The method of claim 8, wherein extracting the at least one feature further comprises: extracting one or more features from metadata, a file name, a path, a parent executable, a number of computing devices where the computer file has been located during the predetermined period of time, an average number of devices associated with the computer file in the file movement graph, a total number of devices represented in the file movement graph, a distance in time from a most recent-in-time node to a first-in-time node, a distance in time from a most recent-in-time node to a second most recent-in-time node, an average number of unique files names, whether the computer file has a digital signature, a minimum entropy time at each node, or a maximum entropy time at each node, or some combination thereof. ### Claim 10 (depends on 8) The method of claim 8, wherein determining the likelihood score by training the machine learning model further comprises: determining the likelihood score using a binary classifier. ### Claim 11 (depends on 10) The method of claim 10, wherein determining the likelihood score using the binary classifier further comprises: using a Random Forest learning method. ### Claim 12 A computer device for detecting and protecting against detecting and protecting against a computing breach based on lateral movement of a computer file within an enterprise, comprising: a processor; a memory in electronic communication with the processor; and instructions stored in the memory, the instructions being executable by the processor to: obtaining data associated with an existence a computer file in a first computing device and a second computing device of an enterprise; detecting a pattern of lateral movement of the computer file from the first computing device to the second computing device over a predetermined period of time, based on the data; generating a file movement graph comprising a first node and a second node, wherein the first node is associated with a first device and a first timestamp representative of when the computer file was determined to be associated with the first device, and wherein the second node is associated with a second device and a second timestamp of when the computer file was determined to be associated with the second device; calculating a likelihood score that the computer file is malicious based on the detected pattern and the file movement graph; determining that the likelihood score satisfies a predetermined breach threshold; and in response to determining that the likelihood score satisfies the predetermined breach threshold, initiating remedial action on the computer file to protect the enterprise against the computer file. ### Claim 13 (depends on 12) The computer device of claim 12, wherein the instructions are further executable by the processor to: calculate a context score using the detected pattern; determine that the context score satisfies a predetermined context threshold; and in response to determining that the context score satisfies the predetermined context threshold, provide context information about the computer file to a user, where the context information is in addition to data associated with the movement of the computer file. ### Claim 14 (depends on 12) The computer device of claim 12, initiating remedial action further comprises one or more of: deleting the computer file, quarantining the computer file, blocking the computer file from transfer to another device, or communicating the likelihood score to a user, or some combination thereof. ### Claim 15 (depends on 12) The computer device of claim 12, wherein obtaining data associated with the movement of the computer file further comprises one or more of: detecting a creation of the computer file, detecting update of the computer file, or detecting execution of the computer file, or some combination thereof. ### Claim 16 (depends on 12) The computer device of claim 12, wherein the first node includes a first identifier associated with the first device, and the second node includes a second identifier associated with the second device. ### Claim 17 (depends on 12) The computer device of claim 12, wherein detecting and protecting against the computing breach, further comprises: detecting and protecting against computing malware. ### Claim 18 (depends on 16) The computer device of claim 16, wherein: the second node further includes a third identifier associated with a third device. ### Claim 19 (depends on 12) The computer device of claim 12, wherein the instructions are further executable to: extract at least one feature associated with the computer file from the file movement graph; and determine the likelihood score by training a machine learning model on the at least one extracted feature. ### Claim 20 One or more non-transitory computer-readable media comprising one or more computer readable instructions that, when executed by one or more processors of a computing device, cause the computing device to perform a method for detecting and protecting against a computing breach based on lateral movement of a computer file within an enterprise, the method comprising: obtaining data associated with an existence a computer file in a first computing device and a second computing device of an enterprise; detecting a pattern of lateral movement of the computer file from the first computing device to the second computing device over a predetermined period of time, based on the data; generating a file movement graph comprising a first node and a second node, wherein the first node is associated with a first device and a first timestamp representative of when the computer file was determined to be associated with the first device, and wherein the second node is associated with a second device and a second timestamp of when the computer file was determined to be associated with the second device; calculating a likelihood score that the computer file is malicious based on the detected pattern and the file movement graph; determining that the likelihood score satisfies a predetermined breach threshold; and in response to determining that the likelihood score satisfies the predetermined breach threshold, initiating remedial action on the computer file to protect the enterprise against the computer file.