User session-based generation of logical graphs and detection of anomalies
AssigneeLacework Inc.
InventorsHarish Kumar Bharat Singh, Vikram Kapoor, Murat Bog, Yijou Chen
Life of this patent
Estimating the term…
Abstract
Log data associated with at least one user session in a network environment associated with an original user is received. A logical graph is generated using at least a portion of the received log data. One example of such a logical graph is a privilege change graph that models privilege changes between processes. Another example of such a logical graph is a user login graph that models machines with which the original user interacts. Another example of such a logical graph is a machine-server graph that clusters machines into nodes based on resources executing on the machine. The generated logical graph is used to detect an anomaly.
Claims18
A system, comprising:
- a processor configured to:
- generate, based on log data associated with at least one user session in a network environment associated with an original user, a logical graph, wherein the logical graph comprises:
- (1) a first node corresponding to the original user, (2) at least a second node, and (3) a set of edges, wherein the set of edges include at least one edge connecting the first node to the second node;
- use the generated logical graph to detect an anomaly, wherein detecting the anomaly includes determining that a change has been made to the set of edges, wherein the anomaly is associated with a second user different from the original user, and wherein the detecting the anomaly includes determining an association between the second user and the original user;
- and
- in response to detecting the anomaly, take a remedial action;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
A method, comprising:
- generating, based on log data associated with at least one user session in a network environment associated with an original user, a logical graph, wherein the logical graph comprises:
- (1) a first node corresponding to the original user, (2) at least a second node, and (3) a set of edges, wherein the set of edges include at least one edge connecting the first node to the second node;
- using the generated logical graph to detect an anomaly, wherein detecting the anomaly includes determining that a change has been made to the set of edges, wherein the anomaly is associated with a second user different from the original user, and wherein the detecting the anomaly includes determining an association between the second user and the original user;
- and
- in response to detecting the anomaly, taking a remedial action.
A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
- generating, based on log data associated with at least one user session in a network environment associated with an original user, a logical graph, wherein the logical graph comprises:
- (1) a first node corresponding to the original user, (2) at least a second node, and (3) a set of edges, wherein the set of edges include at least one edge connecting the first node to the second node;
- using the generated logical graph to detect an anomaly, wherein detecting the anomaly includes determining that a change has been made to the set of edges, wherein the anomaly is associated with a second user different from the original user, and wherein the detecting the anomaly includes determining an association between the second user and the original user;
- and
- in response to detecting the anomaly, taking a remedial action.
Dependencies are inferred from the claim text.