Analyzing user behavior patterns to detect compromised nodes in an enterprise network

A non-transitory computer-readable storage medium embodying a set of instructions, which when executed by one or more processors of a network security device protecting a network including a plurality of computer systems, causes the one or more processors to perform a method comprising:

• identifying top users of a plurality of users of the network exhibiting a first suspicious behavior in a form of login failures by determining a first set of users of the plurality of users each having a number of login failure events during a given time duration that is greater than a first threshold value, wherein each user of the first set of users is associated with a source computer in a first set of source computers of the plurality of computers;
• identifying from the first set of source computers, a second set of source computers, representing a subset of the first set of source computers exhibiting a second suspicious behavior in a form of new computer connections by determining, during the time duration, those source computers in the first set of source computers that initiated a number of new connections that is greater than a second threshold value;
• and
• classifying a third set of source computers, representing a subset of the second set of source computers exhibiting a third suspicious behavior in a form of consecutive new computer connections, as compromised source computers, by identifying those source computers in the second set of source computers that attempted their respective new connections in a sequence that results in a Shannon entropy measure computed based on the sequence that is greater than a third threshold value.

A threat detection system, the system comprising:

• a network security device protecting a network including a plurality of computer systems;
• a non-transitory computer-readable storage medium embodying a set of instructions, which when executed by one or more processors of the network security device, causes the one or more processors to perform a method including:
• identifying top users of a plurality of users of the network exhibiting a first suspicious behavior in a form of login failures by determining a first set of users of the plurality of users each having a number of login failure events during a given time duration that is greater than a first threshold value, wherein each user of the first set of users is associated with a source computer in a first set of source computers of the plurality of computers;
• identifying from the first set of source computers, a second set of source computers, representing a subset of the first set of source computers exhibiting a second suspicious behavior in a form of new computer connections by determining, during the time duration, those source computers in the first set of source computers that initiated a number of new connections that is greater than a second threshold value;
• and
• classifying a third set of source computers, representing a subset of the second set of source computers exhibiting a third suspicious behavior in a form of consecutive new computer connections, as compromised source computers, by identifying those source computers in the second set of source computers that attempted their respective new connections in a sequence that results in a Shannon entropy measure computed based on the sequence that is greater than a third threshold value.