US 11,770,387 B1Granted

Graph-based detection of lateral movement in computer networks

AssigneeRapid7, Inc.

InventorsVasudha Shivamoggi, Roy Donald Hodgman, Katherine Wilbur

Life of this patent

Estimating the term…

Loading patent…

Abstract

Systems and methods are disclosed to implement a cyberattack detection system that monitors a computer network for lateral movement. In embodiments, the system uses network data from a computer network to build a baseline of connection behaviors for the network. Connection graphs are generated from new network data that indicate groups of nodes that made connections with one another during a last time interval. The graphs are analyzed for connection behavior anomalies and ranked to determine a subset of graphs with suspected lateral movement. Graphs with suspected lateral movement may be further analyzed to determine a set of possible attack paths in the lateral movements. The suspected attack paths are reported to network administrators via a notification interface. Advantageously, the disclosed system is able to detect potential lateral movements in localized portions of a network by monitoring for connection behavior anomalies in network data gathered from the network.

Claims20

Dependent claims

A system, comprising:

one or more hardware processors with associated memory that implement a cyberattack detection system, configured to:
collect network data from a computer network, wherein the network data indicates connections made or attempted among nodes of the computer network during a time interval and respective times that the connections were made or attempted;
generate a plurality of connection graphs from the network data, wherein each of the connection graphs indicates a subset of the nodes of the computer network that made or attempted connections with one another during the time interval and one or more anomalies in connection behavior of the subset of nodes during the time interval;
compute a graph metric for each of the connection graphs based on a highest degree of nodes in individual ones of the connection graphs and determine, based on the graph metric, a set of highest-ranking connection graphs to evaluate for a suspected lateral movement of a cyberattack during the time interval;
for each connection graph in the set of highest-ranking connection graphs:
determine a connection path from the connection graph, wherein the connection path indicates a series of nodes linked by a sequence of time-ordered connections and one or more anomalies in connection behavior of the series of nodes during the time interval;
and
compute a path metric of the connection path and determine, based on the path metric, that the connection path is a suspected attack path of the suspected lateral movement;
and
provide an output that indicates the suspected attack paths during the time interval.

7 more elements

A method, comprising:

performing, by one or more computers that implement a cyberattack detection system:
collecting network data from a computer network indicating connections made or attempted among nodes of the computer network during a time interval and respective times that the connections were made or attempted;
generating a plurality of connection graphs from the network data, wherein each of the connection graphs indicates a subset of the nodes of the computer network that made or attempted connections with one another during the time interval and one or more anomalies in connection behavior of the subset of nodes during the time interval;
computing a graph metric for each of the connection graphs based on a highest degree of nodes in individual ones of the connection graphs and determining, based on the graph metric, a set of highest-ranking connection graphs to evaluate for a suspected lateral movement of a cyberattack during the time interval;
determine, based on the graph metric, a set of highest-ranking connection graphs to evaluate for a suspected lateral movement of a cyberattack during the time interval;
for each connection graph in the set of highest-ranking connection graphs:
determining a connection path from the connection graph, wherein the connection path indicates a series of nodes linked by a sequence of time-ordered connections and one or more anomalies in connection behavior of the series of nodes during the time interval;
and
computing a path metric of the connection path and determining, based on the path metric, that the connection path is a suspected attack path of the suspected lateral movement;
and
generating an output indicating the suspected attack paths during the time interval.

8 more elements

One or more non-transitory computer-accessible storage media storing program instructions that when executed on or across one or more processors implement at least a portion of a cyberattack detection system and cause the cyberattack detection system to:

analyze network data collected from a computer network, wherein the network data indicates connections made or attempted among nodes of the computer network during a time interval and respective times that the connections were made or attempted;
generate a plurality of connection graphs from the network data, wherein each of the connection graphs indicates a subset of the nodes of the computer network that made or attempted connections with one another during the time interval and one or more anomalies in connection behavior of the subset of nodes during the time interval;
compute a graph metric for each of the connection graphs based on a highest degree of nodes in individual ones of the connection graphs and determine, based on the graph metric, a set of highest-ranking connection graphs to evaluate for a suspected lateral movement of a cyberattack during the time interval;
for each connection graph in the set of highest-ranking connection graphs:
determine a connection path from the connection graph, wherein the connection path indicates a series of nodes linked by a sequence of time-ordered connections and one or more anomalies in connection behavior of the series of nodes during the time interval;
and
compute a path metric of the connection path and determine, based on the path metric, that the connection path is a suspected attack path of the suspected lateral movement;
and
generate output that indicates the suspected attack paths during the time interval.

6 more elements

Dependencies are inferred from the claim text.