Back to results
US 11,902,303 B2Granted
System and method for detecting lateral movement and data exfiltration
AssigneeJuniper Networks, Inc.
InventorsFengmin Gong, Alexander Burt, Frank Jas
Life of this patent
Estimating the term…
Abstract
A system configured to detect a threat activity on a network. The system including a digital device configured to detect a first order indicator of compromise on a network, detect a second order indicator of compromise on the network, generate a risk score based on correlating said first order indicator of compromise on the network with the second order indicator of compromise on said network, and generate at least one incident alert based on comparing the risk score to a threshold.
Claims20
A system for network management comprising:
- one or more devices on a network to:
- monitor network data transmitted over the network between a plurality of internal devices on the network and between at least one of the plurality of internal devices and at least one external device outside the network;
- detect a first order indicator of compromise on the network based on the network data transmitted over the network;
- detect a second order indicator of compromise on the network based on the network data transmitted over the network;
- detect one or more indicators of a compromised entity detected by a honey-host;
- correlate the one or more indicators of the compromised entity detected by the honey-host, the first order indicator of compromise on the network, and the second order indicator of compromise on the network,
- wherein the compromised entity is one of the plurality of internal devices;
- generate a risk score for the network data based on correlating the one or more indicators of the compromised entity detected by the honey-host, the first order indicator of compromise on the network, and the second order indicator of compromise on the network;
- and
- generate a preventative action on data associated with the network based on comparing the risk score and a threshold.
7 more elements
A non-transitory computer-readable medium storing instructions, the instructions comprising:
- one or more instructions that, when executed by one or more processors of a device, cause the one or more processors to:
- monitor network data transmitted over the network between a plurality of internal devices on the network and between at least one of the plurality of internal devices and at least one external device outside the network;
- detect a first order indicator of compromise on the network based on the network data transmitted over the network;
- detect a second order indicator of compromise on the network based on the network data transmitted over the network;
- correlate one or more indicators of a compromised entity detected by a honey-host, the first order indicator of compromise on the network, and the second order indicator of compromise on the network,
- wherein the compromised entity is one of the plurality of internal devices;
- generate a risk score for the network data based on correlating the one or more indicators of the compromised entity detected by the honey-host, the first order indicator of compromise on the network, and the second order indicator of compromise on the network;
- and
- generate a preventative action on data associated with the network based on comparing the risk score and a threshold.
6 more elements
A method comprising:
- monitoring, by a device, network data transmitted over the network between a plurality of internal devices on the network and between at least one of the plurality of internal devices and at least one external device outside the network;
- detecting, by the device, a first order indicator of compromise on the network based on the network data transmitted over the network;
- detecting, by the device, a second order indicator of compromise on the network based on the network data transmitted over the network;
- detecting, by the device, one or more indicators of a compromised entity detected by a honey-host;
- correlating, by the device, the one or more indicators of the compromised entity detected by the honey-host, the first order indicator of compromise on the network, and the second order indicator of compromise on the network,
- wherein the compromised entity is one of the plurality of internal devices;
- generating, by the device, a risk score for the network data based on correlating the one or more indicators of the compromised entity detected by the honey-host, the first order indicator of compromise on the network, and the second order indicator of compromise on the network;
- and
- generating, by the device, a preventative action on data associated with the network based on the risk score.
6 more elements
Dependencies are inferred from the claim text.