# US 11,902,303 B2 · System and method for detecting lateral movement and data exfiltration > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,902,303 B2 - Document ID: US11902303B2 - Status: Granted - Kind: B2 - Application number: 17/816,040 - Filed: 2022-07-29 - Published: 2023-02-02 - Granted: 2024-02-13 - Earliest claimed: 2014-02-24 - Assignees: Juniper Networks, Inc. - Applicants: Cyphort Inc. - Inventors: Fengmin Gong; Alexander Burt; Frank Jas - Web page: https://patentgrep.com/patent/US11902303B2 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/554: {involving event detection and direct action} - G06F 21/561: {Virus type analysis} - G06F 21/564: {by virus signature recognition} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 63/102: {Entity profiles} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - G06F 2221/2111: Location-sensitive, e.g. geographical location, GPS - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system configured to detect a threat activity on a network. The system including a digital device configured to detect a first order indicator of compromise on a network, detect a second order indicator of compromise on the network, generate a risk score based on correlating said first order indicator of compromise on the network with the second order indicator of compromise on said network, and generate at least one incident alert based on comparing the risk score to a threshold. ## Claims ### Claim 1 A system for network management comprising: one or more devices on a network to: monitor network data transmitted over the network between a plurality of internal devices on the network and between at least one of the plurality of internal devices and at least one external device outside the network; detect a first order indicator of compromise on the network based on the network data transmitted over the network; detect a second order indicator of compromise on the network based on the network data transmitted over the network; detect one or more indicators of a compromised entity detected by a honey-host; correlate the one or more indicators of the compromised entity detected by the honey-host, the first order indicator of compromise on the network, and the second order indicator of compromise on the network, wherein the compromised entity is one of the plurality of internal devices; generate a risk score for the network data based on correlating the one or more indicators of the compromised entity detected by the honey-host, the first order indicator of compromise on the network, and the second order indicator of compromise on the network; and generate a preventative action on data associated with the network based on comparing the risk score and a threshold. ### Claim 2 (depends on 1) The system of claim 1, wherein the one or more devices are further to: detect the first order indicator of compromise on the network based at least in part on an analysis of east-west network traffic of the network data transmitted over the network; and detect the second order indicator of compromise on the network based at least in part on an analysis of north-south network traffic of the network data transmitted over the network. ### Claim 3 (depends on 1) The system of claim 1, wherein the compromised entity includes one or more of: a digital device, an application, or a rogue user on a network. ### Claim 4 (depends on 1) The system of claim 1, wherein the one or more devices are further to: collect the network data based on the network data being identified as malicious or malware. ### Claim 5 (depends on 1) The system of claim 1, wherein the one or more devices are further to: flag the network data as suspicious. ### Claim 6 (depends on 1) The system of claim 1, wherein first order indicator of compromise on the network includes one or more of: an attempt to prove the honey-host for open ports to gain access to the honey-host, or an attempt to examine or move data on a honey-host; and wherein the second order indicator of compromise includes a behavior pattern of the one or more devices observed from the one or more devices. ### Claim 7 (depends on 1) The system of claim 1, wherein the one or more devices are further to: detect real-time observations of an end-user device, the end-user device being associated with the network; compare the real-time observations and a behavior profile for the end-user device; and generate one or more anomalies based on the comparison of the real-time observations and the behavior profile for the end-user device. ### Claim 8 A non-transitory computer-readable medium storing instructions, the instructions comprising: one or more instructions that, when executed by one or more processors of a device, cause the one or more processors to: monitor network data transmitted over the network between a plurality of internal devices on the network and between at least one of the plurality of internal devices and at least one external device outside the network; detect a first order indicator of compromise on the network based on the network data transmitted over the network; detect a second order indicator of compromise on the network based on the network data transmitted over the network; correlate one or more indicators of a compromised entity detected by a honey-host, the first order indicator of compromise on the network, and the second order indicator of compromise on the network, wherein the compromised entity is one of the plurality of internal devices; generate a risk score for the network data based on correlating the one or more indicators of the compromised entity detected by the honey-host, the first order indicator of compromise on the network, and the second order indicator of compromise on the network; and generate a preventative action on data associated with the network based on comparing the risk score and a threshold. ### Claim 9 (depends on 8) The non-transitory computer-readable medium of claim 8, wherein the risk score is generated based on an asset value assigned to the device and a current security posture of the device. ### Claim 10 (depends on 8) The non-transitory computer-readable medium of claim 8, where the one or more instructions, when executed by the one or more processors, further cause the one or more processors to: detect the first order indicator of compromise on the network based at least in part on an analysis of east-west network traffic of the network data transmitted over the network; and detect the second order indicator of compromise on the network based at least in part on an analysis of north-south network traffic of the network data transmitted over the network. ### Claim 11 (depends on 8) The non-transitory computer-readable medium of claim 8, where the one or more instructions, when executed by the one or more processors, further cause the one or more processors to: generate a behavior profile for at least one end-user device under control of a network user. ### Claim 12 (depends on 8) The non-transitory computer-readable medium of claim 8, wherein the compromised entity includes one or more of: a digital device, an application, or a rogue user on a network. ### Claim 13 (depends on 8) The non-transitory computer-readable medium of claim 8, where the one or more instructions, when executed by the one or more processors, further cause the one or more processors to: collect the network data based on the network data being identified as malicious or malware. ### Claim 14 (depends on 8) The non-transitory computer-readable medium of claim 8, where the one or more instructions, when executed by the one or more processors, further cause the one or more processors to: flag the network data as suspicious. ### Claim 15 A method comprising: monitoring, by a device, network data transmitted over the network between a plurality of internal devices on the network and between at least one of the plurality of internal devices and at least one external device outside the network; detecting, by the device, a first order indicator of compromise on the network based on the network data transmitted over the network; detecting, by the device, a second order indicator of compromise on the network based on the network data transmitted over the network; detecting, by the device, one or more indicators of a compromised entity detected by a honey-host; correlating, by the device, the one or more indicators of the compromised entity detected by the honey-host, the first order indicator of compromise on the network, and the second order indicator of compromise on the network, wherein the compromised entity is one of the plurality of internal devices; generating, by the device, a risk score for the network data based on correlating the one or more indicators of the compromised entity detected by the honey-host, the first order indicator of compromise on the network, and the second order indicator of compromise on the network; and generating, by the device, a preventative action on data associated with the network based on the risk score. ### Claim 16 (depends on 15) The method of claim 15, wherein risk score is generated based on an asset value assigned to the device and a current security posture of the device. ### Claim 17 (depends on 15) The method of claim 15, further comprising: detecting the first order indicator of compromise on the network based at least in part on an analysis of east-west network traffic of the network data transmitted over the network; and detecting the second order indicator of compromise on the network based at least in part on an analysis of north-south network traffic of the network data transmitted over the network. ### Claim 18 (depends on 15) The method of claim 15, further comprising: detecting real-time observations of an end-user device, the end-user device being associated with the network; comparing the real-time observations and a behavior profile for the end-user device; and generating one or more anomalies based on the comparison of the real-time observations and the behavior profile for the end-user device. ### Claim 19 (depends on 15) The method of claim 15, further comprising: collecting the network data based on the network data being identified as malicious or malware. ### Claim 20 (depends on 15) The method of claim 15, wherein first order indicator of compromise on the network includes one or more of: an attempt to prove the honey-host for open ports to gain access to the honey-host, or an attempt to examine or move data on a honey-host; and wherein the second order indicator of compromise includes one or more of: a behavior pattern of the one or more devices observed from the one or more devices.