Method for detection of lateral movement of malware

A computer program comprising instructions which, when the computer program is executed by a processing unit, cause the processing unit to carry out a method for detecting malware penetrating a network by identifying anomalous communication between at least two systems of the network, the method being carried out by a computer and for each unique combination of Source IP address and destination IP address, the method comprising:

• considering a past period,
• considering network flow logs stored during said past period,
• calculating values of a metric based on data of the network flow logs within the past period and at a given frequency,
• calculating a baseline which consists in calculating an interquartile range (IQR) of all metric values calculated during the past period,
• determining an outlier threshold from the baseline,
• considering a current period,
• considering the network flow logs stored during said current period,
• calculating values of the metric based on data of the network flow logs within the current period,
• calculating the IQR of all metric values calculated during the current period, and
• classifying a communication between the at least two systems of the network of the each unique combination as an anomalous communication if the IQR of the current period is greater than the outlier threshold.

A non-transitory computer-readable storage medium encoded with computer-executable instructions which, when executed, perform a method for detecting malware penetrating a network by identifying anomalous communication between at least two systems of the network, the method being carried out by a computer and for each unique combination of Source IP address and destination IP address, the method comprising:

• considering a past period,
• considering network flow logs stored during said past period,
• calculating values of a metric based on data of the network flow logs within the past period and at a given frequency,
• calculating a baseline which consists in calculating an interquartile range (IQR) of all metric values calculated during the past period,
• determining an outlier threshold from the baseline,
• considering a current period,
• considering the network flow logs stored during said current period,
• calculating values of the metric based on data of the network flow logs within the current period,
• calculating the IQR of all metric values calculated during the current period, and
• classifying a communication between the at least two systems of the network of the each unique combination as an anomalous communication if the IQR of the current period is greater than the outlier threshold.