# US 12,113,831 B2 · Privilege assurance of enterprise computer network environments using lateral movement detection and prevention

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,113,831 B2
- Document ID: US12113831B2
- Status: Granted
- Kind: B2
- Application number: 17/363,866
- Filed: 2021-06-30
- Published: 2022-02-24
- Granted: 2024-10-08
- Earliest claimed: 2015-10-28
- Assignees: Qomplx LLC
- Applicants: Qomplx LLC
- Inventors: Jason Crabtree; Andrew Sellers; Richard Kelley
- Web page: https://patentgrep.com/patent/US12113831B2

## CPC

- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- G06F 16/2477: {Temporal data queries}
- G06F 16/951: Indexing; Web crawling techniques
- G06F 21/316: {by observing the pattern of computer usage, e.g. typical user behaviour}
- G06F 21/577: {Assessing vulnerabilities and evaluating computer system security}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/1433: {Vulnerability analysis}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 67/306: User profiles
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A system and method for the privilege assurance of enterprise computer network environments using lateral movement detection and prevention. The system uses local session monitors to monitor logon sessions within a network, generating and verifying event logs and authentication records to ensure the legitimacy of authenticated user sessions and to revoke credentials when an illicit session is detected, halting lateral movement in real-time.

## Claims

### Claim 1

A system for privilege assurance of enterprise computer network environments using lateral movement detection and prevention, comprising:
a local session monitor comprising a first plurality of programming instructions stored in a memory of, and operating on a processor of, a first computing device within a computer network operating a directory access protocol, wherein the first plurality of programming instructions, when operating on the processor of the first computing device, cause the first computing device to:
receive a first plurality of session-based details for an authentication session for a user;
check the validity of the first plurality of session-based details, using a stored session configuration;
log the first plurality of session-based details;
receive a second plurality of session details;
compare the first and second pluralities of session details against a stored expected pattern to identify any mismatched data;
where invalid or mismatched information is identified in the first or second plurality of session-based details or in the comparison against a stored expected pattern, revoke authentication credentials for the authentication session and generate an event log indicating the particular session-based details that contain the invalid or mismatched information;
send the event log to a graph engine;
a graph engine comprising a second plurality of programming instructions stored in a memory of, and operating on a processor of, a second computing device, wherein the second plurality of programming instructions, when operating on the processor of the second computing device, cause the second computing device to:
receive the event log;
create and store a cyber-physical graph of the computer network using the event log, wherein the vertices of the cyber-physical graph represent directory access protocol objects and the edges of the cyber-physical graph represent the relationships between those objects;
perform a plurality of queries over time on the cyber-physical graph to identify a cyberattack parameter of interest;
receive results of the plurality of queries;
analyze the results to determine a plurality of high-risk hosts, the high-risk hosts being determined based on the number and value of user accounts associated with each object in the cyber-physical graph and its connections to neighboring objects; and
create and store a lateral movement path map comprising a plurality of identified paths involving each of the plurality of high-risk nodes.

### Claim 2 (depends on 1)

The system of claim 1, wherein the first plurality and the second plurality of session-based details comprise information about the user's granted privilege levels.

### Claim 3 (depends on 1)

The system of claim 1, wherein the first plurality and the second plurality of session-based details comprise historical user activity within the computer network.

### Claim 4

A method for privilege assurance of enterprise computer network environments using lateral movement detection and prevention, comprising the steps of:
receiving a first plurality of session-based details for an authentication session for a user;
checking the validity of the first plurality of session-based details, using a stored session configuration;
logging the first plurality of session-based details;
receiving a second plurality of session details;
comparing the first and second pluralities of session details against a stored expected pattern to identify any mismatched data;
where invalid or mismatched information is identified in the first or second plurality of session-based details or in the comparison against a stored expected pattern, revoking authentication credentials for the session and generating an event log indicating the particular session-based details that contain the invalid or mismatched information;
sending the event log to a graph engine;
receiving the event log;
creating and store a cyber-physical graph of a computer network using the event log, wherein the vertices of the cyber-physical graph represent directory access protocol objects and the edges of the cyber-physical graph represent the relationships between those objects;
performing a plurality of queries over time on the cyber-physical graph to identify a cyberattack parameter of interest;
receiving results of the plurality of queries;
analyzing the results to determine a plurality of high-risk hosts, the high-risk hosts being determined based on the number and value of user accounts associated with each object in the cyber-physical graph and its connections to neighboring objects; and
creating and storing a lateral movement path map comprising a plurality of identified paths involving each of the plurality of high-risk nodes.

### Claim 5 (depends on 4)

The method of claim 4, wherein the first plurality and the second plurality of session-based details comprise information about the user's granted privilege levels.

### Claim 6 (depends on 4)

The method of claim 4, wherein the first plurality and the second plurality of session-based details comprise historical user activity within the computer network.