Privilege assurance of enterprise computer network environments using attack path detection and prediction

A computer-implemented method for privilege assurance of enterprise computer network environments using attack path detection and prediction, the computer-implemented method comprising:

• collecting a plurality of session details for a user authentication session;
• retrieving a plurality of host details pertaining to a computing device;
• monitoring activity during the authentication session;
• generating an event log based on the monitored activity;
• creating and storing a cyber-physical graph of a computer network using the event log and the session and host details, wherein the vertices or nodes of the cyber-physical graph represent directory access protocol objects and the edges of the cyber-physical graph represent the relationships between those objects;
• performing a plurality of queries over time on the cyber-physical graph to identify paths between the nodes;
• receiving a plurality of results of the plurality of queries;
• analyzing the plurality of results to determine a plurality of risk attributes associated with each of a plurality of the nodes in the graph, the risk attributes for each node being based at least in part on a determined value of the node and the node's connectivity to other nodes within any identified paths;
• creating and storing an attack path map comprising a plurality of identified paths that each exceed a plurality of stored risk conditions;
• storing iterative updates of the cyber-physical graph in a multi-dimensional time-series database at predetermined intervals or in response to specific events;
• retrieving a specific historical reference of the cyber-physical graph corresponding to a specified past time point or time window;
• and
• performing specific queries on the retrieved historical reference of the cyber-physical graph to analyze a network state of the computer network as it existed at the specified past time point or within the specified time window.

A system for privilege assurance of enterprise computer network environments using attack path detection and prediction, comprising one or more computers with executable instructions that, when executed, cause the system to:

• collect a plurality of session details for a user authentication session;
• retrieve a plurality of host details pertaining to a computing device;
• monitor activity during the authentication session;
• generate an event log based on the monitored activity;
• create and store a cyber-physical graph of a computer network using the event log and the session and host details, wherein the vertices or nodes of the cyber-physical graph represent directory access protocol objects and the edges of the cyber-physical graph represent the relationships between those objects;
• perform a plurality of queries over time on the cyber-physical graph to identify paths between the nodes;
• receive a plurality of results of the plurality of queries;
• analyze the plurality of results to determine a plurality of risk attributes associated with each of a plurality of the nodes in the graph, the risk attributes for each node being based at least in part on a determined value of the node and the node's connectivity to other nodes within any identified paths;
• create and store an attack path map comprising a plurality of identified paths that each exceed a plurality of stored risk conditions;
• store iterative updates of the cyber-physical graph in a multi-dimensional time-series database at predetermined intervals or in response to specific events;
• retrieve a specific historical reference of the cyber-physical graph corresponding to a specified past time point or time window;
• and
• perform specific queries on the retrieved historical reference of the cyber-physical graph to analyze a network state of the computer network as it existed at the specified past time point or within the specified time window.

Non-transitory, computer-readable storage media having computer-executable instructions embodied thereon that, when executed by one or more processors of a computing system using attack path detection and prediction for privilege assurance of enterprise computer network environments, cause the computing system to:

• collect a plurality of session details for a user authentication session;
• retrieve a plurality of host details pertaining to a computing device;
• monitor activity during the authentication session;
• and
• generate an event log based on the monitored activity;
• create and store a cyber-physical graph of a computer network using the event log and the session and host details, wherein the vertices or nodes of the cyber-physical graph represent directory access protocol objects and the edges of the cyber-physical graph represent the relationships between those objects;
• perform a plurality of queries over time on the cyber-physical graph to identify paths between the nodes;
• receive a plurality of results of the plurality of queries;
• analyze the plurality of results to determine a plurality of risk attributes associated with each of a plurality of the nodes in the graph, the risk attributes for each node being based at least in part on a determined value of the node and the node's connectivity to other nodes within any identified paths;
• create and store an attack path map comprising a plurality of identified paths that each exceed a plurality of stored risk conditions;
• store iterative updates of the cyber-physical graph in a multi-dimensional time-series database at predetermined intervals or in response to specific events;
• retrieve a specific historical reference of the cyber-physical graph corresponding to a specified past time point or time window;
• and
• perform specific queries on the retrieved historical reference of the cyber-physical graph to analyze a network state of the computer network as it existed at the specified past time point or within the specified time window.