Systems and Methods for Detecting and Reacting to Malicious Activity in Computer Networks

A network system configured for detecting potentially malicious activity, the network system comprising:

• at least one computer-readable memory storing instructions;
• and
• at least one processor configured to execute the instructions to:
• receive data associated with a plurality of authentication messages, wherein at least some of the received data includes secure ticket data, the authentication messages having been communicated over a network;
• analyze the received data associated with the plurality of authentication messages;
• determine, based on the analysis, a plurality of characteristics of the data associated with the authentication messages, wherein a characteristic from the plurality of characteristics includes the secure ticket data;
• receive data associated with a new authentication message communicated over the network;
• determine a plurality of characteristics of the data associated with the new authentication message;
• compare at least one determined characteristic of the new authentication message data with at least one of:
• a determined characteristic of the plurality of authentication messages data, known valid data, and known invalid data;
• and
• generate, based on the comparison, an assessment of whether the new authentication message is indicative of the potentially malicious activity in the network.

A computer-implemented method for performing potentially malicious activity detection operations, comprising:

• receiving data associated with a plurality of authentication messages, wherein at least some of the received data includes secure ticket data, the authentication messages having been communicated over a network;
• analyzing the received data associated with the plurality of authentication messages;
• determining, based on the analyzing, a plurality of characteristics of the data associated with the authentication messages, wherein a characteristic from the plurality of characteristics includes the secure ticket data;
• receiving data associated with a new authentication message communicated over the network;
• determining a plurality of characteristics of the data associated with the new authentication message;
• comparing at least one determined characteristic of the new authentication message data with at least one of:
• a determined characteristic of the plurality of authentication messages data, known valid data, and known invalid data;
• and
• generating, based on the comparison, an assessment of whether the new authentication message is indicative of the potentially malicious activity in the network.