System and method for detecting lateral movement and data exfiltration
AssigneeCyphort Inc.
InventorsFengmin Gong, Alexander Burt, Frank Jas
Life of this patent
Estimating the term…
Abstract
A system configured to detect a threat activity on a network. The system including a digital device configured to detect a first order indicator of compromise on a network, detect a second order indicator of compromise on the network, generate a risk score based on correlating said first order indicator of compromise on the network with the second order indicator of compromise on said network, and generate at least one incident alert based on comparing the risk score to a threshold.
Claims21
1-26. (canceled)
A method comprising:
- generating, by a device, a behavior profile for another device;
- detecting, by the device, one or more real-time observations;
- comparing, by the device, the one or more real-time observations and the behavior profile;
- generating, by the device and based on comparing the one or more real-time observations and the behavior profile, one or more anomalies;
- determining, by the device, whether the one or more anomalies is associated with a particular address;
- generating, by the device and based on the one or more anomalies being associated with the particular address, an incident alert;
- and
- quarantining, by the device and based on the incident alert, data associated with the other device.
A device, comprising:
- one or more memories;
- and
- one or more processors, communicatively coupled to the one or more memories, configured to:
- generate a behavior profile for another device;
- detect one or more real-time observations;
- compare the one or more real-time observations and the behavior profile;
- generate, based on comparing the one or more real-time observations and the behavior profile, one or more anomalies;
- determine whether the one or more anomalies is associated with a particular address;
- generate, based on the one or more anomalies being associated with the particular address, an incident alert;
- and
- quarantine, based on the incident alert, data associated with the other device.
A non-transitory computer-readable medium storing instructions, the instructions comprising:
- one or more instructions that, when executed by one or more processors, cause the one or more processors to:
- generate a behavior profile for another device;
- detect one or more real-time observations;
- compare the one or more real-time observations and the behavior profile;
- generate, based on comparing the one or more real-time observations and the behavior profile, one or more anomalies;
- determine whether the one or more anomalies is associated with a particular address;
- generate, based on the one or more anomalies being associated with the particular address, an incident alert;
- and
- quarantine, based on the incident alert, data associated with the other device.
Dependencies are inferred from the claim text.