US 2021/0243208 A1 · AUTOMATIC DETECTION OF ILLICIT LATERAL MOVEMENT

Abstract

Lateral movement between networked computers is detected, and automatically and efficiently assessed by a detection tool to distinguish innocent activity from cyberattacks. By correlating log data about logins and network traffic, the detection tool produces network node sets corresponding to individual movements. If a chain can be built from node sets matching an event sequence pattern that tends to be used by attackers, then the detection tool reports the chain as an illicit lateral movement candidate. Detection patterns define illicitness grounds such as consistency of data transfer sizes, shortness of login intervals, use of suspect protocols, chain scope, and the presence or use of administrator credentials. Detection responses may then isolate computers, inspect them for malware or tampering, obtain forensic images for analysis, tighten exfiltration filtering, and otherwise mitigate against ongoing or future cyberattacks.

Claims20

Dependent claims

A system configured for automatic detection of illicit lateral movement, the system comprising:

a memory;
a processor in operable communication with the memory, the processor configured to perform steps for detecting illicit lateral movement within a network of computers, the steps including (a) correlating at least login data and network traffic data, thereby producing network node sets, each network node set identifying a login event from a source computer to a target computer and also identifying a data transfer to the target computer, (b) building a chain from at least two of the node sets, the chain representing a sequence of events, the sequence of events including:
a second-computer-login into a second computer from a first computer, then a second-computer-data-transfer which transferred data from the first computer to the second computer, then a third-computer-login into a third computer from the second computer, and then a third-computer-data-transfer which transferred data from the second computer to the third computer, wherein a second-computer-data-transfer size of data transferred from the first computer to the second computer and a third-computer-data-transfer size of data transferred from the second computer to the third computer differ by no more than ten percent of the maximum of the two transfer sizes, and (c) reporting the chain as an illicit lateral movement candidate.

A method of detecting illicit lateral movement within a computer network, comprising automatically:

correlating at least login data and network traffic data, thereby producing network node sets, each node set identifying:
at least two login times for logins to respective computers of the node set, at least one administrator account on at least one computer of the node set, and at least one data transfer between computers of the node set;
building a chain from at least two of the node sets, the chain representing a sequence of events, the sequence of events including a login to a first computer as a first user, followed by a data transfer to the first computer, followed by a login to a second computer from the first computer using an administrator credential;
and
reporting the chain as an illicit lateral movement candidate.

2 more elements

Dependencies are inferred from the claim text.

Automatic detection of illicit lateral movement

Life of this patent

Automatic detection of illicit lateral movement

Life of this patent

Abstract

Claims20