Privilege assurance of enterprise computer network environments using lateral movement detection and prevention
AssigneeQomplx LLC
InventorsJason Crabtree, Andrew Sellers, Richard Kelley
Life of this patent
Estimating the term…
Abstract
A system and method for the privilege assurance of enterprise computer network environments using lateral movement detection and prevention. The system uses local session monitors to monitor logon sessions within a network, generating and verifying event logs and authentication records to ensure the legitimacy of authenticated user sessions and to revoke credentials when an illicit session is detected, halting lateral movement in real-time.
Claims6
A computer-implemented method for privilege assurance of enterprise computer network environments using lateral movement detection and prevention, the computer-implemented method comprising:
- collecting a plurality of session details for an authentication session for a user;
- checking the validity of the session details, using a stored session configuration;
- receiving additional session details;
- comparing the session details against a stored expected pattern to identify any mismatched data;
- revoking authentication credentials for the authentication session and generate an event log if invalid or mismatched information is identified;
- sending the event log to a graph engine;
- creating and storing a cyber-physical graph of the computer network using the event log, wherein the vertices represent directory access protocol objects and the edges represent relationships between those objects;
- performing a plurality of queries over time on the cyber-physical graph to identify a cyberattack parameter of interest;
- receiving results of the plurality of queries;
- analyzing the results to determine a plurality of high-risk hosts based on the number and value of user accounts associated with each object and its connections to neighboring objects;
- and
- creating and storing a lateral movement path map comprising a plurality of identified paths involving each of the plurality of high-risk nodes.
A system for privilege assurance of enterprise computer network environments using lateral movement detection and prevention, comprising one or more computers with executable instructions that, when executed, cause the system to:
- collect a plurality of session details for an authentication session for a user;
- check the validity of the session details, using a stored session configuration;
- receive additional session details;
- compare the session details against a stored expected pattern to identify any mismatched data;
- revoke authentication credentials for the authentication session and generate an event log if invalid or mismatched information is identified;
- send the event log to a graph engine;
- create and store a cyber-physical graph of the computer network using the event log, wherein the vertices represent directory access protocol objects and the edges represent relationships between those objects;
- perform a plurality of queries over time on the cyber-physical graph to identify a cyberattack parameter of interest;
- receive results of the plurality of queries;
- analyze the results to determine a plurality of high-risk hosts based on the number and value of user accounts associated with each object and its connections to neighboring objects;
- and
- create and store a lateral movement path map comprising a plurality of identified paths involving each of the plurality of high-risk nodes.
Dependencies are inferred from the claim text.