Systems and methods for detecting and reacting to malicious activity in computer networks

A network system configured for detecting potentially malicious activity, the network system comprising:

• at least one computer-readable memory storing instructions;
• and
• at least one processor configured to execute the instructions to:
• receive data associated with a plurality of authentication messages associated with a ticket requesting client, wherein at least some of the received data includes secure ticket data, the authentication messages having been communicated over a network in accordance with a ticket granting authentication protocol;
• analyze the received data associated with the plurality of authentication messages;
• determine, based on the analysis, a plurality of first characteristics of the data associated with the authentication messages, wherein the first characteristics include the secure ticket data and information identifying the ticket requesting client;
• receive data associated with a new authentication message being communicated over the network and including purported secure ticket data;
• determine a plurality of second characteristics of the data associated with the new authentication message, wherein the second characteristics include the purported secure ticket data and information identifying a client associated with the authentication message;
• compare at least one of the first characteristics with at least one of the second characteristics to determine whether the purported secure ticket data is consistent with the secure ticket data and the client associated with the new authentication message is the same as the ticket requesting client;
• and
• generate, based on the comparison, an assessment of whether the new authentication message is indicative of the potentially malicious activity in the network.

A computer-implemented method for performing potentially malicious activity detection operations, comprising:

• receiving data associated with a plurality of authentication messages associated with a ticket requesting client, wherein at least some of the received data includes secure ticket data, the authentication messages having been communicated over a network in accordance with a ticket granting authentication protocol;
• analyzing the received data associated with the plurality of authentication messages;
• determining, based on the analyzing, a plurality of first characteristics of the data associated with the authentication messages, wherein the first characteristics include the secure ticket data and information identifying the ticket requesting client;
• receiving data associated with a new authentication message being communicated over the network and including purported secure ticket data;
• determining a plurality of second characteristics of the data associated with the new authentication message, wherein the second characteristics include the purported secure ticket data and information identifying a client associated with the new authentication message;
• comparing at least one of the first characteristics with at least one of the second characteristics to determine whether the purported secure ticket data is consistent with the secure ticket data and the client associated with the new authentication message is the same as the ticket requesting client;
• and
• generating, based on the comparison, an assessment of whether the new authentication message is indicative of the potentially malicious activity in the network.