Systems and methods for detecting and reacting to malicious activity in computer networks
AssigneeCyberArk Software Ltd.
InventorMatan Hart
Life of this patent
Estimating the term…
Abstract
Described herein are systems and methods for performing detection operations on secure ticket data to detect potentially malicious activity. Embodiments may involve obtaining encrypted data from an encrypted portion of a secure ticket, the obtained encrypted data having been communicated over a network; obtaining a decryption key corresponding to the encrypted data; decrypting the encrypted data using the obtained decryption key to generate decrypted data elements; comparing the decrypted data elements to at least one of known valid data elements and known invalid data elements; and generating an assessment based on the comparison, the assessment identifying whether the secure ticket is indicative of potentially malicious activity in the network.
Claims28
A non-transitory computer readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform detection operations on secure ticket data to detect potentially malicious activity, comprising:
- obtaining encrypted data from an encrypted portion of a secure ticket, the obtained encrypted data having been communicated over a network as part of an authentication message in accordance with a ticket granting authentication protocol, the authentication message having been received by an intermediary network system;
- obtaining a decryption key corresponding to the encrypted data;
- decrypting the encrypted data using the obtained decryption key to generate decrypted data elements;
- comparing the decrypted data elements to known valid data elements, the known valid data elements including previously decrypted data associated with the secure ticket obtained from a plurality of authentication messages previously communicated over the network;
- and
- generating, by the intermediary network system, an assessment based on the comparison, the assessment identifying that the secure ticket is indicative of potentially malicious activity in the network when the decrypted data elements are not consistent with the previously decrypted data.
An intermediary network system configured for performing detection operations on message data to detect potentially malicious activity, the network system comprising:
- at least one computer-readable memory storing instructions;
- and
- at least one processor configured to execute the instructions to:
- obtain encrypted data from an encrypted portion of a message, the message and obtained encrypted data having been communicated over a network as part of an authentication message in accordance with a client authentication protocol, the authentication message having been received by the intermediary network system;
- obtain, from a network resource, a decryption key corresponding to the encrypted data, wherein the decryption key is obtained based on metadata associated with the message;
- decrypt the encrypted data using the obtained decryption key to generate decrypted data elements;
- compare the decrypted data elements to known valid data elements, the known valid data elements including previously decrypted data associated with the message obtained from a plurality of authentication messages previously communicated over the network;
- and
- generate an assessment based on the comparison, the assessment identifying that the message is indicative of potentially malicious activity in the network when the decrypted data elements are not consistent with the previously decrypted data.
A computer-implemented method for performing detection operations on message data to detect potentially malicious activity, comprising:
- obtaining encrypted data from an encrypted portion of a message, the message and obtained encrypted data having been communicated over a network as part of an authentication message in accordance with a client authentication protocol, the authentication message having been received by an intermediary network system;
- obtaining, from a network resource, a decryption key corresponding to the encrypted data, wherein the decryption key is obtained based on metadata associated with the message;
- decrypting the encrypted data using the obtained decryption key to generate decrypted data elements;
- comparing the decrypted data elements to known valid data elements, the known valid data elements including previously decrypted data associated with the message obtained from a plurality of authentication messages previously communicated over the network;
- and
- generating, by the intermediary network system, an assessment based on the comparison, the assessment identifying that the message is indicative of potentially malicious activity in the network when the decrypted data elements are not consistent with the previously decrypted data.
Dependencies are inferred from the claim text.