Real-time detection of risky edges in lateral movement paths

Abstract

Detection of risky edges in lateral movement paths by determining the weakest points in the configuration of user accounts, groups, and devices that can access resources of tenants of cloud services. A lateral movement graph with nodes for user accounts, devices, and groups and edges representing relationships between the nodes is used to calculate a risk score for each edge in the graph. The risk score of the edge is used to identify weak connections and potential targets for lateral movement attacks.

Description

Background Art

[0001] Cybersecurity techniques utilize multiple defense mechanisms to prevent the risk of attacks on an organization's computer systems. Lateral movement is a type of attack in which a cybercriminal moves through a network using credentials and privileges stolen from each computing device in the path. The cybercriminal infiltrates the initial device to obtain credentials and / or privileges that allow the cybercriminal to access and compromise other computing devices within the network. Ultimately, the cybercriminal locates credentials with elevated privileges to access domain controllers and other highly secure computing devices, where the cybercriminal can potentially compromise all computers within the organization's domain except for external domains associated with the organization. If lateral movement is not detected, a global intrusion can result in catastrophic consequences. Often, real-time detection of lateral movement attacks may not be timely enough to prevent such catastrophic consequences. Summary of the invention

[0002] This Summary is provided to introduce some concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.

[0003] Detection of risky edges in a lateral movement graph by identifying the weakest points in the configuration of entities (e.g., user accounts, groups, devices) that can access tenant resources of cloud services. The lateral movement graph includes paths from non-sensitive entities to sensitive entities. Each edge in the lateral movement graph is analyzed in real time to identify risky edges that are likely to be vulnerable to lateral movement attacks.

[0004] A lateral movement graph is a directed acyclic graph with nodes representing user accounts, devices, and groups and edges representing the relationship between two nodes connected to the edge. Each node is classified as sensitive or non-sensitive depending on the permissions, roles, and credentials associated with the node's entity. The graph contains paths from non-sensitive nodes to sensitive nodes. Each edge in each lateral movement graph is analyzed to determine whether the edge could lead to a lateral movement attack against a sensitive entity based on the paths that the edge is a part of and the entities in those paths and the relationships of the entities.

[0005] A risk score is calculated for each edge in the graph based on the number of different non-sensitive nodes that cannot be reached when the edge is separated, the number of different sensitive nodes that cannot be reached when the edge is separated, and the number of different paths that contain the edge. The risk score for an edge identifies whether the edge is on a path to a sensitive node for which preventive action should be taken.

[0006] These and other features and advantages will become apparent by reading the following detailed description and examining the associated drawings.It is to be understood that both the foregoing general description and the following detailed description are explanatory only and are not restrictive of the aspects, as claimed. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] Figure 1 An exemplary system for identifying risky edges in a lateral movement graph in real time is shown.

[0008] Figure 2 is a schematic diagram illustrating an exemplary lateral movement graph.

[0009] Figure 3 is an exemplary flow chart illustrating a method for detecting risky edges in a lateral movement graph in real time.

[0010] Figure 4 is a diagram illustrating an example report that identifies risky entities and recommends actions to prevent lateral movement attacks.

[0011] Figure 5 is an exemplary flow chart illustrating a method for assigning a risk score to each edge of a lateral movement graph.

[0012] Figure 6A-6H is a schematic diagram showing an example of identifying risk edges.

[0013] Figure 7 is a block diagram illustrating an exemplary operating environment. DETAILED DESCRIPTION

[0014] Overview

[0015] The present subject matter relates to detecting risky edges in a lateral movement graph representing tenants of a cloud service. A cloud service provides convenient, on-demand network access to a shared pool of configurable computing resources that can be quickly provisioned and released with nominal management effort or interaction with a service provider. A cloud service allows cloud consumers (i.e., users, customers) to obtain various types of computing resources on demand. A cloud service provides a security service that monitors the configuration of resources and the behavior of users accessing the resources in real time in order to detect connections between user accounts, groups, or devices that may lead to lateral movement attacks.

[0016] In one aspect, a lateral movement graph represents the configuration state of entities that can access resources of a tenant of a cloud service. The lateral movement graph includes paths from non-sensitive nodes to sensitive nodes. The lateral movement graph is a directed acyclic graph having nodes representing user accounts, devices, and management groups and edges representing relationships between entities represented by the nodes. Each node is classified as sensitive or non-sensitive depending on the permissions, roles, and credentials associated with the entity of the node. Each edge in each path is analyzed to determine whether the edge can facilitate a lateral movement attack.

[0017] A risk score is calculated for each edge in the lateral movement graph. In one aspect, the risk score is a weighted sum of three values: the number of distinct non-sensitive nodes that cannot be reached when the edge is detached from the graph; the number of distinct detached sensitive nodes that cannot be reached when the edge is detached from the graph; and the number of distinct paths that contain the edge. The risk score for each edge is used to identify potential exposures for which preventive actions are recommended or performed to eliminate potential lateral movement attacks. The risk score can be used to identify risky edges in a lateral movement path from a non-sensitive entity to a sensitive entity.

[0018] Attention will now turn to further discussion of the systems, devices, components, and methods utilized in the systems.

[0019] system

[0020] Figure 1 A block diagram of an exemplary system 100 is shown in which various aspects of the invention may be practiced. In one aspect, the exemplary system 100 includes a cloud service 102 coupled to one or more user devices 106 via a network 104. The cloud service 102 may include one or more servers 108A-108N coupled to a security service 110 and a management service 112.

[0021] Cloud services 102 are computing environments for enabling convenient, on-demand network access to a shared pool of configurable computing resources that can be quickly provisioned and released with nominal management effort or interaction with a service provider. Cloud services 102 allow cloud consumers to obtain computing resources (such as networks, network bandwidth, servers, processing memory, storage, applications, virtual machines, and services) as a service on an elastic and sometimes temporary basis. The cloud service platform and infrastructure allow developers to build, deploy, and manage assets and resources for applications.

[0022] In one aspect, cloud service 102 hosts resources 114A-114N of multiple tenants 116A-116N. Tenants 116A-116N are directories associated with enterprises, organizations, groups, users, or entities that subscribe to cloud service 102. Tenants 116A-116N contain resources grouped into subscriptions, such as virtual machines, applications, application programming interfaces (APIs), storage accounts, services, etc. A subscription is an object that represents a folder where a resource resides. Tenants 116A-116N can have many subscriptions. Resources 114A-114N are entities managed by cloud service 102.

[0023] Cloud services 102 host tenants' subscriptions and control access to the resources contained within the subscriptions. Subscriptions can be paid or free and last for a specified length of time. Examples of cloud services include, but are not limited to, Microsoft Azure, Azure Active Directory, and Azure Active Directory. Google Cloud Platform TM , wait.

[0024] Cloud servers 108A-108N can be part of a data center that provides distributed computing services (such as cloud computing services). The data center can provide pooled resources, and customers or tenants can dynamically configure and scale applications on the pooled resources as needed without having to add servers or additional networks. The data center can be configured to communicate with local computing devices (including personal computers, mobile devices, embedded systems, or other computing devices) used by cloud consumers. Within the data center, the computing device can be configured as a server, which is either a stand-alone device or a separate blade server in a rack of one or more other server devices. Tenants can initially use one virtual machine on the server to run the application. When demand increases, the data center can activate additional virtual machines on the server or on other servers, and as demand decreases, the data center can deactivate virtual machines.

[0025] A data center can be a locally deployed private system that provides services to a single enterprise user, or it can be a publicly (or semi-publicly) accessible distributed system that provides services to multiple, possibly unrelated customers and tenants, or it can be a combination of both. In addition, a data center can be contained within a single geographic location, or can be distributed to multiple locations around the world and provide redundancy and disaster recovery capabilities. For example, a data center can designate one virtual machine on a server as the primary location for a tenant application, and can activate another virtual machine on the same server or another server as a secondary or backup in case the first virtual machine or server fails.

[0026] Tenants 116A-116N can communicate with other devices via a network 104 (such as the Internet), including communicating with each other or communicating with devices located outside of cloud services 102. In one example, tenants 116A-116N can communicate with other devices via assigned network addresses (such as assigned Internet Protocol (IP) addresses). In one example, users of devices 106 can log in to tenants 116A-116N and access resources 114A-114N. In some examples, resources 114A-114N are available to authorized users, and users can have further restrictions via permissions in a set of permission levels for each authorized user for each resource in cloud services 102.

[0027] Management service 112 helps users log in and access resources 114A-114N of tenants 116A-116N, including external resources (such as software-as-a-service applications) and applications on tenant networks and intranets, such as using single sign-on (SSO). In one aspect, management service 112 provides similar features to domain directory services, such as configuration, authentication, and authorization of user groups. However, management service 112 is different from domain directory services because domain directory services cannot manage web-based services.

[0028] A domain directory service is a database that organizes the resources of a computer network and provides authentication and authorization to applications, file services, printers, and other locally deployed resources. A domain directory service or name service maps the names of network resources to their corresponding network addresses. A domain directory service is a shared information infrastructure for locating, managing, governing, and organizing everyday items and network resources (which include volumes, folders, files, printers, users, groups, devices, phone numbers, and other objects). A domain directory service can treat each resource on the network as an object. Information about a particular resource is stored as a collection of attributes associated with the resource or object. An example of a domain directory service is a service from Microsoft Corporation called "Active Directory Domain Service". An exemplary domain directory service can authorize all users and computers in a domain-type network, which can include assigning and implementing security policies for all computers and installing or updating software. For example, when a user logs on to a computer that is part of a domain, the domain directory service checks the submitted password and determines whether the user is a system administrator or a normal user. In addition, the domain directory service allows the management and storage of information, provides authentication and authorization mechanisms, and establishes a framework for the deployment of other related services (such as certificate services, federation services, lightweight directory services, and rights management services). In one example, the domain directory service uses protocols such as Kerberos and New Technology Local Area Network Manager (NTLM) for authentication, and uses the Lightweight Directory Access Protocol (LDAP) to query and modify items in the domain directory service.

[0029] In contrast, the management service 112 is configured to support web-based services that apply REST (REpresentational State Transfer) APIs (application programming interfaces) for many software-as-a-service applications. The management service 112 applies protocols that are different from domain directory services. For example, the management service 112 applies protocols that can work with web-based services such as authentication protocols, including Security Assertion Markup Language (SAML), Open Authorization (OAuth), identity layers above the OAuth protocol (such as OpenID Connect), and Web Services Federation (WS-Federation). In one aspect, each tenant can apply an instance of the management service, such as the tenant's directory 118. The directory 118 can be configured to include the tenant's users, groups, and applications, and can perform identification and access management functions on the tenant's resources.

[0030] The user device 106 communicates with the cloud service via a REST API. The REST API is used to request information from the cloud service 102 or access resources from the cloud service 102 using a Hypertext Transfer Protocol (HTTP) method. The cloud service 102 responds by returning an HTTP response. The REST API is sent to an endpoint 120 of the cloud service 102. The endpoint 120 is a port that connects a device to a service hosted by the cloud service 102. The endpoint 120 is addressed by a uniform resource locator (URL) that the user device 106 uses to access resources or services hosted by the cloud service 102. The cloud service 102 can have multiple endpoints 120. In one aspect, the endpoint 120 is an API endpoint, each of which is configured to receive requests through a specified REST API.

[0031] The security service 110 protects and secures resources from malicious communications or other threats. In one example, the security service 110 may include controls to manage and configure the security of resources 114A-114N so as to customize security for tenants 116A-116N. The security service 110 may include isolation features to prevent unauthorized or unintentional data transfer between deployments of a multi-tenant architecture. In addition, the security service 110 may include network and endpoint protection in the form of firewalls and virtual firewalls. For example, the security service 110 may include a network group virtual firewall feature to control network traffic to instances of virtual machines. In addition, the security service 110 may utilize agents on each computing node, storage node, or fabric node in the environment to provide logging and monitoring of events including security-related events.

[0032] The security service 110 may include a lateral movement risky path identification (LMRPI) component 122 and a lateral movement path (LMP) graph generation component 124. The LMRPI component 122 identifies those paths with edges that represent the greatest risk for lateral movement vulnerabilities. Risky edges identify relationships between user accounts, devices, and / or login sessions that present vulnerabilities for lateral movement attacks.

[0033] The LMP graph generation component 124 generates a lateral movement graph 126 for each tenant that represents the relationships between users, devices, and groups associated with the tenant. In one aspect, the LMP graph generation component 124 retrieves data about the relationships between users, devices, and login sessions of the tenant from the management service 112 to build an LMP graph for the tenant 116. To identify lateral movement paths, an application programming interface (API) that provides access to a web service via an endpoint 120 is used to retrieve data about users, devices, groups, and login sessions. In one example, the LMP graph generation component 124 can use a REST API and security permissions that utilize the OAuth protocol. An example unified API endpoint and management service directory identity protection API are available under the Microsoft Graph API, which can provide programmatic access to the directory 118 of the management service 112. The LMP graph generation component 124 can also extract data about devices that join the management service 112, membership of roles and groups, administrators (such as local administrators, device administrators), and users or accounts that perform directory joins and login sessions with devices. Alternatively, the LMP map generation component 124 can be generated from a tool that monitors the behavior and activities of users and obtains information about each tenant, such as permissions and group membership. Examples of such software tools include ATP and Advanced threat analytics.

[0034] A domain is a collection of users and machines that share a common management infrastructure and can be accessed and managed using a common set of rules. At least one machine in the collection acts as a domain controller and hosts a member list that identifies all members of the domain. Administrators can be assigned tasks for specific purposes, such as adding or changing users in a domain, assigning roles, and managing domain names. Administrators have full and unrestricted access to a machine or domain.

[0035] Steering Figure 2 , an exemplary LMP graph 200 is shown. The LMP graph 200 is a directed acyclic graph containing one or more nodes connected by edges, where the edges have a direction from a source node to a sink node, and the graph does not have any cycles. The nodes represent entities associated with a tenant, such as a user or user account, a group, or a device, and the edges represent a relationship between two connected entities. The groups can be user account groups, administrator groups, and device groups.

[0036] Edges can represent "its admin", "its member", or "has session" relationships. An "its admin" edge represents that an administrator controls privileges to a device, an "its member" edge represents that a user is a member of a particular group, and "has session" represents that a particular device is currently in a user session or login session with a particular device. A path is a series of edges that connect a series of connected nodes. However, it should be noted that edges can represent other things besides Figure 2 Other relationships beyond those shown in , such as privileges, credentials, or permissions that each entity has over the other.

[0037] like Figure 2 As shown, user account "Bob" 202 is "a member of" 204 of group "IT Admins" 206. Group "IT Admins" 206 is "an administrator of" 208 of a computer identified as "Server1" 210. Computer "Server1" 210 currently "has a session" 212 with user account "Mary" 214, and user account "Mary" 214 is "a member of" 216 of group "Domain Admins" 218.

[0038] The LMP graph 200 also associates a label to each node indicating whether the node is sensitive or not. A sensitive node represents a device, user account, or group that has permissions, privileges, and / or credentials to highly sensitive data. Sensitive designations can apply to administrators, power users, account operators, domain administrators, domain controllers, group policy creator owners, and the like. Sensitive designations can also be user-defined to meet objectives. Sensitive designations are used to enhance detection of risky lateral movement paths. Non-sensitive designations apply to users, devices, and groups that are not considered sensitive. Figure 2 , nodes 206 and 218 are identified as sensitive because they represent the administrator group, and nodes 202, 210, and 212 are non-sensitive.

[0039] method

[0040] Attention will now be directed to the description of various exemplary methods utilizing the systems and devices disclosed herein. The operation of these aspects can be further described with reference to various exemplary methods. It is to be understood that, unless otherwise stated, representative methods do not necessarily have to be performed in the order presented or in any particular order. In addition, the various activities described about the method can be performed in a serial or parallel manner or in any combination of serial and parallel operations. In one or more aspects, the method illustrates the operation of the systems and devices disclosed herein.

[0041] Figure 3 An exemplary method 300 for identifying risk edges in a lateral movement graph is shown. Figure 1 and Figure 3, a lateral movement map 126 may be generated for each tenant 116A-116N in the cloud service 102 (block 302). As described above, the LMP map generation component 124 generates the lateral movement map 126 based on data retrieved from the management service 112, or obtains the map based on existing software tools. In addition, the LMP map generation component 124 periodically updates the LMP map 126 to obtain the latest tenant data. The updates may be performed at pre-configured time intervals or dynamically based on the frequency and / or occurrence of specific events.

[0042] For each tenant's LMP graph 126, the LMRPI component 122 calculates a risk score for each edge of the graph (block 304). The risk score identifies the riskiest edges most likely to be attacked by lateral movement and can be used to prioritize which edges require additional review (block 306).

[0043] Upon detecting a risky edge, the LMRPI component 122 may perform one or more preventive actions to stop the lateral movement attack (block 308). In one aspect, the preventive action may be a suggestion of an action that an administrator may perform. Alternatively, the cloud service 102 may initiate the preventive action itself. The preventive action may include removing a user account or device from a group, removing a group from a domain, preventing a user from logging into a device, removing a local administrator from a domain controller, and the like.

[0044] The LMP map generation component 124 periodically updates the LMP map 126 for each tenant (block 314) and repeats the process (block 310 - "No") to detect additional risk edges on the lateral movement path (blocks 304-308) until the process terminates (block 310 - "Yes", block 312).

[0045] Steering Figure 4 , shows an exemplary security report 400 identifying actions taken by the LMRPI component to prevent lateral movement attacks. The report 400 identifies an entity name 402 associated with a risk edge, an action 404 to be performed to prevent lateral movement attacks, a target device, account, or group 406 associated with the risk entity, and a security impact 408. The security impact 408 is a value derived from the risk score associated with the risk edge. Figure 4As shown, the User1 account has the riskiest security impact with a score of 442, and the recommended action is to remove the User1 account from the "Finance User Group" (row 410). The User20 account has a security impact of 20, and the recommended action is to block the User20 account from logging on to the RDPSV device (row 412). The TempAdmin account has a security impact of 10, and the recommended action is to remove the TempAdmin account from the Help Desk Server device (414). The Exch01 account has a security impact of 5, and the recommended action is to remove the Exch01 account from the Domain Admins group (416). The User3 account has a security impact of 5, and the recommended action is to block the User3 account from logging on to the DC5 device (418).

[0046] Steering Figure 5 , an exemplary method 500 illustrating a manner of calculating a risk score for an edge is shown. In one aspect, the risk score for an edge is calculated as a weighted sum of three values: the number of distinct separated non-sensitive nodes; the number of distinct separated sensitive nodes; and the number of distinct paths that contain the edge. A path is a series of edges that connect a series of distinct nodes. Distinct separated non-sensitive nodes are non-sensitive nodes that cannot be reached because when the particular edge is separated from the graph, there are no longer distinct paths to the non-sensitive node. Distinct separated sensitive nodes are sensitive nodes that cannot be reached because when the particular edge is separated from the graph, there are no longer distinct paths to the sensitive node. The risk score for an edge indicates that the edge is on a lateral movement path to a sensitive node.

[0047] refer to Figure 1 and Figure 5 , LMRPI component 122 receives lateral movement graph 126 having nodes for users, devices, and groups and edges for “whose admin,” “has a session,” and / or “whose member.” Certain nodes are designated as sensitive and other nodes are designated as non-sensitive.

[0048] The LMRPI component 122 calculates a risk score for each edge by performing a reverse traversal of the graph 126 starting from each sensitive node (block 502). In one aspect, the traversal may use a reverse depth-first search order, i.e., starting from a sensitive node, traversing each path from the sensitive node to each connected non-sensitive node (block 502).

[0049] For each edge in the path to the sensitive node 126 (block 504), the number of distinct separated non-sensitive nodes is calculated (block 506). This can be calculated by subtracting the list of reachable nodes with the edge intact from the list of reachable nodes with the edge removed (block 506).

[0050] Next, the number of distinct separated sensitive nodes is calculated (block 508). This number is set to 1 when there is no path to a non-sensitive node if the edge is removed (block 508). The number of distinct paths containing the edge is calculated as the difference between the number of intact paths in the graph with the edge removed and the number of paths in the graph with the edge removed (block 510).

[0051] The risk score is then derived as the sum of the number of distinct isolated non-sensitive nodes, the number of distinct isolated sensitive nodes, and the number of distinct paths containing the edge (block 512). In one aspect, the risk score may be a weighted sum with a weight applied to each value (block 512). There may be different weights for each value in the risk score calculation.

[0052] We now turn our attention to the illustration of the calculation of the risk score for each edge of the lateral movement graph. Fig. 6A , shows an exemplary lateral movement graph 600 containing several paths to a sensitive node (node ​​1). Graph 600 has directed edges from several non-sensitive nodes (nodes 2-5) to the sensitive node (node ​​1). The arrows of the edges in graph 600 show the direction of the relationship.

[0053] like Figure 6B As shown, the graph 602 is traversed from the sensitive node (node ​​1) in a reverse depth-first search manner to calculate the three values ​​required to calculate the risk score. The arrows of the edges point to the traversal direction, which starts from the sensitive node (node ​​1) and traverses to all non-sensitive nodes (nodes 2-5) along each path.

[0054] Figure 6C A graph 604 is depicted showing the calculation of a risk score for a directed edge from node 1 to node 2 (as indicated by edge 1->2). When the edge is removed, as indicated by the dashed line from node 1 to node 2, the number of distinct separate non-sensitive nodes is 4, including nodes 2, 3, 4, and 5. The number of distinct separate sensitive nodes is 1, since node 1 cannot be reached when edge 1->2 is removed. The number of distinct paths containing the edge is 5, including a path from node 1 to node 2, a path from node 1 to node 2 to node 3, a path from node 1 to node 2 to node 3 to node 4, a path from node 1 to node 2 to node 5, and a path from node 1 to node 2 to node 3 to node 5. The risk score for the edge is calculated as (W1*4)+(W2*1)+(W3*5), where W1 is a weight applied to the number of distinct separate non-sensitive nodes, W2 is a weight applied to the number of distinct separate sensitive nodes, and W3 is a weight applied to the number of distinct paths containing the edge (block 606).

[0055] Fig.6DA graph 608 is depicted showing the calculation of a risk score for an edge from node 2 to node 3 (as indicated by edge 2->3). When the edge is removed, as indicated by the dashed line between nodes 2 and 3, the number of distinct separate non-sensitive nodes is 2, including nodes 3 and 4. The number of distinct separate sensitive nodes is 0, since node 1 can be reached when edge 2->3 is removed. The number of distinct paths containing the edge is 3, including a path from node 2 to node 3, a path from node 2 to node 3 to node 4, and a path from node 2 to node 3 to node 5. The risk score for the edge is calculated as (W1*2)+(W2*0)+(W3*3), where W1, W2, and W3 are respective weights (block 610).

[0056] Fig. 6E A graph 612 is depicted showing the calculation of a risk score for an edge from node 2 to node 5 (as indicated by edge 2->5). When the edge is removed, as indicated by the dashed line between node 2 and node 5, the number of distinct separate non-sensitive nodes is 0, since there are paths to all non-sensitive nodes in the graph. The number of distinct separate sensitive nodes is 0, since node 1 can be reached when edge 2->5 is removed. The number of distinct paths containing the edge is 1, i.e., the path from node 2 to node 5. The risk score for the edge is calculated as (W1*0)+(W2*0)+(W3*1), where W1, W2, and W3 are respective weights (block 614).

[0057] Fig. 6F A graph 616 is depicted showing the calculation of a risk score for an edge from node 3 to node 4 (as indicated by edge 3->4). When the edge is removed, as indicated by the dashed line from node 3 to node 4, the number of distinct separate non-sensitive nodes is 1, since there is no longer a path to node 4. The number of distinct separate sensitive nodes is 0, since node 1 can be reached when edge 3->4 is removed. The number of distinct paths containing the edge is 1, i.e., the path from node 3 to node 4. The risk score for the edge is calculated as (W1*1)+(W2*0)+(W3*1), where W1, W2, and W3 are respective weights (block 618).

[0058] Figure 6GA diagram 620 is depicted showing the calculation of a risk score for an edge from node 3 to node 5 (as indicated by edge 3->5). When the edge is removed, as indicated by the dashed line from node 3 to node 5, the number of distinct separate non-sensitive nodes is 0, because there is a path to each of the non-sensitive nodes. The number of distinct separate sensitive nodes is 0, because node 1 can be reached when edge 3->5 is removed. The number of distinct paths containing the edge is 1, i.e., the path from node 3 to node 5. The risk score for the edge is calculated as (W1*0)+(W2*0)+(W3*1), where W1, W2, and W3 are respective weights (box 622).

[0059] Figure 6H 624 shows the risk score for each edge assuming no weights are applied. The risk score for edge 1->2 is 10, the risk score for edge 2->3 is 5, the risk score for edge 2->5 is 1, the risk score for edge 3->5 is 1, and the risk score for edge 3->4 is 2. These results indicate that the riskiest edge is edge 1->2, which is likely to be attacked by lateral movement.

[0060] Exemplary Operating Environment

[0061] Attention now turns to a discussion of an exemplary operating environment. Figure 7 An exemplary operating environment 700 is shown in which one or more computing devices of a cloud service are used to perform real-time identification of risky edges in lateral movement paths. Cloud service 702 is connected to one or more user devices 706 via a network 704. However, it should be noted that aspects disclosed herein are not limited to any particular configuration of devices, and other configurations are possible.

[0062] The cloud service 702 may be comprised of one or more computing devices 708, 724 coupled to a network 722. The computing devices 708, 724 may be any type of electronic device, such as, but not limited to, a mobile device, a personal digital assistant, a mobile computing device, a smart phone, a cellular phone, a handheld computer, a server, a server array or server farm, a web server, a network server, a blade server, an Internet server, a workstation, a microcomputer, a mainframe computer, a supercomputer, a network appliance, an Internet of Things (IOT) device, a web appliance, a distributed computing system, a multiprocessor system, or a combination thereof.

[0063] The computing devices 708, 724 may include one or more processors 710, 726, one or more communication interfaces 712, 728, one or more storage devices 714, 730, one or more input / output devices 718, 732, and one or more memory devices 716, 734. The processors 710, 726 may be any commercial or custom processors, and may include dual microprocessor and multi-processor architectures. The communication interfaces 712, 728 facilitate wired or wireless communications between the computing devices 708, 724 and other devices. The storage devices 714, 730 may be computer-readable media that do not contain propagation signals (such as modulated data signals transmitted by carrier waves). Examples of storage devices 714, 730 include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disks (DVD) or other optical storage devices, cassettes, tapes, magnetic disk storage devices, all of which do not contain propagation signals, such as modulated data signals transmitted by carrier waves. There may be multiple storage devices 714, 730 in the computing devices 708, 724. The input / output devices 718 , 732 may include a keyboard, a mouse, a pen, a voice input device, a touch input device, a display, a speaker, a printer, etc., and any combination thereof.

[0064] The memory devices 716, 734 can be any non-temporary computer-readable storage medium that can store executable programs, applications, and data. The computer-readable storage medium does not belong to a propagation signal, such as a modulated data signal transmitted by a carrier. It can be any type of non-temporary memory device (e.g., random access memory, read-only memory, etc.), magnetic storage device, volatile storage device, non-volatile storage device, optical storage device, DVD, CD, floppy disk drive, etc., which does not belong to a propagation signal, such as a modulated data signal transmitted by a carrier. The memory device 716 may also include one or more external storage devices or remote storage devices, which do not belong to a propagation signal, such as a modulated data signal transmitted by a carrier. The memory device 716 can be used to store various applications and data 720. The memory device 734 may include an operating system 736, a lateral movement risk path identification component 738, a lateral movement map generation component 740, a lateral movement map 742, and other applications and data 744.

[0065] The computing devices 708, 724 may be communicatively coupled to each other via the network 704 and to other devices via the network 722. The networks 704, 722 may be configured as an ad hoc network, an intranet, an extranet, a virtual private network (VPN), a local area network (LAN), a wireless LAN (WLAN), a wide area network (WAN), a wireless WAN (WWAN), a metropolitan area network (MAN), the Internet, a portion of a public switched telephone network (PSTN), a plain old telephone service (POTS) network, a wireless network, network or any other type of network or combination of networks.

[0066] The networks 704, 722 may employ various wired and / or wireless communication protocols and / or technologies. The different generations of communication protocols and / or technologies that may be employed by the network may include, but are not limited to, Global System for Mobile Communications (GSM), General Packet Radio Service (GPRS), Enhanced Data GSM Environment (EDGE), Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (W-CDMA), Code Division Multiple Access 2000 (CDMA-2000), High Speed ​​Downlink Packet Access (HSDPA), Long Term Evolution (LTE), Universal Mobile Telecommunications System (UMTS), Evolution-Data Optimized (Ev-DO), Worldwide Interoperability for Microwave Access (WiMax), Time Division Multiple Access (TDMA), Orthogonal Frequency Division Multiplexing (OFDM), Ultra-Wideband (UWB), Wireless Application Protocol (WAP), User Datagram Protocol (UDP), Transmission Control Protocol / Internet Protocol (TCP / IP), any part of the Open Systems Interconnection (OSI) model protocols, Session Initiation Protocol / Real-time Transport Protocol (SIP / RTP), Short Message Service (SMS), Multimedia Messaging Service (MMS), or any other communication protocol and / or technology.

[0067] One or more user devices 706 communicate with computing devices 708, 724 of cloud services 702 via a network 704. In one aspect, the network 704 is the Internet. As described above, the user device 706 may include one or more processors 746, a communication interface 748, one or more storage devices 750, an input / output device 752, and one or more memory devices 754. The one or more memory devices 754 include an operating system 756 and other applications and data 758.

[0068] in conclusion

[0069] A system having one or more processors coupled to a memory is disclosed. One or more programs are stored in the memory and are configured to be executed by the one or more processors. The one or more programs include instructions to: obtain a graph having a path, the path including nodes and edges, the nodes representing users, groups, and devices, the edges representing the relationship between each node connected to the edges, the graph representing tenants of a cloud service, wherein the nodes are classified as sensitive or non-sensitive; identify risky edges in the path leading to the sensitive nodes; and perform actions to eliminate the relationship between the nodes connected to the risky edges.

[0070] In one aspect, the edge represents one of "its administrator", "has a session", and "its member". The one or more programs include additional instructions, the additional instructions: periodically updating the graph during operation of the cloud service. The one or more programs include additional instructions, the additional instructions: determining whether there is another risk edge based on the updated graph. The additional instructions identify the risk edge based on a risk score, the risk score being based on a number of different separated non-sensitive nodes, a number of different separated sensitive nodes, and a number of different paths containing the risk edge.

[0071] In other aspects, the risk score is a weighted sum of the number of distinct separated non-sensitive nodes, the number of distinct separated sensitive nodes, and the number of distinct paths containing risky edges. The one or more programs include further instructions that: identify risky edges based on the risk score, the risk score applies a first weight to the number of distinct separated non-sensitive nodes, applies a second weight to the number of distinct separated sensitive nodes, and applies a third weight to the number of distinct paths containing risky edges.

[0072] A method is disclosed, the method comprising: representing entities in a graph that can access resources in a tenant of a cloud service, the graph having nodes of the entities and edges representing relationships between two connected entities, at least one node representing a sensitive entity and at least one node representing a non-sensitive entity; determining whether an edge is on a lateral movement path by traversing each path in the graph from the sensitive entity to each connected non-sensitive entity and calculating a score for the edge indicating whether the edge in the graph is on the lateral movement path; and based on the score, eliminating relationships between entities connected to the edge determined to be on the lateral movement path.

[0073] In some aspects, the score may be based on the number of different separated non-sensitive entities. The score may be based on the number of different separated sensitive entities. The score may be based on the number of different paths that contain the edge. The score may be the sum of the number of different separated non-sensitive entities, the number of different separated sensitive entities, and the number of different paths that contain the edge. The score may be the sum of a first weight applied to the number of different separated non-sensitive entities, a second weight applied to the number of different separated sensitive entities, and a third weight applied to the number of different paths that contain the edge.

[0074] Edges can represent relationships of "whose manager", "has a session", or "whose member". Entities represent user accounts, groups, or devices.

[0075] A device having a processor coupled to a memory is disclosed. The processor is configured to: obtain a graph of paths, the paths including nodes connected by edges, nodes associated with sensitive entities or non-sensitive entities, and edges representing relationships between two connected nodes, wherein the graph represents a configuration of entities that can access resources of a tenant of a cloud service; calculate a risk score for each edge in the path, the risk score being based on a count of different separated non-sensitive nodes, a count of different separated sensitive nodes, and different paths containing the edge; and identify risky edges in the path based on the risk score.

[0076] An edge can represent an "whose admin", "has a session", or "whose member" relationship between two connected nodes. A node can represent a user account, a device, or a group.

[0077] The risk score is the sum of the number of distinct separated non-sensitive entities, the number of distinct separated sensitive entities, and the number of distinct paths containing the edge. In one aspect, the risk score is the sum of a first weight applied to the number of distinct separated non-sensitive entities, a second weight applied to the number of distinct separated sensitive entities, and a third weight applied to the number of distinct paths containing the edge.

[0078] Although the subject matter has been described in language specific to structural features and / or methodological acts, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Instead, the specific features and acts described above are disclosed as example forms of implementing the claims.

Claims

1. A system for risk edge identification, comprising: one or more processors; and memory; One or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the one or more programs comprising instructions to perform the following actions: obtaining a graph having a plurality of paths, the paths comprising nodes and edges, wherein the nodes represent users, groups, or devices, wherein the edges represent relationships between each node connected to the edges, the graph representing tenants of the cloud service, wherein the nodes are classified as sensitive or non-sensitive; Identifying a risky edge leading to a lateral movement path in the path leading to a sensitive node, wherein the identification of the risky edge is based on a risk score, wherein the risk score is a weighted sum of applying a first weight to the number of different separate non-sensitive nodes that cannot be reached when the risky edge is removed from the graph, applying a second weight to the number of different separate sensitive nodes that cannot be reached when the risky edge is removed from the graph, and applying a third weight to the number of different paths that contain the risky edge; and performing an action to eliminate the relationship between the nodes connected to the risky edge to prevent a lateral movement attack. 2 . The system of claim 1 , wherein an edge represents one of: its administrator relationship, has a session relationship, and its member relationship. 3 . The system of claim 1 , wherein the one or more programs include further instructions to perform the following actions: periodically updating the map during operation of the cloud service. 4 . The system of claim 3 , wherein the one or more programs include further instructions to perform the following actions: determining whether there is another risk edge based on the updated graph.

5. The system of claim 1, wherein the sensitive nodes represent devices, users, or groups that have permissions, privileges, and / or credentials to highly sensitive data.

6. The system of claim 5, wherein the sensitive classification is applied to Administrators, Power Users, Account Operators, Domain Administrators, Domain Controllers, and Group Policy Creator Owners.

7. A method for risk edge identification, comprising: Representing entities that can access resources in a tenant of a cloud service in a graph, the graph having a plurality of paths, each path including nodes of entities and edges representing a relationship between two connected entities, at least one node representing a sensitive entity, and at least one node representing a non-sensitive entity; determining whether a first edge in the graph is on a lateral movement path by traversing each path from a sensitive entity to each connected non-sensitive entity in the plurality of paths in the graph and calculating a risk score for a first edge in the graph, the risk score being a weighted sum of applying a first weight to a number of distinct separate non-sensitive nodes that cannot be reached when the first edge is removed from the graph, applying a second weight to a number of distinct separate sensitive nodes that cannot be reached when the first edge is removed from the graph, and applying a third weight to a number of distinct paths that contain the first edge; as well as Relationships connected to entities of the first edge determined to be on the lateral movement path are eliminated based on the risk score for the first edge indicating a risky edge of the lateral movement path.

8. The method of claim 7, wherein the sensitive nodes represent devices, users or groups that have permissions, privileges and / or credentials to highly sensitive data.

9. The method of claim 8, wherein the sensitive classification is applied to Administrators, Power Users, Account Operators, Domain Administrators, Domain Controllers, and Group Policy Creator Owners.

10. The method according to claim 7, wherein an edge represents its administrator relationship, has a session relationship, or its member relationship. The method of claim 7 , wherein the entity represents a user account, a group, or a device.

12. An electronic device comprising: a processor coupled to the memory; The processor is configured to perform the following actions: Obtaining a graph having a plurality of paths, the paths comprising nodes connected by edges, the nodes being associated with sensitive entities or non-sensitive entities, the edges representing a relationship between two connected nodes, wherein the graph represents a configuration of entities that can access resources of a tenant of the cloud service; calculating, for a first edge in the plurality of paths, a risk score that is a weighted sum of applying a first weight to a number of distinct separate non-sensitive nodes that cannot be reached when the first edge is removed from the graph, applying a second weight to a number of distinct separate sensitive nodes that cannot be reached when the first edge is removed from the graph, and applying a third weight to a number of distinct paths that contain the first edge; Based on the risk score, identifying the first edge as a risky edge in a lateral movement path; as well as The relationship between the two connected nodes of the first edge is eliminated to prevent lateral movement attacks. 13 . The electronic device according to claim 12 , wherein an edge represents an administrator relationship, a session relationship or a member relationship between two connected nodes. The electronic device of claim 12 , wherein the node represents a user account, a device, or a group.

15. The electronic device of claim 12, wherein the sensitive nodes represent devices, users, or groups that have permissions, privileges, and / or credentials to highly sensitive data.

Images