Graph-Based Network Lateral Movement Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems face challenges in detecting lateral movement within computer networks due to large-scale data volumes and varying behaviors of different computer types, making it difficult to accurately identify infected computers and design efficient detection algorithms in a timely manner.
Innovation Solution
Graph-based detection systems and techniques are employed to identify potential malicious lateral movement paths by generating a network connection graph, determining edge weights, calculating path-rate scores, and using remote file execution detectors and rare path anomaly detection algorithms to rank and detect malicious computers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional detection methods are used on large-scale network data, then detection coverage is achieved, but detection time and computational resources become excessive
Solution Approach 1:
The patent segments the large-scale network detection problem into two distinct phases: (1) offline pre-computation phase where graph structures and anomaly scores are pre-calculated and stored, and (2) online detection phase where only query-specific path analysis is performed. This segmentation allows the system to handle large datasets efficiently by separating heavy computational tasks from real-time detection operations.
2Measurement precision
If comprehensive network monitoring is implemented, then detection accuracy improves, but system complexity and data volume increase
Solution Approach 1:
The patent introduces graph theory as an intermediary framework that transforms raw network connection data into structured graph objects with predefined properties (nodes, edges, paths). This intermediary representation simplifies complex network relationships and enables efficient querying without requiring complex ad-hoc analysis of raw data.
Solution Approach 2:
The system performs preliminary actions by pre-computing graph structures, edge weights, and anomaly scores during offline processing. This preliminary computation stores pre-analyzed information that can be quickly retrieved during online detection, avoiding the need to re-analyze entire datasets for each detection query.
3Measurement precision
If all network paths are analyzed in detail, then detection accuracy increases, but computational resources and processing time exceed acceptable limits
Solution Approach 1:
The patent changes the parameter representation by computing a scalar anomaly score for each path based on graph-theoretic properties (such as path rarity, node degrees, and edge weights). This parameter transformation converts complex multi-dimensional path analysis into a single comparable metric, enabling efficient ranking and selection of suspicious paths without detailed analysis of all paths.
Data Source
AI summary
Graph-based detection systems and techniques are provided to identify potential malicious lateral movement paths. System and security events may be used to generate a network connection graph and detect remote file executions and/or other detections, for use in tracking malicious lateral movement across a computer network, such as a compromised computer network. Lateral movement determination across a computer network may be divided into two subproblems: forensic analysis and general detection. With forensic analysis, given a malicious node, possible lateral movement leading into or out of the node is identified. General detection identifies previously unknown malicious lateral movement on a network using a remote file execution detector, and/or other detectors, and a rare path anomaly detection algorithm.