Lateral Movement Detection via Cross-Device Alert Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In complex organization network infrastructures, identifying the root cause of lateral movement attacks, which involve malicious access from within the organization, is challenging due to limited information and the difficulty in determining the origin of access.
Innovation Solution
A system that combines multiple protection products to automatically identify the root cause of malicious commands by sharing alerts from a data store defender process with a device protection process, which then transmits the information to a server-based protection system for analysis and identification of the compromised user identity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If multiple protection products are combined to share alerts and transmit information across devices, then the accuracy of identifying the root cause of malicious access is improved, but the complexity of the system increases
Solution Approach 1:
The system divides the security monitoring function into separate protection products deployed on different devices (data store defender process on first device, device protection process on second device, server-based protection system). Each segment handles specific aspects of attack detection and information sharing, improving overall identification accuracy while maintaining manageable complexity through modular architecture.
Solution Approach 2:
The patent implements a nested information sharing structure where the data store defender process embeds alert information within the existing data store communication protocol, which is then transmitted to the device protection process, which in turn forwards enriched information to the server-based protection system. This nested approach allows multiple layers of protection to work together without requiring complete system redesign.
2Loss of information
If alert information is shared between data store defender process and device protection process through protocol enrichment, then the completeness of security information is improved, but the difficulty of detecting and measuring increases
Solution Approach 1:
The device protection process acts as an intermediary that receives alerts from the data store defender process, enriches them with additional device-level context and log activity data, and forwards the enhanced information to the server-based protection system. This intermediary layer bridges the information gap between data store monitoring and device-level monitoring without requiring direct complex communication between all components.
Solution Approach 2:
The system enriches the data communication protocol by adding new parameters and fields to the alert information structure. The data store defender process includes additional fields such as device identifiers, process identifiers, user identifiers, and timestamp information in the transmitted alerts, transforming the information format to include comprehensive security context without breaking existing protocol compatibility.
3Productivity
If the system automatically identifies and isolates compromised user identities through multi-device analysis, then the productivity of security response is improved, but the device complexity increases
Solution Approach 1:
The system performs preliminary actions by automatically matching process identifiers from alerts with log activity data before security personnel need to manually investigate. The device protection process proactively correlates alert information with device logs, user identities, and process information in advance, preparing enriched data that enables rapid automated identification of compromised accounts, reducing response time from hours to minutes.
Data Source
AI summary
A method may include receiving from a first computing device, metadata that includes a suspected malicious activity indicator and a device identifier associated with the indicator; receiving, from a second computing device, log activity data; matching the device identifier included in the metadata to a device identifier in the log activity data; and based on the matching, transmitting an alert identifying the second computing device as a source of the suspected malicious activity.