Lateral Movement Detection via Probabilistic Logon Scoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems fail to effectively detect lateral movement of attackers within computer networks, which can lead to undetected breaches and expanded intrusion scope, as traditional methods rely heavily on manual analysis and struggle to differentiate between benign and malicious activities.
Innovation Solution
Implementing a detection model system that employs probabilistic intrusion detection models to score logon sessions based on historical security event data, analyzing logon behavior, event sequences, inter-event times, and explicit credential usage, generating a ranking score to identify compromised accounts and machines, and visualizing probable attack paths through an attack graph.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional manual analysis methods are used to detect lateral movement, then false positives may be reduced, but detection speed and coverage are insufficient
Solution Approach 1:
The detection system segments lateral movement detection into multiple independent detection models, each focusing on specific indicators (logon behavior, event sequences, inter-event times, credential usage). This segmentation allows parallel processing of different detection aspects, improving both speed and accuracy without overwhelming a single analysis system.
Solution Approach 2:
The patent introduces an automated detection model system as an intermediary between raw security event data and human analyst review. This intermediary processes and scores potential lateral movement events, filtering and prioritizing results before human analysis, thereby accelerating detection while maintaining reliability through automated scoring mechanisms.
2Productivity
If automated detection models are implemented, then detection speed and coverage improve, but system complexity increases
Solution Approach 1:
The complex detection system is divided into separate, specialized detection models (logon behavior model, event sequence model, inter-event time model, credential model). Each model handles a specific aspect of lateral movement detection, making the overall complex system manageable through modular design where each component has a focused function.
Solution Approach 2:
The detection model system is designed to be universally applicable across different network environments and attack scenarios. The models process various types of security events and adapt to different organizational contexts, reducing the need for multiple specialized systems and simplifying deployment across diverse infrastructure.
3Measurement precision
If multiple detection models are used to score logon sessions, then detection precision improves, but processing time increases
Solution Approach 1:
The system applies multiple detection models but does not require all models to complete before generating results. Instead, it uses partial results from high-priority models to quickly identify and flag suspicious logon sessions, applying additional models only when needed to confirm or refine detections, thus balancing precision with processing speed.
Solution Approach 2:
The detection system implements prioritized processing where critical detection models that provide quick, high-confidence results are executed first. When these models identify clear indicators of lateral movement, the system can skip less critical models for those specific cases, reducing overall processing time while maintaining detection precision for high-risk events.
Data Source
AI summary
Lateral movement detection may be performed by employing different detection models to score logon sessions. The different detection models may be implemented by and/or utilize counts computed from historical security event data. The different detection models may include probabilistic intrusion detection models for detecting compromised behavior based on logon behavior, a sequence of security events observed during a logon session, inter-event time between security events observed during a logon session, and/or an attempt to logon using explicit credentials. Scores for each logon session that are output by the different detection models may be combined to generate a ranking score for each logon session. A list of ranked alerts may be generated based on the ranking score for each logon session to identify compromised authorized accounts and/or compromised machines. An attack graph may be automatically generated based on compromised account-machine pairs to visually display probable paths of an attacker.