Lateral Movement Path Detector for Cloud REST API Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current techniques for detecting lateral movement paths in computer networks are not available for cloud tenants or domains that utilize extensive external resources and assets, such as web-based services with REST API interfaces, making it difficult for security professionals to visualize and mitigate potential attacks.
Innovation Solution
A lateral movement path detector that uses programmatic access via REST API endpoints to gather data and create a graph representation of users, groups, and devices, visualizing potential lateral paths and vulnerabilities within the management service directory, employing data grabber, connector, and reporter components to identify susceptible paths.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If current lateral movement detection techniques are used, then traditional network security monitoring is achieved, but cloud environments with external resources and REST API interfaces cannot be effectively monitored
Solution Approach 1:
The patent changes the detection parameters from traditional network traffic analysis to cloud-specific parameters including REST API interface monitoring, authentication token tracking, and cloud resource access patterns. This enables the detection system to adapt to cloud environments while maintaining reliable lateral movement detection capabilities.
Solution Approach 2:
The detection system is designed to be universal by implementing multiple detection methods that work across different cloud environments and traditional networks. It monitors various cloud services, REST API interfaces, and authentication mechanisms simultaneously, making it adaptable to diverse cloud architectures while maintaining consistent detection reliability.
2Adaptability or versatility
If extensive cloud resources and external assets are utilized, then cloud service functionality is enhanced, but the complexity of detecting lateral movement paths increases
Solution Approach 1:
The detection system segments the complex cloud environment into discrete monitorable units including individual REST API interfaces, authentication tokens, cloud resources, and access patterns. By dividing the monitoring task into these manageable segments, the system can handle extensive cloud resources without becoming unmanageably complex.
Solution Approach 2:
The patent introduces intermediary components that mediate between the complex cloud environment and the detection system. These intermediaries include API proxies, token validation services, and event correlation engines that simplify the monitoring of extensive cloud resources while maintaining detection effectiveness.
3Productivity
If programmatic access via REST API endpoints is implemented, then data gathering capability is improved, but the difficulty of visualizing and understanding lateral paths increases
Solution Approach 1:
The patent replaces complex manual visualization and analysis mechanisms with automated computational methods. Machine learning algorithms and graph visualization tools automatically process the data gathered from REST API endpoints, transforming raw data into intuitive visual representations of lateral movement paths without requiring manual intervention.
Solution Approach 2:
The system creates simplified copies or representations of complex lateral movement paths through graph visualizations and attack scenario models. These visual copies make it easier to understand and analyze the actual lateral movement patterns by presenting them in an intuitive graphical format rather than raw data.
Data Source
AI summary
A lateral movement path detector is disclosed. Data is gathered via programmatic access to a management service director through a REST API endpoint. The data is grouped into a graph having nodes of users, groups, and devices. The nodes coupled together via edges. A visualization of the graph is provided to illustrate lateral paths of the management service directory.