Remote Protocol Tunnel Detection for Malicious Lateral Movement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Remote system protocols like RDP are vulnerable to malicious tunneling, which can bypass firewalls and pose cybersecurity threats, necessitating a solution to detect and mitigate such malicious lateral movements.
Innovation Solution
A method and system for detecting malicious tunnels by identifying atomic tunnels based on packet data, classifying them using isomorphic graph structures, and performing mitigation actions such as generating alerts or severing connections.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If remote system protocols are used to enable tunneling for convenient access, then ease of operation is improved, but cybersecurity vulnerability increases
Solution Approach 1:
The patent segments tunnel detection into atomic tunnel identification (basic two-hop structures) and composite tunnel construction (complex multi-hop patterns). This segmentation allows the system to analyze remote protocol traffic at granular levels, detecting malicious patterns while preserving legitimate remote access functionality.
Solution Approach 2:
The patent introduces an intermediary detection system that monitors remote protocol traffic between devices. This intermediary analyzes packet flows, identifies atomic tunnels, constructs composite tunnel patterns, and detects anomalies without blocking legitimate remote access operations.
2Adaptability or versatility
If tunneling is allowed to bypass firewalls, then adaptability is improved, but reliability of security control deteriorates
Solution Approach 1:
The patent performs preliminary detection and classification of tunnels before malicious activities can compromise security. By identifying atomic tunnels and constructing composite tunnel patterns in advance, the system can proactively detect and respond to potential security threats while maintaining firewall integrity.
Solution Approach 2:
The patent implements feedback mechanisms where detected tunnel patterns are analyzed against security policies. The system provides feedback on tunnel legitimacy, allowing dynamic adjustment of security controls to block malicious tunnels while permitting legitimate remote access through firewall protocols.
3Measurement precision
If packet analysis is performed to detect malicious tunnels, then measurement precision is improved, but processing time increases
Solution Approach 1:
The patent segments packet analysis into efficient atomic tunnel detection (identifying basic two-hop structures) and composite tunnel construction (analyzing complex patterns). This segmentation enables rapid processing of individual packet flows while maintaining high detection accuracy for both simple and complex malicious tunnel patterns.
Solution Approach 2:
The patent applies partial analysis by focusing on critical packet features essential for tunnel identification rather than analyzing every packet attribute in detail. This selective analysis maintains measurement precision for detecting malicious tunnels while significantly reducing overall processing time.
Data Source
AI summary
A system and method for malicious lateral movement detection. A method includes identifying atomic tunnels in packets sent between devices; identifying tunnel constructs; determining a potentially malicious atomic tunnel among the atomic tunnels by comparing edges of each of the atomic tunnels to edges of previously observed tunnel constructs; determining a potentially malicious tunnel including the potentially malicious atomic tunnel; and mitigating the potentially malicious tunnel. Each atomic tunnel is a structure representing communications among the devices defined with respect to at least three nodes and at least two edges. Each node represents a respective device, and each edge represents a connection between two of the devices. Each atomic tunnel has two hops, where each hop is a level of communication in which a packet is sent from one device to another device. Each tunnel construct is a structure including at least one of the atomic tunnels.