Detecting malicious lateral movement across a computer network

US10505954B2 · kind B2 · utility

Assignee

• MICROSOFT TECHNOLOGY LICENSING, LLC · US

Inventors

• Jack Wilson Stokes, III · North Bend, US
• Robert Mead · Lostwithiel, GB
• Tim W. Burrell · Cheltenham, GB
• Ian Hellen · Seattle, US
• John J. Lambert · Seattle, US
• Weidong Cui · Redmond, US
• Andrey Marochko · Redmond, US
• Qingyun Liu · North Wales, US

Key dates

• Filing date: Jun 14, 2017
• Grant date: Dec 10, 2019
• Expiry date: Dec 26, 2037

Classification

• Technology area (CPC H): Electricity
• CPC primary: H04L2463/146
• WIPO field: Digital communication
• WIPO sector: Electrical engineering

Abstract

Graph-based detection systems and techniques are provided to identify potential malicious lateral movement paths. System and security events may be used to generate a network connection graph and detect remote file executions and/or other detections, for use in tracking malicious lateral movement across a computer network, such as a compromised computer network. Lateral movement determination across a computer network may be divided into two subproblems: forensic analysis and general detection. With forensic analysis, given a malicious node, possible lateral movement leading into or out of the node is identified. General detection identifies previously unknown malicious lateral movement on a network using a remote file execution detector, and/or other detectors, and a rare path anomaly detection algorithm.