Detecting threats against computing resources based on user behavior changes

Patent metadata

Field	Value
Publication number	US-12120140-B2
Application number	US-202318196149-A
Country	US
Kind code	B2
Filing date	May 11, 2023
Priority date	Nov 27, 2017
Publication date	Oct 15, 2024
Grant date	Oct 15, 2024

Abstract

An illustrative method includes generating, based on log data associated with at least one user session in a network environment associated with a user, a logical graph, wherein the logical graph comprises: (1) a first node corresponding to the user, (2) a plurality of additional nodes, and (3) a set of edges connecting the first node to one or more of the additional nodes, wherein each edge in the set of edges represents a change in behavior of the user; using the logical graph to detect an anomaly, wherein detecting the anomaly includes determining that a change has been made to at least one edge included in the set of edges; and generating, in response to detecting the anomaly, an alert.

First claim

The invention claimed is:

1. A method comprising:
generating, based on log data associated with at least one user session in a network environment associated with a user, a logical graph, wherein the logical graph comprises: (1) a first node corresponding to the user, (2) a plurality of additional nodes, and (3) a set of edges connecting the first node to one or more of the additional nodes, wherein each edge in the set of edges represents a change in behavior of the user;
using the logical graph to detect an anomaly, wherein detecting the anomaly includes determining that a change has been made to at least one edge included in the set of edges; and
generating, in response to detecting the anomaly, an alert.

2. The method of claim 1 , wherein the logical graph comprises an insider behavior graph, wherein the insider behavior graph models interactions of the user with the network environment.

3. The method of claim 1 , wherein the log data comprises information associated with the user provided by a plurality of machines.

4. The method of claim 1 , wherein the logical graph comprises a privilege change graph, wherein the privilege change graph models privilege changes between processes.

5. The method of claim 4 , wherein the privilege changes are represented as edges in the privilege change graph.

6. The method of claim 4 , wherein the privilege change graph includes process hierarchy information.

7. The method of claim 1 , wherein the logical graph comprises a machine-server graph, wherein the machine-server graph clusters machines into nodes based on resources executing on the machine.

8. The method of claim 1 , wherein detecting the anomaly includes determining that the user has logged in from an anomalous location.

9. The method of claim 1 , wherein detecting the anomaly includes determining that the user has logged into an anomalous machine.

10. The method of claim 9 , wherein the anomalous machine has an associated machine class and wherein determining that the user has logged into the anomalous machine includes determining that the user has accessed an anomalous machine class.

11. The method of claim 1 , wherein detecting the anomaly includes determining that the user has accessed an anomalous application.

12. The method of claim 1 , wherein detecting the anomaly includes determining that the user has transmitted data to an anomalous destination.

13. The method of claim 12 , further comprising determining that the anomalous destination is an anomalous destination based at least in part on geolocation information associated with the destination.

14. The method of claim 1 , wherein detecting the anomaly includes determining that the user has transmitted an anomalous amount of data.

15. The method of claim 1 , wherein detecting the anomaly includes determining that the user has made an anomalous privilege change.

16. A system comprising:
a memory storing instructions; and
a processor and configured to execute the instructions to perform a process comprising:
generating, based on log data associated with at least one user session in a network environment associated with a user, a logical graph, wherein the logical graph comprises: (1) a first node corresponding to the user, (2) a plurality of additional nodes, and (3) a set of edges connecting the first node to one or more of the additional nodes, wherein each edge in the set of edges represents a change in behavior of the user;
using the logical graph to detect an anomaly, wherein detecting the anomaly includes determining that a change has been made to at least one edge included in the set of edges; and
generating, in response to detecting the anomaly, an alert.

17. The system of claim 16 , wherein the logical graph comprises an insider behavior graph, wherein the insider behavior graph models interactions of the user with the network environment.

18. The system of claim 16 , wherein the log data comprises information associated with the user provided by a plurality of machines.

19. The system of claim 16 , wherein the logical graph comprises a privilege change graph, wherein the privilege change graph models privilege changes between processes.

20. A computer program product embodied in a non-transitory computer readable storage medium and comprising computer instructions for:
generating, based on log data associated with at least one user session in a network environment associated with a user, a logical graph, wherein the logical graph comprises: (1) a first node corresponding to the user, (2) a plurality of additional nodes, and (3) a set of edges connecting the first node to one or more of the additional nodes, wherein each edge in the set of edges represents a change in behavior of the user;
using the logical graph to detect an anomaly, wherein detecting the anomaly includes determining that a change has been made to at least one edge included in the set of edges; and
generating, in response to detecting the anomaly, an alert.

Assignees

• Lacework Inc
• Fortinet Inc

Inventors

• Singh Harish Kumar Bharat
• Kapoor Vikram
• Bog Murat
• Chen Yijou

Classifications

• H04L67/535

  Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34) · CPC title

• G06F16/9535

  Search customisation based on user profiles and personalisation · CPC title

• H04L43/06

  Generation of reports · CPC title

• H04L43/045

  for graphical visualisation of monitoring data · CPC title

• G06F16/2456

  Join operations · CPC title