Confluera, Inc.

Eun-Gyu Kim

Niloy Mukherjee

Abhijit Ghosh

Sandeep Siroya

Rushikesh Patil

Infrastructure attacks involving lateral movement are identified by monitoring system level activities using software agents deployed on respective operating systems, and constructing, based on the system level activities, an execution graph comprising execution trails. A logon session between a remote connection client executing on a first operating system and a remote connection server executing on a second operating system is identified. Behavior exhibited from the logon session is attributed to a first global execution trail in the execution graph. A reconnection to the logon session between a remote connection client executing on a third operating system and the remote connection server is then identified, and, thereafter, behavior exhibited from the logon session is attributed to a second global execution trail in the execution graph.

Detecting and trail-continuation for attacks through remote desktop protocol lateral movement

A novel enterprise security solution allows for precise interception and surgical response to attack progression, in real time, as it occurs across a distributed infrastructure. The solution includes a data monitoring and management framework that continually models system level host and network activities as mutually exclusive infrastructure wide execution sequences and bucketizes them into unique execution trails. A multimodal intelligent security middleware detects indicators of compromise in real-time on top of subsets of each unique execution trail using rule based behavioral analytics, machine learning based anomaly detection, and other sources. Each detection result dynamically contributes to aggregated risk scores at execution trail level granularities. These scores can be used to prioritize and identify highest risk attack trails to end users, along with steps that such end users can perform to mitigate further damage and progression of an attack.

Methods and system for characterizing infrastructure security-related events

Methods and system for identifying relationships among infrastructure security-related events

Methods and system for tracking security risks over infrastructure

Methods and systems for identifying infrastructure attack progressions

Methods and system for detecting behavioral indicators of compromise in infrastructure

Growing community of inventors

San Carlos, CA, United States of America

Eun-Gyu Kim