Microsoft Technology Licensing, LLC

Matt Swann

Vinod Sankaran Nair

Ram Shankar Siva Kumar

Sundararajan Sellamanickam

Marco DiPlacido

Nguyen Song Khanh Vu

Aniruddha Das

Keerthi Selvaraj

Marco Diplacido

Vinod Nair

Lateral movement detection may be performed by employing different detection models to score logon sessions. The different detection models may be implemented by and/or utilize counts computed from historical security event data. The different detection models may include probabilistic intrusion detection models for detecting compromised behavior based on logon behavior, a sequence of security events observed during a logon session, inter-event time between security events observed during a logon session, and/or an attempt to logon using explicit credentials. Scores for each logon session that are output by the different detection models may be combined to generate a ranking score for each logon session. A list of ranked alerts may be generated based on the ranking score for each logon session to identify compromised authorized accounts and/or compromised machines. An attack graph may be automatically generated based on compromised account-machine pairs to visually display probable paths of an attacker.

Lateral movement detection

Growing community of inventors

Bothell, WA, United States of America

Matt Swann