Automatic detection of illicit lateral movement

Abstract

Lateral movement between networked computers is detected, and automatically and efficiently assessed by a detection tool to distinguish innocent activity from cyberattacks. By correlating log data about logins and network traffic, the detection tool produces network node sets corresponding to individual movements. If a chain can be built from node sets matching an event sequence pattern that tends to be used by attackers, then the detection tool reports the chain as an illicit lateral movement candidate. Detection patterns define illicitness grounds such as consistency of data transfer sizes, shortness of login intervals, use of suspect protocols, chain scope, and the presence or use of administrator credentials. Detection responses may then isolate computers, inspect them for malware or tampering, obtain forensic images for analysis, tighten exfiltration filtering, and otherwise mitigate against ongoing or future cyberattacks.