Lateral account mapping
View Patent ↗Systems and methods of correlating accounts among a plurality of network assets using account lateral movement data is presented in the context of network security. In one embodiment a plurality of authentication audit logs are received from a plurality of assets; the plurality of authentication audit logs are correlated; and a notification is generated based on a comparison of correlation results and a database of permitted account associations.
1. A method of monitoring a network, the method comprising:
retrieving, via a processing module, a first log from an origination asset
identifying, via the processing module, a destination asset for a first authentication transaction from the first log;
retrieving, via the processing module, a second log from the destination asset;
identifying the origination asset in a second authentication transaction from the second log;
identifying, via the processing module, that a single user is responsible for the first and second authentication transactions accessing a plurality of assets on the network utilizing multiple accounts; and
generating, via the processing module, a notification based on a comparison of the identified single user and a database of individual users, each individual user associated with multiple accounts.
2. The method of monitoring the network according to claim 1 , wherein identifying a single user comprises associating a first account from the origination asset with a second account from the destination asset.
3. The method of monitoring the network according to claim 1 , wherein the origination asset and the destination asset are network devices.
4. The method of monitoring the network according to claim 1 , wherein the database of individual users comprises permitted account switches at a single network asset.
5. The method of monitoring the network according to claim 1 , further comprising generating a visual map of the identified single users.
6. A system for monitoring a network, the system comprising:
a database of individual users;
a processing module in communication with the database; and
memory storing instructions configured to instruct the processing module to retrieve a first log from an origination asset, identify a destination asset for a first authentication transaction from the first log, retrieve a second log from the destination asset, identify the origination asset in a second authentication transaction from the second log, identify that a single user is responsible for the first and second authentication transactions accessing a plurality of assets on the network-utilizing multiple accounts; and, generate a notification based on a comparison of the identified single user and the database of individual users, each individual user associated with multiple accounts.
7. The system for monitoring the network according to claim 6 , wherein the processing module is further configured to update the database of individual users based on a user response to the notification.
8. The system for monitoring the network according to claim 6 , wherein audit wherein the single user is identified by associating a first account from the origination asset with a second account from the destination asset.
9. The system for monitoring the network according to claim 6 , wherein the origination asset and the destination asset are network devices.
10. The system for monitoring the network according to claim 6 , wherein the database of individual users comprises permitted account switches at a single network asset.
11. The system for monitoring the network according to claim 10 , wherein the permitted account switches are based on account information and device information.
12. The system for monitoring the network according to claim 6 , further comprising a second database associating at least one device label with user information.
13. The system for monitoring the network according to claim 12 , wherein a user is identified based on the second database and an authentication record.
14. The system for monitoring the network according to claim 13 , wherein the authentication record is an active directory log.
15. The system for monitoring the network according to claim 12 , wherein the device label is a domain name or an Internet protocol address.
16. The system for monitoring the network according to claim 12 , wherein the second database is updated upon a dynamic host configuration protocol lease renewal, a virtual private network internet protocol address assignment, or both.
17. The system for monitoring the network according to claim 6 , wherein the plurality of assets are part of an organization's internal network.