Privileged account breach detections based on behavioral access patterns
Disclosed is an improved approach for detecting potentially malicious activity on a network. The present improved approach generates a multi-dimensional activity model based on captured network activity. Additional network activity is captured, and relative activity values are determined therefor. Determination of whether the additional network activity corresponds to potentially malicious activity is obtained by fitting the relative activity values of the additional network activity to the multi-dimensional relative activity model.
1. A method for detecting potentially malicious activity on a network, comprising:
generating a plurality of relative activity values from network activity, at least one relative activity value of the plurality of relative activity values comprising an account privilege score generated at least by:
identifying a respective account used to access a first resource and a second resource,
determining a first number of accounts that access the first resource,
determining a second number of accounts that access the second resource, and
setting the account privilege score for the respective account based on both the first number and the second number;
generating a multi-dimensional relative activity model based on the plurality of relative activity values comprising at least the account privilege score;
identifying additional network activity;
generating additional relative activity values from the additional network activity, the additional relative activity values comprising at least an additional account privilege score; and
determining whether the additional network activity corresponds to potentially malicious activity by fitting the additional relative activity values comprising at least the additional account privilege score to the multi-dimensional relative activity model.
2. The method of claim 1 , wherein dimensions of the multi-dimensional relative activity model comprises at least two of the following dimensions: account privilege scores, service privilege scores, and host privilege scores.
3. The method of claim 1 , wherein the multi-dimensional relative activity model maps relative activity values based on account privilege scores, service privilege scores, and host privilege scores.
4. The method of claim 3 , wherein:
the multi-dimensional relative activity model further defines at least two of the following regions: a normal region, an abnormal but not suggestive of malicious activity region and an abnormal and suggestive of malicious activity region; and
the additional network activity is marked as normal, abnormal but not suggestive of malicious activity, or abnormal and suggestive of malicious activity based on the fitting of the additional relative activity values of the additional network activity to a corresponding region of the multi-dimensional relative activity model.
5. The method of claim 3 , wherein an account value is determined to correspond to a high value account based on a naming convention.
6. The method of claim 1 , wherein network activity comprises at least requests from hosts to an authentication service or responses from the authentication service to the hosts, requests comprising token or authorization requests, and responses comprising token or authorization responses.
7. The method of claim 1 , wherein network activity is captured by at least one of: packet sniffing and authentication service log parsing.
8. The method of claim 1 , wherein the multi-dimensional relative activity model is generated based on captured network activity over a predetermined time window.
9. The method of claim 8 , wherein:
the additional network activity is captured in real-time; and
the relative activity values for the additional network activity are determined dynamically.
10. The method of claim 9 , wherein the multi-dimensional relative activity model is regularly regenerated using a portion of the network activity and the additional network activity.
11. A non-transitory computer readable medium having stored thereon a sequence of instructions which, when executed by a processor, performs a set of acts for detecting potentially malicious activity on a network, comprising:
generating a plurality of relative activity values from network activity, at least one relative activity value of the plurality of relative activity values comprising an account privilege score generated at least by:
identifying a respective account used to access a first resource and a second resource,
determining a first number of accounts that access the first resource,
determining a second number of accounts that access the second resource, and
setting the account privilege score for the respective account based on both the first number and the second number;
generating a multi-dimensional relative activity model based on the plurality of relative activity values comprising at least the account privilege score;
identifying additional network activity;
generating additional relative activity values from the additional network activity, the additional relative activity values comprising at least an additional account privilege score; and
determining whether the additional network activity corresponds to potentially malicious activity by fitting the additional relative activity values comprising at least the additional account privilege score to the multi-dimensional relative activity model.
12. The computer readable medium of claim 11 , wherein dimensions of the multi-dimensional relative activity model comprises at least two of the following dimensions: account privilege scores, service privilege scores, and host privilege scores.
13. The computer readable medium of claim 11 , wherein the multi-dimensional relative activity model maps relative activity values based on account privilege scores, service privilege scores, and host privilege scores.
14. The computer readable medium of claim 13 , wherein:
the multi-dimensional relative activity model further defines at least two of the following regions: a normal region, an abnormal but not suggestive of malicious activity region and an abnormal and suggestive of malicious activity region; and
the additional network activity is marked as normal, abnormal but not suggestive of malicious activity, or abnormal and suggestive of malicious activity based on the fitting of the additional relative activity values of the additional network activity to a corresponding region of the multi-dimensional relative activity model.
15. The computer readable medium of claim 13 , wherein an account value is determined to correspond to a high value account based on a naming convention.
16. The computer readable medium of claim 11 , wherein network activity comprises at least requests from hosts to an authentication service or responses from the authentication service to the hosts, requests comprising token or authorization requests, and responses comprising token or authorization responses.
17. The computer readable medium of claim 11 , wherein network activity is captured by at least one of: packet sniffing and authentication service log parsing.
18. The computer readable medium of claim 11 , wherein the multi-dimensional relative activity model is generated based on captured network activity over a predetermined time window.
19. The computer readable medium of claim 18 , wherein:
the additional network activity is captured in real-time; and
the relative activity values for the additional network activity are determined dynamically.
20. A system for detecting potentially malicious activity on a network, comprising:
a memory storing a sequence of program code instructions; and
a processor that executes the sequence of program code instructions to perform a set of acts, comprising:
generating a plurality of relative activity values from network activity, at least one relative activity value of the plurality of relative activity values comprising an account privilege score generated at least by:
identifying a respective account used to access a first resource and a second resource,
determining a first number of accounts that access the first resource,
determining a second number of accounts that access the second resource, and
setting the account privilege score for the respective account based on both the first number and the second number;
generating a multi-dimensional relative activity model based on the plurality of relative activity values comprising at least the account privilege score;
identifying additional network activity;
generating additional relative activity values from the additional network activity, the additional relative activity values comprising at least an additional account privilege score; and
determining whether the additional network activity corresponds to potentially malicious activity by fitting the additional relative activity values comprising at least the additional account privilege score to the multi-dimensional relative activity model.