System and method for detecting lateral movement and data exfiltration
A system configured to detect a threat activity on a network. The system including a digital device configured to detect a first order indicator of compromise on a network, detect a second order indicator of compromise on the network, generate a risk score based on correlating said first order indicator of compromise on the network with the second order indicator of compromise on said network, and generate at least one incident alert based on comparing the risk score to a threshold.
1. A method comprising:
generating, by a device, a behavior profile for another device,
wherein the other device is associated with a particular security posture,
wherein the particular security posture is dynamic based on information received;
detecting, by the device, one or more real-time observations;
comparing, by the device, the one or more real-time observations and the behavior profile;
generating, by the device and based on comparing the one or more real-time observations and the behavior profile, one or more anomalies;
determining, by the device, whether the one or more anomalies is associated with a particular address;
generating, by the device and based on the one or more anomalies, the particular security posture, and a policy framework, an incident alert,
wherein the one or more anomalies is associated with a particular type of behavior, and
wherein the policy framework defines different types of behaviors, including the particular type of behavior, and different types of incident alerts, including the incident alert, generated for different security postures including the particular security posture; and
quarantining, by the device and based on the incident alert, data associated with the other device.
2. The method of claim 1 , wherein the behavior profile includes information regarding at least one of:
a role of a particular user in a network,
authorization to use the other device on the network,
one or more activities the particular user performs on the other device,
one or more addresses that have been connected to the other device,
time durations of connections to the other device,
a quantity of data transferred to the other device,
a quantity of data transferred from the other device, or
a total quantity of data transferred.
3. The method of claim 1 , wherein generating the behavior profile comprises:
generating the behavior profile based on one or more of:
network traffic patterns, or
behavior patterns of the other device.
4. The method of claim 1 , further comprising:
analyzing network traffic patterns; and
wherein detecting the one or more real-time observations comprises:
detecting the one or more real-time observations based on analyzing the network traffic patterns.
5. The method of claim 1 , wherein the one or more anomalies include one or more of:
a network anomaly,
a device anomaly, or
a user anomaly.
6. The method of claim 1 , wherein the particular address is associated with at least one of:
a detected malware infection,
a control-and-command activity, or
a security policy.
7. The method of claim 1 , wherein the other device is a first other device;
wherein the data associated with the other device is first data; and
wherein the method further comprises at least one of:
transferring, based on the incident alert, second data to a second other device, or
adding, based on the incident alert, a security protocol to access the second data.
8. A device, comprising:
one or more memories; and
one or more processors, communicatively coupled to the one or more memories, configured to:
generate a behavior profile for another device,
wherein the other device is associated with a particular security posture,
wherein the particular security posture is dynamic based on information received;
detect one or more real-time observations;
compare the one or more real-time observations and the behavior profile;
generate, based on comparing the one or more real-time observations and the behavior profile, one or more anomalies;
determine whether the one or more anomalies is associated with a particular address;
generate, based on the one or more anomalies, the particular security posture, and a policy framework, an incident alert,
wherein the one or more anomalies is associated with a particular type of behavior, and
wherein the policy framework defines different types of behaviors, including the particular type of behavior, and different types of incident alerts, including the incident alert, generated for different security postures including the particular security posture; and
quarantine, based on the incident alert, data associated with the other device.
9. The device of claim 8 , wherein the behavior profile includes information regarding at least one of:
a role of a particular user in a network,
authorization to use the other device on the network,
one or more activities the particular user performs on the other device,
one or more addresses that have been connected to the other device,
time durations of connections to the other device,
a quantity of data transferred to the other device,
a quantity of data transferred from the other device, or
a total quantity of data transferred.
10. The device of claim 8 , wherein the one or more processors, when generating the behavior profile, are configured to:
generate the behavior profile based on one or more of:
network traffic patterns, or
behavior patterns of the other device.
11. The device of claim 8 , wherein the one or more processors are further configured to:
analyze network traffic patterns; and
wherein the one or more processors, when detecting the one or more real-time observations, are configured to:
detect the one or more real-time observations based on analyzing the network traffic patterns.
12. The device of claim 8 , wherein the one or more anomalies include one or more of:
a network anomaly,
a device anomaly, or
a user anomaly.
13. The device of claim 8 , wherein the particular address is associated with at least one of:
a detected malware infection,
a control-and-command activity, or
a security policy.
14. The device of claim 8 , wherein the other device is a first other device;
wherein the data associated with the other device is first data; and
wherein the one or more processors are further configured to at least one of:
transfer, based on the incident alert, second data to a second other device, or
add, based on the incident alert, a security protocol to access the second data.
15. A non-transitory computer-readable medium storing instructions, the instructions comprising:
one or more instructions that, when executed by one or more processors, cause the one or more processors to:
generate a behavior profile for another device,
wherein the other device is associated with a particular security posture,
wherein the particular security posture is dynamic based on information received;
detect one or more real-time observations;
compare the one or more real-time observations and the behavior profile;
generate, based on comparing the one or more real-time observations and the behavior profile, one or more anomalies;
determine whether the one or more anomalies is associated with a particular address;
generate, based on the one or more anomalies, the particular security posture, and a policy framework, an incident alert,
wherein the one or more anomalies is associated with a particular type of behavior, and
wherein the policy framework defines different types of behaviors, including the particular type of behavior, and different types of incident alerts, including the incident alert, generated for different security postures including the particular security posture; and
quarantine, based on the incident alert, data associated with the other device.
16. The non-transitory computer-readable medium of claim 15 , wherein the behavior profile includes information regarding at least one of:
a role of a particular user in a network,
authorization to use the other device on the network,
one or more activities the particular user performs on the other device,
one or more addresses that have been connected to the other device,
time durations of connections to the other device,
a quantity of data transferred to the other device,
a quantity of data transferred from the other device, or
a total quantity of data transferred.
17. The non-transitory computer-readable medium of claim 15 , wherein the one or more instructions, that cause the one or more processors to generate the behavior profile, cause the one or more processors to:
generate the behavior profile based on one or more of:
network traffic patterns, or
behavior patterns of the other device.
18. The non-transitory computer-readable medium of claim 15 , wherein the one or more instructions, when executed by the one or more processors, further cause the one or more processors to:
analyze network traffic patterns; and
wherein the one or more instructions, that cause the one or more processors to detect the one or more real-time observations, cause the one or more processors to:
detect the one or more real-time observations based on analyzing the network traffic patterns.
19. The non-transitory computer-readable medium of claim 15 , wherein the particular address is associated with at least one of:
a detected malware infection,
a control-and-command activity, or
a security policy.
20. The non-transitory computer-readable medium of claim 15 , wherein the other device is a first other device;
wherein the data associated with the other device is first data; and
wherein the one or more instructions, when executed by the one or more processors, further cause the one or more processors to at least one of:
transfer, based on the incident alert, second data to a second other device, or
add, based on the incident alert, a security protocol to access the second data.