User and entity behavioral analysis with network topology enhancements
A system and method for network cybersecurity analysis that uses user and entity behavioral analysis combined with network topology information to provide improved cybersecurity. The system and method involve gathering network entity information, establishing baseline behaviors for each entity, and monitoring each entity for behavioral anomalies that might indicate cybersecurity concerns. Further, the system and method involve incorporating network topology information into the analysis by generating a model of the network, annotating the model with risk and criticality information for each entity in the model and with a vulnerability level between entities, and using the model to evaluate cybersecurity risks to the network. Risks and vulnerabilities associated with user entities may be represented, in part or in whole, by the behavioral analyses and monitoring of those user entities.
1. A system for cybersecurity analysis using user and entity behavioral analysis combined with network topology information, comprising: a computing device comprising a memory and a processor; a directed graph stored in the memory of the computing device, the directed graph comprising a representation of a computer network wherein: nodes of the directed graph represent entities comprising the computer network; and edges of the directed graph represent relationships between the entities of the computer network; and wherein network segmentation is used to reduce the number of nodes required to represent entities in the directed graph by: assigning computing devices in the computing network to logical segments by changing their configurations or by changing the computer network configurations, wherein the computing devices in a logical segment are treated analogously with respect to access of the computer network; and representing all computing devices in a logical segment as a single entity in the directed graph; and a behavioral analysis engine comprising a plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the plurality of programming instructions, when operating on the processor, cause the computing device to: monitor the activity of a plurality of entities comprising the computer network; establish behavioral baseline data for each of the plurality of entities from the monitored activity over a defined period of time; associate the behavioral baseline data for each entity with the directed graph node for that entity; identify anomalous behavior of one of the plurality of entities by comparing monitored activity for that entity to the associated behavioral baseline data for that entity; and calculate a risk of the anomalous behavior using the directed graph by determining a relationship between the entity for which anomalous behavior has been identified and a different entity of the plurality of entities.
2. The system of claim 1 , wherein the relationship between entities used to calculate the risk is a vulnerability rating which indicates a difficulty of exploiting a vulnerability between entities.
3. The system of claim 2 , wherein the vulnerability rating comprises information regarding the levels and types of authentication required to access an entity.
4. The system of claim 1 , wherein each node further comprises a risk of attack rating which indicates a likelihood that the node will be subject to a cyberattack, and the calculation of risk is based in part on the risk rating.
5. The system of claim 1 , wherein each node further comprises a criticality rating which indicates the criticality to the computer network, or the organization operating the network, if the node is compromised by a cyberattack, and the calculation of risk is based in part on the criticality rating.
6. A method for cybersecurity analysis using user and entity behavioral analysis combined with network topology information, comprising the steps of: storing a directed graph in the memory of a computing device, the directed graph comprising a representation of a computer network wherein: nodes of the directed graph represent entities comprising the computer network; and edges of the directed graph represent relationships between the entities of the computer network; and the number of nodes required to represent entities in the directed graph is reduced using network segmentation by: assigning computing devices in the computing network to logical segments by changing their configurations or by changing the computer network configurations wherein the computing devices in a logical segment are treated analogously with respect to access of the computer network; and representing all computing devices in a logical segment as a single entity in the directed graph monitoring the activity of a plurality of entities comprising the computer network; establishing behavioral baseline data for each of the plurality of entities from the monitored activity over a defined period of time; associating the behavioral baseline data for each entity with the directed graph node for that entity; identifying anomalous behavior of one of the plurality of entities by comparing monitored activity for that entity to the associated behavioral baseline data for that entity; and calculating a risk of the anomalous behavior using the directed graph by determining a relationship between the entity for which anomalous behavior has been identified and a different entity of the plurality of entities.
7. The method of claim 6 , wherein the relationship between entities used to calculate the risk is a vulnerability rating which indicates a difficulty of exploiting a vulnerability between entities.
8. The method of claim 7 , wherein the vulnerability rating comprises information regarding the levels and types of authentication required to access an entity.
9. The method of claim 6 , wherein each node further comprises a risk rating which indicates a likelihood that the node will be subject to a cyberattack, and the calculation of risk is based in part on the risk rating.
10. The method of claim 6 , wherein each node further comprises a criticality rating which indicates the criticality to the computer network, or the organization operating the network, if the node is compromised by a cyberattack, and the calculation of risk is based in part on the criticality rating.