Privilege assurance of enterprise computer network environments using logon session tracking and logging

1. A system for prevention, mitigation, and detection of cyberattack attacks on computer networks using logon session tracking and logging, comprising:

a local session monitor comprising a first plurality of programming instructions stored in a memory of, and operating on a processor of, a first computing device within a computer network operating a directory access protocol, wherein the first plurality of programming instructions, when operating on the processor of the first computing device, cause the first computing device to:

receive a first plurality of session-based details for an authentication session for a user;

check the validity of the first plurality of session-based details, using a stored session configuration;

log the first plurality of session-based details; receive a second plurality of session details;

compare the first and second pluralities of session details to identify any mismatched data;

where invalid or mismatched information is identified in the first or second pluralities of session-based details, generate an event log indicating the particular session-based details that contain the invalid or mismatched information;

send the event log to a graph engine;

a graph engine comprising a second plurality of programming instructions stored in a memory of, and operating on a processor of, a second computing device, wherein the second plurality of programming instructions, when operating on the processor of the second computing device, cause the second computing device to:

receive the event log;

create and store a cyber-physical graph of the computer network using the event log, wherein the vertices of the cyber-physical graph represent directory access protocol objects and the edges of the cyber-physical graph represent the relationships between those objects;

perform a plurality of queries over time on the cyber-physical graph about a cyberattack parameter of interest;

receive results of the plurality of queries; and

send the results to a time-series rule comparator;

a time-series rule comparator comprising a third plurality of programming instructions stored in a memory of, and operating on a processor of, a third computing device, wherein the third plurality of programming instructions, when operating on the processor, cause the third computing device to:

receive the results from the graph engine;

measure changes over time in the results;

if the measurement of the changes over time exceeds a threshold, send the results to a user interface; and

a user interface comprising a fourth plurality of programming instructions stored in a memory of, and operating on a processor of, a fourth computing device, wherein the fourth plurality of programming instructions, when operating on the processor, cause the fourth computing device to:

receive the results;

identify the directory access protocol objects and relationships which caused the measurement of changes to exceed the threshold; and

display a portion of the cyber-physical graph comprising the vertices and edges corresponding to the identified directory access protocol objects and relationships.

2. The system of claim 1 , wherein the first plurality of session-based details comprises a session expiration timing information.

3. The system of claim 2 , wherein the invalid information comprises invalid expiration timing information.

4. The system of claim 1 , wherein the first plurality of session-based details comprises a user name.

5. The system of claim 4 , wherein the mismatched information comprises a user name that does not correspond to the user of the authentication session.

6. A method for prevention, mitigation, and detection of cyberattack attacks on computer networks using logon session tracking and logging, comprising the steps of:

collecting, at a local session monitor, a first plurality of session-based details for an authentication session for a user;

checking the validity of the first plurality of session-based details, using a stored session configuration;

logging the first plurality of session-based details;

receiving a second plurality of session details;

comparing the first and second pluralities of session details to identify any mismatched data;

where invalid or mismatched information is identified in the first or second pluralities of session-based details, generating an event log indicating the particular session-based details that contain the invalid or mismatched information;

sending the event log to a graph engine;

creating and storing a cyber-physical graph of the computer network using the event log, wherein the vertices of the cyber-physical graph represent directory access protocol objects and the edges of the cyber-physical graph represent the relationships between those objects;

performing a plurality of queries over time on the cyber-physical graph about a cyberattack parameter of interest;

receiving results of the plurality of queries;

measure changes over time in the results;

if the measurement of the changes over time exceeds a threshold, sending the results to a user interface;

identifying the directory access protocol objects and relationships which caused the measurement of changes to exceed the threshold; and

displaying, on the user interface, a portion of the cyber-physical graph comprising the vertices and edges corresponding to the identified directory access protocol objects and relationships.

7. The method of claim 6 , wherein the first plurality of session-based details comprises a session expiration timing information.

8. The method of claim 7 , wherein the invalid information comprises invalid expiration timing information.

9. The method of claim 6 , wherein the first plurality of session-based details comprises a user name.

10. The method of claim 9 , wherein the mismatched information comprises a user name that does not correspond to the user of the authentication session.