Using graph enrichment to detect a potentially malicious access attempt
Techniques are described herein that are capable of using graph enrichment to detect a potentially malicious access attempt. A graph that includes nodes and configuration-based links is generated. The nodes represent respective resources. Behavior-based links are added to the graph based at least in part on traffic logs associated with at least a subset of the resources. An attempt to create a new behavior-based link is identified. A probability of the new behavior-based link being created in the graph is determined. The probability is based at least in part on the configuration-based links and the behavior-based links. The new behavior-based link is identified as a potentially malicious link based at least in part on the probability being less than or equal to a threshold probability. A security action is performed based at least in part on the new behavior-based link being identified as a potentially malicious link.
1. A system to use graph enrichment to detect a potentially malicious access attempt, the system comprising:
a memory; and
a processing system coupled to the memory, the processing system configured to:
generate a graph that includes at least a subset of a plurality of nodes and a plurality of configuration-based links, the plurality of nodes representing a plurality of respective resources in a network-based system, each configuration-based link representing a hierarchical relationship between a respective pair of the nodes such that a first node in the pair belongs to a second node in the pair;
add a plurality of behavior-based links to the graph based at least in part on traffic logs associated with at least a subset of the resources, each behavior-based link representing at least one of the following:
an access-based relationship between a respective pair of the nodes, which is based at least in part on a first node in the pair accessing a second node in the pair; or
an association-based relationship between a respective pair of nodes, which is based at least in part on a first node in the pair having a relationship with a third node and which is further based at least in part on the third node sharing a link with a second node in the pair;
identify an attempt to create a new behavior-based link between a designated first node of the plurality of nodes and a designated second node of the plurality of nodes, wherein the designated first node attempts to access the designated second node;
determine a probability of the new behavior-based link being created in the graph, wherein the probability is based at least in part on the plurality of configuration-based links and the plurality of behavior-based links;
identify the new behavior-based link as a potentially malicious link based at least in part on the probability of the new behavior-based link being created in the graph being less than or equal to a threshold probability; and
perform a security action based at least in part on the new behavior-based link being identified as a potentially malicious link, the security action configured to increase security of the network-based system.
2. The system of claim 1 , wherein an identified behavior-based link of the plurality of behavior-based links represents an access-based relationship between an identified pair of nodes, which is based at least in part on a first node in the identified pair accessing a second node in the identified pair.
3. The system of claim 1 , wherein an identified behavior-based link of the plurality of behavior-based links represents an association-based relationship between an identified pair of nodes, which is based at least in part on a first node in the identified pair having a relationship with a third node and which is further based at least in part on the third node sharing a link with a second node in the identified pair.
4. The system of claim 1 , wherein the processing system is configured to:
determine a plurality of link probabilities of the plurality of respective behavior-based links being created in the graph, wherein each link probability is based at least in part on the configuration-based links, the other behavior-based links in the plurality of behavior-based links, and the new behavior-based link; and
determine the probability of the new behavior-based link being created in the graph based at least in part on the plurality of link probabilities of the plurality of respective behavior-based links.
5. The system of claim 1 , wherein the processing system is further configured to:
after the plurality of behavior-based links are added to the graph, add a new node to the plurality of nodes in real-time to represent a new resource as a result of discovery of the new resource;
add at least one new configuration-based link to the graph, each new configuration-based link representing a hierarchical relationship between the new node and another respective node of the plurality of nodes; and
add at least one new behavior-based link to the plurality of behavior-based links, each new behavior-based link being between the new node and another respective node of the plurality of nodes.
6. The system of claim 1 , wherein the processing system is configured to:
determine that a motif in the graph is associated with malicious activity;
determine that the motif includes the new behavior-based link; and
identify the new behavior-based link as a potentially malicious link further based at least in part on the motif, which is associated with the malicious activity, including the new behavior-based link.
7. The system of claim 1 , wherein the processing system is configured to:
provide an alert to an entity associated with the network-based system based at least in part on the new behavior-based link being identified as a potentially malicious link, the alert indicating that the new behavior-based link between the designated first node and the designated second node is potentially malicious.
8. The system of claim 1 , wherein the processing system is configured to:
not allow creation of the new behavior-based link between the designated first node and the designated second node based at least in part on the new behavior-based link being identified as a potentially malicious link.
9. The system of claim 1 , wherein the processing system is configured to:
determine that the new behavior-based link between the designated first node and the designated second node is created; and
disconnect the new behavior-based link between the designated first node and the designated second node based at least in part on the new behavior-based link being identified as a potentially malicious link.
10. The system of claim 1 , wherein the processing system is configured to:
compare the probability of the new behavior-based link being created in the graph to a second threshold probability that is less than the first threshold probability; and
perform either a first action or a second action depending on whether the probability of the new behavior-based link being created in the graph is less than or equal to the second threshold probability, including:
perform the first action as a result of the probability of the new behavior-based link being created in the graph being greater than the second threshold probability, the first action including providing an alert to an entity associated with the network-based system, the alert indicating that the new behavior-based link between the designated first node and the designated second node is potentially malicious; or
perform the second action as a result of the probability of the new behavior-based link being created in the graph being less than or equal to the second threshold probability, the second action including not allowing creation of the new behavior-based link between the designated first node and the designated second node.
11. The system of claim 1 , wherein the processing system is configured to:
determine a confidence in an accuracy of the probability of the new behavior-based link being created in the graph;
compare the confidence to a confidence threshold; and
perform the security action further based at least in part on the confidence being greater than or equal to the confidence threshold.
12. A method of using graph enrichment to detect a potentially malicious access attempt, the method implemented by a computing system that is included in a network-based system, the method comprising:
generating a graph that includes at least a subset of a plurality of nodes and a plurality of configuration-based links, the plurality of nodes representing a plurality of respective resources in the network-based system, each configuration-based link representing a hierarchical relationship between a respective pair of the nodes such that a first node in the pair belongs to a second node in the pair;
adding a plurality of behavior-based links to the graph based at least in part on traffic logs associated with at least a subset of the resources, each behavior-based link representing at least one of the following:
an access-based relationship between a respective pair of the nodes, which is based at least in part on a first node in the pair accessing a second node in the pair; or
an association-based relationship between a respective pair of nodes, which is based at least in part on a first node in the pair having a relationship with a third node and which is further based at least in part on the third node sharing a link with a second node in the pair;
identifying an attempt to create a new behavior-based link between a designated first node of the plurality of nodes and a designated second node of the plurality of nodes, wherein the designated first node attempts to access the designated second node;
determining a probability of the new behavior-based link being created in the graph, wherein the probability is based at least in part on the plurality of configuration-based links and the plurality of behavior-based links;
identifying the new behavior-based link as a potentially malicious link based at least in part on the probability of the new behavior-based link being created in the graph being less than or equal to a threshold probability; and
performing a security action based at least in part on the new behavior-based link being identified as a potentially malicious link, the security action configured to increase security of the network-based system.
13. The method of claim 12 , further comprising:
determining that a motif in the graph is associated with malicious activity; and
determining that the motif includes the new behavior-based link;
wherein identifying the new behavior-based link as a potentially malicious link comprises:
identifying the new behavior-based link as a potentially malicious link further based at least in part on the motif, which is associated with the malicious activity, including the new behavior-based link.
14. The method of claim 12 , wherein performing the security action comprises at least one of the following:
providing an alert to an entity associated with the network-based system based at least in part on the new behavior-based link being identified as a potentially malicious link, the alert indicating that the new behavior-based link between the designated first node and the designated second node is potentially malicious; or
not allowing creation of the new behavior-based link between the designated first node and the designated second node based at least in part on the new behavior-based link being identified as a potentially malicious link.
15. The method of claim 12 , wherein identifying the attempt to create the new behavior-based link comprises:
determining that the new behavior-based link between the designated first node and the designated second node is created; and
wherein performing the security action comprises:
disconnecting the new behavior-based link between the designated first node and the designated second node based at least in part on the new behavior-based link being identified as a potentially malicious link.
16. The method of claim 12 , further comprising:
comparing the probability of the new behavior-based link being created in the graph to a second threshold probability that is less than the first threshold probability;
wherein performing the security action comprises:
performing either a first action or a second action depending on whether the probability of the new behavior-based link being created in the graph is less than or equal to the second threshold probability, including:
performing the first action as a result of the probability of the new behavior-based link being created in the graph being greater than the second threshold probability, the first action including providing an alert to an entity associated with the network-based system, the alert indicating that the new behavior-based link between the designated first node and the designated second node is potentially malicious; or
performing the second action as a result of the probability of the new behavior-based link being created in the graph being less than or equal to the second threshold probability, the second action including not allowing creation of the new behavior-based link between the designated first node and the designated second node.
17. The method of claim 12 , further comprising:
determining a sensitivity of data associated with the designated second node; and
comparing the sensitivity to a sensitivity threshold;
wherein performing the security action comprises:
performing the security action further based at least in part on the sensitivity being greater than or equal to the sensitivity threshold.
18. The method of claim 12 , further comprising:
determining a number of the plurality of resources whose performance is to be reduced by creation of the new behavior-based link;
wherein performing the security action comprises:
providing a notification to an entity associated with the network-based system based at least in part on the new behavior-based link being identified as a potentially malicious link, the notification indicating the number of the plurality of resources whose performance is to be reduced by the creation of the new behavior-based link.
19. The method of claim 12 , further comprising:
determining an extent to which performance of the plurality of resources is to be reduced by creation of the new behavior-based link;
wherein performing the security action comprises:
providing a notification to an entity associated with the network-based system based at least in part on the new behavior-based link being identified as a potentially malicious link, the notification indicating the extent to which the performance of the plurality of resources is to be reduced by the creation of the new behavior-based link.
20. A computer program product comprising a computer-readable storage medium having instructions recorded thereon for enabling a processor-based system to perform operations, which are configured to use graph enrichment to detect a potentially malicious access attempt, the operations comprising:
generating a graph that includes at least a subset of a plurality of nodes and a plurality of configuration-based links, the plurality of nodes representing a plurality of respective resources in a network-based system, each configuration-based link representing a hierarchical relationship between a respective pair of the nodes such that a first node in the pair belongs to a second node in the pair;
adding a plurality of behavior-based links to the graph based at least in part on traffic logs associated with at least a subset of the resources, each behavior-based link representing at least one of the following:
an access-based relationship between a respective pair of the nodes, which is based at least in part on a first node in the pair accessing a second node in the pair; or
an association-based relationship between a respective pair of nodes, which is based at least in part on a first node in the pair having a relationship with a third node and which is further based at least in part on the third node sharing a link with a second node in the pair;
identifying an attempt to create a new behavior-based link between a designated first node of the plurality of nodes and a designated second node of the plurality of nodes, wherein the designated first node attempts to access the designated second node;
determining a probability of the new behavior-based link being created in the graph, wherein the probability is based at least in part on the plurality of configuration-based links and the plurality of behavior-based links;
identifying the new behavior-based link as a potentially malicious link based at least in part on the probability of the new behavior-based link being created in the graph being less than or equal to a threshold probability; and
performing a security action based at least in part on the new behavior-based link being identified as a potentially malicious link, the security action configured to increase security of the network-based system.