Advanced detection of identity-based attacks to assure identity fidelity in information technology environments
A system and method for the detection and mitigation of Kerberos golden ticket, silver ticket, and related identity-based cyberattacks by passively monitoring and analyzing Kerberos and authentication operations within the network. The system and method provide real-time detections of identity attacks using time-series data and data pipelines, and by transforming the stateless Kerberos protocol into stateful protocol. A packet capturing agent is deployed on the network where captured time-series Kerberos and related event and log information is processed in distributed computational graph (DCG) stages where declarative rules determine if an attack is being carried out and what type of attack it is.
1. A system for detection and mitigation of authentication attacks, comprising:
a graph module comprising a first plurality of programming instructions stored in a memory of, and operating on a processor of, a computing device, wherein the first plurality of programming instructions, when operating on the processor, cause the computing device to:
retrieve information about an authentication transaction, the information comprising authentication data regarding clients, services, and key distribution centers;
create a graph representing a plurality of authentication transactions, the graph comprising nodes representing the clients, services, and key distribution centers associated with a plurality of authentication transactions and edges representing time-series identity information associated with each independent authentication transaction; and
identify cybersecurity attacks by detecting missing or anomalous data within the time-series identity information.
2. The system of claim 1 , wherein the graph module is a distributed computational graph module for stream-processing detection.
3. The system of claim 1 , wherein the graph module is a cyber-physical graph module for event-driven detection.
4. The system of claim 1 , wherein both a distributed computational graph module and a cyber-physical graph module may be employed for event-driven and stream-processing detection.
5. The system of claim 1 , further comprising edges with time and date information.
6. The system of claim 1 , further comprising edges with Internet Protocol (IP) information.
7. The system of claim 1 , further comprising edges with hash and encryption information.
8. The system of claim 1 , further comprising edges with hash information.
9. The system of claim 1 , further detecting a plurality of authentication attacks using operating system event logs.
10. The system of claim 9 , wherein a plurality of authentication attacks are identified with Boolean logic.
11. A method for detection and mitigation of authentication attacks, comprising the steps of:
retrieving information about an authentication transaction, the information comprising authentication data regarding clients, services, and key distribution centers;
creating a graph representing a plurality of authentication transactions, the graph comprising nodes representing the clients, services, and key distribution centers associated with a plurality of authentication transactions and edges representing time-series identity information associated with each independent authentication transaction; and
identifying cybersecurity attacks by detecting missing or anomalous data within the time-series identity information.
12. The method of claim 11 , wherein the graph module is a distributed computational graph module for stream-processing detection.
13. The method of claim 11 , wherein the graph module is a cyber-physical graph module for event-driven detection.
14. The method of claim 11 , wherein both a distributed computational graph module and a cyber-physical graph module may be employed for event-driven and stream-processing detection.
15. The method of claim 11 , further comprising edges with time and date information.
16. The method of claim 11 , further comprising edges with Internet Protocol (IP) information.
17. The method of claim 11 , further comprising edges with hash and encryption information.
18. The method of claim 11 , further comprising edges with hash information.
19. The method of claim 11 , further detecting a plurality of authentication attacks using operating system event logs.
20. The method of claim 19 , wherein a plurality of authentication attacks are identified with Boolean logic.