System and method for user and entity behavioral analysis using network topology information
A system and method for network cybersecurity analysis that uses user and entity behavioral analysis combined with network topology information to provide improved cybersecurity. The system and method involve gathering network entity information, establishing baseline behaviors for each entity, and monitoring each entity for behavioral anomalies that might indicate cybersecurity concerns. Further, the system and method involve incorporating network topology information into the analysis by generating a model of the network, annotating the model with risk and criticality information for each entity in the model and with a vulnerability level between entities, and using the model to evaluate cybersecurity risks to the network. Risks and vulnerabilities associated with user entities may be represented, in part or in whole, by the behavioral analyses and monitoring of those user entities.
1. A system for cybersecurity analysis using user and entity behavioral analysis combined with network topology information, comprising:
a computing device comprising a memory and a processor;
a directed graph stored in the memory of the computing device, the directed graph comprising a representation of a computer network wherein:
nodes of the directed graph represent a plurality of users and a plurality of devices of the computer network; and
edges of the directed graph represent relationships between pairs of users and devices of the computer network; and
a behavioral analysis engine comprising a plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the plurality of programming instructions, when operating on the processor, cause the computing device to:
monitor the activity of a plurality of users of the computer network;
establish behavioral baseline data for each of the plurality of users of the network from the monitored activity over a defined period of time;
identify anomalous behavior of one of the plurality of users of the network by comparing monitored activity for that user to the associated behavioral baseline data for that user; and
calculate a risk of the anomalous behavior using the directed graph by determining a relationship between the user for which anomalous behavior has been identified and one or more of the plurality of devices of the network;
wherein network segmentation is used to reduce the number of nodes required to represent devices in the directed graph by:
assigning devices in the computing network to logical segments, wherein the devices in a logical segment are treated analogously with respect to access of the computer network; and
representing all devices in a logical segment as a single entity in the directed graph.
2. The system of claim 1 , wherein the relationship between pairs of users and devices of the computer network used to calculate the risk is a vulnerability rating which indicates a difficulty of exploiting a vulnerability.
3. The system of claim 2 , wherein the vulnerability rating comprises information regarding the levels and types of authentication required to access a device.
4. The system of claim 1 , wherein each node further comprises a risk of attack rating which indicates a likelihood that the node will be subject to a cyberattack, and the calculation of risk is based in part on the risk rating.
5. The system of claim 1 , wherein each node further comprises a criticality rating which indicates the criticality to the computer network, or the organization operating the network, if the node is compromised by a cyberattack, and the calculation of risk is based in part on the criticality rating.
6. A method for cybersecurity analysis using user and entity behavioral analysis combined with network topology information, comprising the steps of:
storing a directed graph in the memory of a computing device, the directed graph comprising a representation of a computer network wherein:
nodes of the directed graph represent a plurality of users and a plurality of devices of the computer network; and
edges of the directed graph represent relationships between pairs of users and devices of the computer network;
monitoring the activity of a plurality of users of the computer network;
establishing behavioral baseline data for each of the plurality of users of the network from the monitored activity over a defined period of time;
identifying anomalous behavior of one of the plurality of users of the network by comparing monitored activity for that entity to the associated behavioral baseline data for that user; and
calculating a risk of the anomalous behavior using the directed graph by determining a relationship between the user for which anomalous behavior has been identified and one or more of the plurality of devices of the network;
wherein network segmentation is used to reduce the number of nodes required to represent devices in the directed graph by:
assigning devices in the computing network to logical segments, wherein the devices in a logical segment are treated analogously with respect access of the computer network; and
representing all devices in a logical segment as a single entity in the directed graph.
7. The method of claim 6 , wherein the relationship between pairs of users and devices of the network used to calculate the risk is a vulnerability rating which indicates a difficulty of exploiting a vulnerability.
8. The method of claim 7 , wherein the vulnerability rating comprises information regarding the levels and types of authentication required to access a device.
9. The method of claim 6 , wherein each node further comprises a risk rating which indicates a likelihood that the node will be subject to a cyberattack, and the calculation of risk is based in part on the risk rating.
10. The method of claim 6 , wherein each node further comprises a criticality rating which indicates the criticality to the computer network, or the organization operating the network, if the node is compromised by a cyberattack, and the calculation of risk is based in part on the criticality rating.
11. The method of claim 6 , further comprising the step of using network segmentation to reduce the number of nodes required to represent devices in the directed graph by:
assigning devices in the computing network to logical segments by changing their configurations or by changing the computer network configurations wherein the devices in a logical segment are treated similarly with respect access of the computer network; and
representing all devices in a logical segment as a single entity in the directed graph.