SYSTEM AND METHOD FOR TRACK AND TRACE USER AND ENTITY BEHAVIOR ANALYSIS
A system and method for user-level network trace and tracking which leverages the uniqueness of verified authentication objects as metadata tags on captured network packets to gain insight at the user-level of how a network and various applications interact. The tagged network packets may be tracked, and the resulting data formed into a trace and track dataset to create one or more user-level dependency graphs alongside captured temporal dynamics. The trace and track dataset may be enriched with application trace information and runtime instruction data to improve the executable graph and provide deeper insight into application and user security on a given network.
1 . A system for user-level network tracking and tracing, comprising:
a computing device comprising a memory, a processor, and a non-volatile data storage device;
an authentication object database stored on the non-volatile data storage device, the authentication object database comprising a plurality of unique authentication objects, wherein each of the unique authentication objects is associated with a user; and
a tagging and tracking engine comprising a first plurality of programming instructions stored in the memory which, when operating on the processor, causes the computing device to:
capture a network packet;
add a metadata tag to the network packet, the metadata tag comprising one of the authentication objects;
create a track and trace dataset, the track and trace dataset comprising tracking data associated with the tagged network packet as the tagged network packet traverses a network; and
create a user-level dependency graph using a subset of the track and trace dataset.
2 . The system of claim 1 , wherein the unique authentication objects comprise a ticket, a token, or a hash value.
3 . The system of claim 1 , wherein the tagging and tracking engine is further configured to:
insert tracking code into a software application;
monitor the execution of the software application to produce data-flow information runtime trace; and
add the data-flow information and runtime trace to the track and trace dataset.
4 . The system of claim 3 , wherein the runtime trace comprises information associated with memory corruption vulnerabilities.
5 . The system of claim 3 , wherein the tagging and tracking engine is further configured to:
receive a plurality of crash dump data;
analyze a subset of the plurality of crash dump data to identify one or more security vulnerabilities; and
add the one or more security vulnerabilities to the trace and track dataset.
6 . The system of claim 5 , wherein static analysis and dynamic analysis is used to analyze the subset of the plurality of crash dump data.
7 . The system of claim 5 , further comprising an endpoint integration manager comprising a second plurality of programming instructions stored in the memory which, when operating on the processor, causes the computing device to:
connect to an endpoint device; and
send configuration instructions to the endpoint device, the configuration instructions comprising registry settings for the location to where crash dump data should be sent.
8 . The system of claim 1 , wherein the tagging and tracking engine is further configured to:
analyze the captured network packet to identify a protocol type associated with the captured network packet; and
wherein the metadata tag is added to the network packet based on the identified protocol type.
9 . A method for user-level network tracking and tracing, comprising the steps of:
storing an authentication object database on a non-volatile data storage device, the authentication object database comprising a plurality of unique authentication objects, wherein each of the unique authentication objects is associated with a user;
capturing a network packet;
adding a metadata tag to the network packet, the metadata tag comprising one of the authentication objects;
creating a track and trace dataset, the track and trace dataset comprising tracking data associated with the tagged network packet as the tagged network packet traverses a network; and
creating a user-level dependency graph using a subset of the track and trace dataset.
10 . The method of claim 9 , wherein the unique authentication objects comprise a ticket, a token, or a hash value.
11 . The method of claim 9 , further comprising the steps of:
inserting tracking code into a software application;
monitoring the execution of the software application to produce data-flow information runtime trace; and
adding the data-flow information and runtime trace to the track and trace dataset.
12 . The method of claim 11 , wherein the runtime trace comprises information associated with memory corruption vulnerabilities.
13 . The method of claim 11 , further comprising the steps of:
receiving a plurality of crash dump data;
analyzing a subset of the plurality of crash dump data to identify one or more security vulnerabilities; and
adding the one or more security vulnerabilities to the trace and track dataset.
14 . The method of claim 13 , wherein static analysis and dynamic analysis is used to analyze the subset of the plurality of crash dump data.
15 . The method of claim 13 , further comprising the steps of:
connecting to an endpoint device; and
sending configuration instructions to the endpoint device, the configuration instructions comprising registry settings for the location to where crash dump data should be sent.
16 . The method of claim 9 , further comprising the steps of:
analyzing the captured network packet to identify a protocol type associated with the captured network packet; and
wherein the metadata tag is added to the network packet based on the identified protocol type.