Unauthorized authentication events

1. A non-transitory machine-readable storage medium storing instructions that upon execution cause a system to:

for a given authentication event between a plurality of devices in a network, identify a set of events within a time window that includes a time of the given authentication event, wherein the set of events includes events that are temporally related to the given authentication event and that are of a different type from the given authentication event, wherein the plurality of devices include a first device at which a user or program initiated the given authentication event with a second device, and wherein the identifying of the set of events comprises:

identifying events of the first device only in a specified first time interval before the time of the given authentication event, and

identifying events of the second device only in a specified second time interval following the time of the given authentication event;

apply a classifier on a collection of features associated with the set of events including the events that are of the different type from the given authentication event;

determine, based on an output of the classifier, whether the given authentication event is an unauthorized authentication event; and

update the classifier in response to a triggering condition.

2. The non-transitory machine-readable storage medium of claim 1 , wherein a length of the specified first time interval and a length of the specified second time interval are based on historical data.

3. The non-transitory machine-readable storage medium of claim 1 , wherein the set of events comprises an event relating to a domain name system (DNS) lookup between devices, and another event comprising a Hypertext Transfer Protocol (HTTP) request from a device.

4. The non-transitory machine-readable storage medium of claim 1 , wherein determining that the given authentication event is the unauthorized authentication event comprises identifying the given authentication event as a lateral movement in the network by an unauthorized entity.

5. The non-transitory machine-readable storage medium of claim 1 , wherein the output of the classifier is based on further applying the classifier on a collection of features associated with the given authentication event, and wherein the applying of the classifier on the collection of features associated with the given authentication event and the applying of the classifier on the collection of features associated with the set of events comprises applying an ensemble of classifiers on the collection of features associated with the given authentication event and on the collection of features associated with the set of events.

6. The non-transitory machine-readable storage medium of claim 5 , wherein the ensemble of classifiers comprises classifiers derived according to different machine learning techniques.

7. The non-transitory machine-readable storage medium of claim 5 , wherein the ensemble of classifiers comprises classifiers trained using respective different samples of a labeled data set.

8. The non-transitory machine-readable storage medium of claim 1 , wherein the instructions upon execution cause the system to:

extract features of contexts associated with authentication events, each context of the contexts including associated events of a respective authentication event; and

learn the classifier using the extracted features of contexts associated with authentication events in a labeled data set.

9. The non-transitory machine-readable storage medium of claim 1 , wherein the triggering condition comprises a time-based condition or a user-initiated condition.

10. The non-transitory machine-readable storage medium of claim 1 , wherein the instructions upon execution cause the system to:

receive a first parameter value that defines the specified first time interval; and

receive a second parameter value that defines the specified second time interval.

11. The non-transitory machine-readable storage medium of claim 10 , wherein the instructions upon execution cause the system to:

determine the specified first time interval based on the time of the given authentication event less the first parameter value; and

determine the specified second time interval based on the time of the given authentication event plus the second parameter value.

12. A system comprising:

a processor; and

a non-transitory storage medium storing instructions that are executable on the processor to:

detect an authentication event that includes a user credential submitted from a first device to a second device in a network;

identify non-authentication events temporally related to a time of the detected authentication event, wherein the identifying of the non-authentication events comprises:

identifying events of the first device only in a specified first time interval before the time of the detected authentication event, and

identifying events of the second device only in a specified second time interval after the time of the detected authentication event;

indicate an occurrence of an unauthorized lateral movement by an entity in the network based on applying a classifier on information associated with the identified non-authentication events within a time window, wherein the classifier is part of an ensemble of classifiers; and

train each classifier of the ensemble of classifiers using different samples from a labeled data set.

13. The system of claim 12 , wherein the applying of the classifier comprises applying the classifier on features extracted from identified non-authentication events within the time window.

14. The system of claim 12 , wherein the applying of the classifier comprises applying the ensemble of classifiers on the information associated with_the identified non-authentication events within the time window to detect the occurrence of the unauthorized lateral movement.

15. The system of claim 12 , wherein the instructions are executable on the processor to:

receive a first parameter value that defines the specified first time interval; and

receive a second parameter value that defines the specified second time interval.

16. The system of claim 15 , wherein the instructions are executable on the processor to:

determine the specified first time interval based on the time of the detected authentication event less the first parameter value; and

determine the specified second time interval based on the time of the detected authentication event plus the second parameter value.

17. The system of claim 12 , wherein the identifying of the non-authentication events comprises identifying a first event comprising a domain name system (DNS) lookup and a second event comprising a Hypertext Transfer Protocol (HTTP) request.

18. The system of claim 17 , wherein the instructions are executable on the processor to:

apply the classifier on features associated with the first event and the second event.

19. A method comprising:

detecting, by a system comprising a hardware processor, an authentication event that includes a user credential submitted from a first device to a second device in a network;

identifying, by the system, a set of events that are temporally related to the detected authentication event, wherein the set of events is in a time window and includes events that are of a different type from the detected authentication event, wherein the time window includes a time of the detected authentication event, and wherein the identifying of the set of events comprises:

identifying events of the first device only in a specified first time interval before the time of the detected authentication event, and

identifying events of the second device only in a specified second time interval following the time of the detected authentication event;

executing, by the system, a classifier that is applied on features associated with the set of events and the detected authentication event;

determining, by the system based on an output of the classifier, whether the detected authentication event is an unauthorized authentication event; and

updating the classifier in response to a triggering condition.

20. The method of claim 19 , wherein the identifying of the set of events comprises identifying a first event comprising a domain name system (DNS) lookup and a second event comprising a Hypertext Transfer Protocol (HTTP) request, and wherein the classifier is applied on features associated with the first event and the second event.