Patent ID: 11968227
Assignee: QOMPLX LLC
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 5:
6. A method for detecting ticket-based attacks within a domain, comprising the steps of:
using an authentication object inspector operating on a computing device comprising a memory and a processor to:
receive network traffic via a first network connection, the network traffic comprising at least a plurality of first authentication objects known to be generated by an identity provider associated with an authentication domain;
store a record of each received first authentication object, with attached metadata comprising a timestamp of when each first authentication object was received, in a time-series database;
compute a unique identifier of each first authentication object;
store the unique identifier of each first authentication object in a database of unique identifiers for the identity provider;
receive a request for access to a network resource within the authentication domain accompanied by a second authentication object;
compute a unique identifier of the second authentication object;
determine if the second unique identifier exists in the database of unique identifiers for the authentication provider; and
where the unique identifier of the second authentication object does not exist in the database of unique identifiers:
analyze a plurality of the stored first authentication objects to determine a plurality of compromised accounts;
analyze a plurality of the stored network traffic records to determine a plurality of access paths;
generate an incident report comprising results of the analyses of the plurality of stored first authentication objects and the plurality of stored network traffic records; and
transmit the incident report via a second network connection that is not connected to, or visible to, to the identity provider;, wherein each unique identifier is a cryptographic hash generated by performing a plurality of calculations and transformations on the respective authentication object.