Patent ID: 11956260
Assignee: RAPID7, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 0:
1. A system, comprising:
one or more hardware processors with associated memory that implement a cyberattack monitoring service, configured to:
monitor network data of a computer network, wherein the network data indicates connections made or attempted among nodes of the computer network during a time interval and respective times that the connections were made or attempted;
generate a plurality of connection graphs from the network data, wherein each of the connection graphs indicates a subset of the nodes of the computer network that made or attempted connections with one another during the time interval and one or more anomalies in connection behavior of the subset of nodes during the time interval;
compute a graph metric for each of the connection graphs based on a highest degree of nodes that indicates a maximum number of edges from any node in individual ones of the connection graphs, wherein the graph metric for each connection graph is computed based on configuration information received via a configuration interface of the cyberattack monitoring service, and the configuration information specifies that the graphic metric is computed based on a size and an order of the connection graph;
determine, based on the graph metric, a highest-ranking connection graph to evaluate for a suspected lateral movement of a cyberattack during the time interval;
determine, in the highest-ranking connection graph, a suspected attack path that indicates a series of nodes linked by a sequence of time-ordered connections and one or more anomalies in connection behavior of one or more node in the suspected attack path during the time interval; and
generate an alert indicating the suspected attack path and the on the one or more anomalies.