Privilege assurance of enterprise computer network environments

Abstract

A system and method for the prevention, mitigation, and detection of cyberattack attacks on computer networks by identifying weaknesses in directory access object allowances and providing professionals with centralized graph-centric tools to maintain and observe key security and performance insights into their security posture. The system uses an interrogation agent to collect Active Directory configuration parameters and activity information about a forest and the devices operating within. Cyber-physical graphs and histograms using persisted time-series data provides critical information, patterns, and alerts about configurations, attack vectors, and vulnerabilities which enable information technology and cybersecurity professionals greater leverage and control over their infrastructure.

What is claimed is: 
     
         1 . A system for privilege assurance protection of computer networks, comprising:
 a graph engine comprising a first plurality of programming instructions stored in a memory of, and operating on a processor of, a first computing device, wherein the first plurality of programming instructions, when operating on the processor of the first computing device, cause the first computing device to:
 receive a plurality of messages from a plurality of devices on a network, each message comprising network information relevant to privilege assurance, the network information comprising device identifiers and configuration parameters; 
 create and store a cyber-physical graph of the computer network using the received messages, wherein the vertices of the cyber-physical graph represent directory access protocol objects and the edges of the cyber-physical graph represent the relationships between those objects; 
 perform a plurality of queries over time on the cyber-physical graph for a cyberattack parameter of interest; 
 receive results of the plurality of queries; and 
 send the results to a time-series rule comparator; and 
   the time-series rule comparator comprising a second plurality of programming instructions stored in a memory of, and operating on a processor of, a second computing device, wherein the second plurality of programming instructions, when operating on the processor, cause the second computing device to:
 receive the results from the graph engine; 
 measure changes over time in the results; 
 if the measurement of changes over time exceeds a threshold, identify the directory access protocol objects and relationships which caused the measurement of changes to exceed the threshold and send the results to a user interface. 
   
     
     
         2 . A method for privilege assurance protection of computer networks, comprising the steps of:
 receiving, at a graph engine, a plurality of messages from a plurality of devices on a network, each message comprising network information relevant to privilege assurance, the network information comprising device identifiers and configuration parameters;   using the graph engine, creating and storing a cyber-physical graph of the network using the received messages, wherein the vertices of the cyber-physical graph represent directory access protocol objects and the edges of the cyber-physical graph represent the relationships between those objects;   performing a plurality of queries over time on the cyber-physical graph for a cyberattack parameter of interest;   receiving results of the plurality of queries;   using a time-series rule comparator, measuring changes over time in the results; and   if the measurement of changes over time exceeds a threshold, identifying the directory access protocol objects and relationships which caused the measurement of changes to exceed the threshold and sending the results to a user interface.