Characterizing university network usage with Active Directory event logs

Active Directory;Network usage;Network characterization;University network;University network usage;University network characterization;Lateral movement;Event logs;Active Directory event logs

Mitsdarfer, Alex Joseph ; Bailey ; Michael

关键词: Active Directory;    Network usage;    Network characterization;    University network;    University network usage;    University network characterization;    Lateral movement;    Event logs;    Active Directory event logs;   

Others  :  https://www.ideals.illinois.edu/bitstream/handle/2142/99375/MITSDARFER-THESIS-2017.pdf?sequence=1&isAllowed=y

美国|英语

来源: The Illinois Digital Environment for Access to Learning and Scholarship

【 摘 要 】

In this thesis, we investigate a university network that uses Active Directory as its authentication system. We get an understanding of the network by analyzing Windows event logs generated at Active Directory domain controllers. We want to see what network activity looks like as a first step in identifying and modeling network lateral movement. We characterize network activity, access behavior, most frequent events encountered, and domain controller usage. We find that the data, covering a week’s time, supports multiple trends. The number of events encountered increases from morning to noon and decreases after mid afternoon. Weekend activity is lower than during weekdays. Over the week of user-generated events, about 85% create 1,000 events or less. Less than 5% of users create more than 10,000 events. The top five events encountered are associated with user sessions (i.e., login, logout, authentication) or Kerberos ticket requests. Most events are generated at the Urbana Domain Controllers. The second largest number of events (although about 15 times smaller) are generated at the DCs that serve only WiFi and VPN.