Detecting unmanaged and unauthorized assets in an information technology network with a recurrent neural network that identifies anomalously-named assets

Abstract

The present disclosure describes a system, method, and computer program for detecting unmanaged and unauthorized assets on an IT network by identifying anomalously-named assets. A recurrent neural network (RNN) is trained to identify patterns in asset names in a network. The RNN learns the character distribution patterns of the names of all observed assets in the training data, effectively capturing the hidden naming structures followed by a majority of assets on the network. The RNN is then used to identify assets with names that deviate from the hidden naming structures. Specifically, the RNN is used to measure the reconstruction errors of input asset name strings. Asset names with high reconstruction errors are anomalous since they cannot be explained by learned naming structures. After filtering for attributes or circumstances that mitigate risk, such assets are associated with a higher cybersecurity risk.

Description

BACKGROUND OF THE INVENTION

1. Field of the Invention

This invention relates generally to security analytics in computer networks, and more specifically to detecting unmanaged and unauthorized assets in a computer network by using a recurrent neural network to identify anomalously-named assets.

2. Description of the Background Art

Devices unknown to corporate information technology (IT) teams pose security threats. Whether they are legitimate, but unmanaged devices, or unauthorized rogue devices, they represent a security blind spot, as they are potential entry points for malware or adversarial actions. In 2016, the world discovered the Mirai Botnet, which targeted Internet-of-Things (IoT) devices that are generally not managed by businesses. The rapid growth of bring-your-own-device (BYOD) initiatives invites security risks as employees, contractors, and partners bring unvetted devices to corporate networks. Unknown devices are not limited to the physical hardware of users' laptops or employees' smartphones. With compromised accounts, adversaries can create unmonitored virtual machine (VM) at will for malicious purposes and delete the VMs afterwards to hide their tracks. These devices present an attack surface from multiple points. The risks are comprised intellectual property, leaked sensitive data, and a tarnished company reputation.

Current approaches in device management range from deployment of mobile device management (MDM) tools to cloud access security broker (CASB) enforcement. Nonetheless, these solutions are costly and require administration as well as compliance. And they do not address devices brought in by nonemployees or virtual machines created and used in a malicious way. Reducing the security risk from unknown physical or virtual devices is multifaceted. A key first step toward reducing risk from unknown devices is to recognize and identify their presence.

In a large corporate network, managed devices adhere to some official naming conventions. In practice, groups of unmanaged devices may have their own unofficial naming conventions that are unknown to the IT department. Some such groups belong to internal departments outside of formal control policy; some are from legacy systems or domains; some belong to external vendors or partners; and some are communication devices brought in by employees. Outside of these, unmanaged or unauthorized device with arbitrary names without naming peers are the most interesting, as they are anomalous. An example is a freely-named VM created via compromised credentials.

There is demand for a system that can detect anomalously-named devices on a network. Such a system can be part of a comprehensive risk detection system. Known industry solutions rely on policies to manage controlled devices. We are unaware of any prior work that investigates the presence of unknown devices from device name only.

SUMMARY OF THE DISCLOSURE

The present disclosure describes a system, method, and computer program for detecting unmanaged and unauthorized assets on an IT network by identifying anomalously-named assets. A recurrent neural network (RNN), such as a long short-term network (LSTM) or bidirectional RNN, is trained to identify patterns in asset names in a network. The RNN learns the character distribution patterns of the names of all observed assets in the training data, effectively capturing the hidden naming structures followed by a majority of assets on the network. The RNN is then used to identify and flag assets with names that deviate from the hidden asset naming structures. Specifically, the RNN is used to measure the reconstruction errors of input asset name strings. Asset names with high reconstruction errors are anomalous since they cannot be explained by learned naming structures. These identified assets make up an initial pool of potentially unmanaged and unauthorized assets.

In certain embodiments, the initial pool is then filtered to remove assets with attributes that mitigate the cybersecurity risk associated with them. For example, the filtering may remove assets who names may deviate from network-wide naming conventions, but are consistent with naming conventions in their peer group.

The assets in the pool that remain after filtering are associated with a higher cybersecurity risk, as these assets are likely unmanaged and unauthorized assets. In certain embodiments, this means that these assets are presented in a user interface for administrative review. In addition or alternatively, in a system that computes a cybersecurity risk score for user sessions, the presence of these assets for the first time in a user session elevates the risk score for the session.

In one embodiment, a method for detecting anomalously-named assets comprises the following:

• • creating a set of input vectors representative of an asset name in the IT network, each vector in the set corresponding to a character in the asset name;
  • applying the set of input vectors to a recurrent neural network comprising an encoder and a decoder, wherein the recurrent neural network is trained to identify patterns in asset names in the IT network;
  • using the encoder to compress the set of input vectors to a single latent vector that is representative of the asset name and that is generated based on patterns in asset names in the IT network learned by the recurrent neural network during training;
  • applying the latent vector to the decoder as an initial state of the decoder to reconstruct the asset name one character at a time;
  • receiving the reconstructed asset name;
  • determining a degree of reconstruction error between the reconstructed asset name and the asset name;
  • determining whether the degree of reconstruction error is above a threshold; and
  • in response to determining that the degree of reconstruction error is above a threshold, flagging the asset name as being anomalous.

BRIEF DESCRIPTION OF THE DRAWINGS

FIGS. 1A-1B are flowcharts that illustrates a method, according to one embodiment, for detecting anomalous asset names in an IT network.

FIG. 2 is a flowchart that illustrates a method, according to one embodiment, for providing an indication of an elevated cybersecurity risk for certain anomalously-named assets.

FIG. 3 is a flowchart that illustrates an example method for filtering out anomalously-named assets based on whether an asset's name conforms with the asset's peer group.

FIG. 4 is a diagram illustrating an example seq2seq LSTM.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

The present disclosure describes a system, method, and computer program for detecting unmanaged and unauthorized assets on an IT network by identifying anomalously-named assets. Examples of assets are virtual machines and physical devices, such as computers, printers, and smart phones. The method is performed by a computer system (the “system”), such as a computer system that detects cyber threats in a network. The system may be a user behavior analytics (UBA) system or a user-and-entity behavior analytics system (UEBA). An example of a UBA/UEBA cybersecurity monitoring system is described in U.S. Pat. No. 9,798,883 issued on Oct. 24, 2017 and titled “System, Method, and Computer Program for Detecting and Assessing Security Risks in a Network,” the contents of which are incorporated by reference herein.

1. Identify Assets with Anomalous Names

FIGS. 1A-1B illustrate a method for detecting anomalous asset names in an IT network. Although the method is described with respect to a single asset, it is performed for each of a plurality of assets in the network (e.g., all assets). The system creates a set of input vectors representative of an asset name (step 110). The asset name is treated as a sequence of characters, and each vector in the set corresponds to a character in the asset name. In one embodiment, each character is represented by a numerical value, and each character is converted to a numerical value using one-hot encoding.

The system applies the set of input vectors to an RNN that has been trained to identify patterns in asset names in the IT network (step 120). As described below, during training the RNN learns the character distribution patterns of the names of all observed assets in the training data, effectively capturing the hidden naming structures followed by a majority of assets on the network.

The RNN comprises an encoder and a decoder. The system uses the RNN encoder to compress the set of input vectors into a single latent vector that is representative of the asset name and that is generated based on patterns in asset names in the IT network learned by the RNN during training (step 130). The system then uses the decoder, the single latent vector, and the set of input vectors to reconstruct the asset name. Specifically, the decoder receives the single latent vector output of the encoder as its initial state (step 140) With the state initialized by the single latent vector, the set of input vectors is then applied to the decoder to reconstruct the asset name (step 150).

In one embodiment, the RNN is a seq2seq long short-term memory network (LSTM), and the asset name is reconstructed one character at a time with teacher forcing method in which the set of input vectors, offset by one time step, is applied to the LSTM decoder. In other words, the LSTM decoder predicts a character at time t given a character at time t−1 and the state of the LSTM decoder at time t. In an alternate embodiment, the RNN is a bidirectional recurrent neural network.

The system receives the reconstructed asset name from the decoder and determines a degree of reconstruction error between the reconstructed asset name and the original asset name (steps 160, 170). The system ascertains whether the reconstruction error is above a threshold (e.g., top 1% largest error) (step 180). If the reconstruction error is above the threshold, the asset is flagged as anomalous (step 185). Otherwise, the system concludes that the asset name is not anomalous (190). In one embodiment, the system computes the categorical cross-entropy loss values of the asset name character sequences, and flags the top r percent (e.g., top 1%) of asset names with the largest loss as the initial candidates of anomalous asset names to review.

2. Filtering Assets Flagged as Anomalous and Associating Elevated Risk with Anomalously-Named Assets that Pass Filtering

As illustrated in FIG. 2, in certain embodiments, the system takes the initial pool of asset with names flagged as anomalous and filters the pool to remove assets that are less likely to be unmanaged and unauthorized assets (steps 210, 220). For example, the system may remove assets that may have anomalous names when looked at the network in whole, but not when compared to the asset's peer group (i.e. the assets names are anomalous from a global network-wide perspective, but not from a local peer group perspective). Also, the system may filter out assets used by multiple users, as an asset used by a single user is deemed to be riskier than others that are accessed by multiple users.

Assets that satisfy the filter criteria are de-flagged as being anomalous (step 230, 240). The system provides an indicator of an elevated cybersecurity risk for anomalously-named assets that pass through the filter criteria, as these assets are likely to be unmanaged and unauthorized assets (step 230, 250). For example, these assets may be presented in a user interface for administrative review. The displayed assets may be ranked based on reconstruction error (i.e., the higher the reconstruction error, the higher the rank). In addition or alternatively, whether an asset has an anomalous name may be used by a UBA/UBEA as input to a risk rule. Anomalously-named assets that pass the filter criteria may trigger a risk rule, resulting in a higher risk score for the applicable user or asset session. For example, the system may add points to a user session risk score if it is the first time the system is seeing an asset in the network and it has an anomalous name.

FIG. 3 illustrates a method for filtering out anomalously-named assets based on whether the asset is unusual within the asset's peer group. For each asset identified as having an anomalous name within the network, the system identifies an associated asset peer group using Internet Protocol (IP) addresses (step 310). For example, the system may cluster assets based on the first three blocks of the IP address to group assets into peer groups. The system then determines whether a prefix or suffix in the anomalously-named asset is common to the peer group (step 320). If so, the asset is de-flagged as being anomalous (step 330). Otherwise, the asset name “passes through” the filter and remains anomalous (step 340).

3. Training the RNN to Identify Patterns in Asset Names

The RNN is trained is to identify patterns in asset names by performing steps 110-170 with respect to a training data set and training the RNN to minimize the reconstruction errors. For example, the training data set may be extracting asset names from a window (e.g., 3 months) of domain controller logs in which user-to-asset authentications are recorded. One portion (e.g., 80%) of the training data set is used for training, and one portion (e.g., 20%) is used for parameter validation. To prepare the input data for RNN training, asset names may be fixed to a length n, where n is the length of the top 99% quantile of all asset names in the environment.

During training, the decoder receives the ground truth at the current time step as the input at the next time step in the teacher forcing method. At the output of the decoder, a densely connected layer is used to predict the sequential characters one by one. The loss function is specified as categorical cross-entropy since the prediction of each character is considered multi-class classification. This results in an RNN that learns the character distribution patterns of the names of all observed assets in the training data, effectively capturing the hidden naming structures followed by a majority of assets on the network.

FIG. 4 illustrates an example with an LSTM architecture for the RNN. A vector representative of a device called “TAL” is inputted into encoder, which generates a latent vector that is a learned representation of the input. For the corresponding output sequence, the symbols “/s” and “/n” are used as the start and end sequence characters. During training, the learned latent vector and the character “/s” is used to predict “T” in the decoder. The latent vector and the character “T” are used to predict “A”, and so on. In one embodiment, the RNN implementation is written in Python using the Keras framework.

The methods described with respect to FIGS. 1-4 are embodied in software and performed by a computer system (comprising one or more computing devices) executing the software. A person skilled in the art would understand that a computer system has one or more physical memory units, disks, or other physical, computer-readable storage media for storing software instructions, as well as one or more processors for executing the software instructions.

As will be understood by those familiar with the art, the invention may be embodied in other specific forms without departing from the spirit or essential characteristics thereof. Accordingly, the above disclosure is intended to be illustrative, but not limiting, of the scope of the invention, which is set forth in the following claims.

Claims

1. A method, performed by a computer system, for anomalous asset name detection in an IT computer network, the method comprising: creating a set of input vectors representative of an asset name in the IT network, each vector in the set corresponding to a character in the asset name;applying the set of input vectors to a recurrent neural network comprising an encoder and a decoder, wherein the recurrent neural network is trained to identify patterns in asset names in the IT network;using the encoder to compress the set of input vectors to a single latent vector that is representative of the asset name and that is generated based on patterns in asset names in the IT network learned by the recurrent neural network during training;applying the latent vector to the decoder as an initial state of the decoder to reconstruct the asset name one character at a time;receiving the reconstructed asset name;determining a degree of reconstruction error between the reconstructed asset name and the asset name;determining whether the degree of reconstruction error is above a threshold;in response to determining that the degree of reconstruction error is above a threshold, flagging the asset name as being anomalous;applying one or more filter criteria to assets flagged as having an anomalous name, wherein applying the one or more filter criteria comprises: identifying a peer asset group associated with an asset having a flagged asset name, wherein the peer group is identified based on IP addresses of assets,determining whether a prefix or suffix in the flagged asset name is common to the peer group, andin response to determining that the prefix or suffix of the flagged asset name is common to the peer group, concluding that the asset satisfies the filter criteria;filtering out assets that satisfy the filter criteria; andproviding an indication of an elevated cybersecurity risk for at least a subset of remaining flagged assets that pass filtering.

2. The method of claim 1, wherein applying the filter criteria comprises: identifying a number of users using an asset having a flagged asset name; andin response to the number being above a threshold, concluding that the asset satisfies the filter criteria.

3. The method of claim 1, wherein providing an indication of an elevated cybersecurity risk comprises displaying flagged asset names that pass filtering in a user interface for administrative review.

4. The method of claim 1, wherein providing an indication of an elevated cybersecurity risk comprises increasing a risk score of a user session using a flagged asset that passed filtering.

5. The method of claim 1, wherein the set of input vectors is created using one-hot encoding.

6. The method of claim 1, wherein the recurrent neural network is a bidirectional recurrent neural network.

7. The method of claim 1, wherein the recurrent neural network is a seq2seq LSTM.

8. The method of claim 7, wherein the asset name is reconstructed one character at a time with teacher forcing method in which the set of input vectors, offset by one time step, is applied to the decoder.

9. A non-transitory computer-readable medium comprising a computer program, that, when executed by a computer system, enables the computer system to perform the following method for anomalous asset name detection in an IT computer network, the method comprising: creating a set of input vectors representative of an asset name in the IT network, each vector in the set corresponding to a character in the asset name;applying the set of input vectors to a recurrent neural network comprising an encoder and a decoder, wherein the recurrent neural network is trained to identify patterns in asset names in the IT network;using the encoder to compress the set of input vectors to a single latent vector that is representative of the asset name and that is generated based on patterns in asset names in the IT network learned by the recurrent neural network during training;applying the latent vector to the decoder as an initial state of the decoder to reconstruct the asset name one character at a time;receiving the reconstructed asset name;determining a degree of reconstruction error between the reconstructed asset name and the asset name;determining whether the degree of reconstruction error is above a threshold;in response to determining that the degree of reconstruction error is above a threshold, flagging the asset name as being anomalous;applying one or more filter criteria to assets flagged as having an anomalous name, wherein applying the one or more filter criteria comprises: identifying a peer asset group associated with an asset having a flagged asset name, wherein the peer group is identified based on IP addresses of assets,determining whether a prefix or suffix in the flagged asset name is common to the peer group, andin response to determining that the prefix or suffix of the flagged asset name is common to the peer group, concluding that the asset satisfies the filter criteria;filtering out assets that satisfy the filter criteria; andproviding an indication of an elevated cybersecurity risk for at least a subset of remaining flagged assets that pass filtering.

10. The non-transitory computer-readable medium of claim 9, wherein applying the filter criteria comprises: identifying a number of users using an asset having a flagged asset name; andin response to the number being above a threshold, concluding that the asset satisfies the filter criteria.

11. The non-transitory computer-readable medium of claim 9, wherein providing an indication of an elevated cybersecurity risk comprises displaying flagged asset names that pass filtering in a user interface for administrative review.

12. The non-transitory computer-readable medium of claim 9, wherein providing an indication of an elevated cybersecurity risk comprises increasing a risk score of a user session using a flagged asset that passed filtering.

13. The non-transitory computer-readable medium of claim 9, wherein the set of input vectors is created using one-hot encoding.

14. The non-transitory computer-readable medium of claim 9, wherein the recurrent neural network is a bidirectional recurrent neural network.

15. The non-transitory computer-readable medium of claim 9, wherein the recurrent neural network is a seq2seq LSTM.

16. The non-transitory computer-readable medium of claim 15, wherein the asset name is reconstructed one character at a time with teacher forcing method in which the set of input vectors, offset by one time step, is applied to the decoder.

17. A computer system for anomalous asset name detection in an IT computer network, the system comprising: one or more processors;one or more memory units coupled to the one or more processors, wherein the one or more memory units store instructions that, when executed by the one or more processors, cause the system to perform the operations of: creating a set of input vectors representative of an asset name in the IT network, each vector in the set corresponding to a character in the asset name;applying the set of input vectors to a recurrent neural network comprising an encoder and a decoder, wherein the recurrent neural network is trained to identify patterns in asset names in the IT network;using the encoder to compress the set of input vectors to a single latent vector that is representative of the asset name and that is generated based on patterns in asset names in the IT network learned by the recurrent neural network during training;applying the latent vector to the decoder as an initial state of the decoder to reconstruct the asset name one character at a time;receiving the reconstructed asset name;determining a degree of reconstruction error between the reconstructed asset name and the asset name;determining whether the degree of reconstruction error is above a threshold;in response to determining that the degree of reconstruction error is above a threshold, flagging the asset name as being anomalous;applying one or more filter criteria to assets flagged as having an anomalous name, wherein applying the one or more filter criteria comprises: identifying a peer asset group associated with an asset having a flagged asset name, wherein the peer group is identified based on IP addresses of assets,determining whether a prefix or suffix in the flagged asset name is common to the peer group, andin response to determining that the prefix or suffix of the flagged asset name is common to the peer group, concluding that the asset satisfies the filter criteria;filtering out assets that satisfy the filter criteria; andproviding an indication of an elevated cybersecurity risk for at least a subset of remaining flagged assets that pass filtering.