Patent Application
20180034837
The present technology pertains to network security, and more specifically pertains to identifying compromised computing devices in a computer network.
Computer networks are under constant attack from hackers and other online predators. A multi-billion dollar network security industry has been built around firewall technologies aimed at monitoring network traffic to identify and block malicious network traffic. This industry engages in a never-ending effort to prevent network attacks and intrusions. Even with this heavy investment in preventive technologies, network breaches will inevitably occur.
Determining whether a network has been breached and what computing devices have been compromised can be a tedious process. Network administrators are tasked with evaluating computing device in the network one by one to assess whether they have been compromised or pose a security risk. This can be both resource intensive and time consuming. Accordingly, improvements are needed.
Additional features and advantages of the disclosure will be set forth in the description which follows, and in part will be obvious from the description, or can be learned by practice of the herein disclosed principles. The features and advantages of the disclosure can be realized and obtained by means of the instruments and combinations particularly pointed out in the appended claims. These and other features of the disclosure will become more fully apparent from the following description and appended claims, or can be learned by the practice of the principles set forth herein.
Disclosed are systems, methods, and non-transitory computer-readable storage media for identifying compromised computing devices in a computer network. A threat detection engine can gather network data describing performance of a secured computer network. The secured computer network can include a set of computing devices. The threat detection server can apply a set of threat detection algorithms to the network data to yield threat detection data for the secured computer network. The threat detection engine can then calculate, based on the threat detection data, a threat value for at least a first computing device from the set of computing devices. The threat value can indicate an estimated likelihood that the first computing device has been compromised and/or the severity of the compromise. The threat detection server can then present a visual representation of the threat value for at least the first computing device from the set of computing devices.
The above-recited and other advantages and features of the disclosure will become apparent by reference to specific embodiments thereof which are illustrated in the appended drawings. Understanding that these drawings depict only exemplary embodiments of the disclosure and are not therefore to be considered to be limiting of its scope, the principles herein are described and explained with additional specificity and detail through the use of the accompanying drawings in which:
Various embodiments of the disclosure are discussed in detail below. While specific implementations are discussed, it should be understood that this is done for illustration purposes only. A person skilled in the relevant art will recognize that other components and configurations may be used without parting from the spirit and scope of the disclosure.
The disclosed technology addresses the need in the art for identifying compromised computing devices in a computer network. A threat detection engine can gather network data describing performance of a secured computer network. The secured computer network can include a set of computing devices. The threat detection server can apply a set of threat detection algorithms to the network data to yield threat detection data for the secured computer network. The threat detection engine can then calculate, based on the threat detection data, a threat value for at least a first computing device from the set of computing devices. The threat value can indicate an estimated likelihood that the first computing device has been compromised and/or the severity of the compromise. The threat detection server can then present a visual representation of the threat value for at least the first computing device from the set of computing devices.
System 100 includes unsecured network 105, such as the Internet, and secured network 110. Secured network 110 can include computing devices 115, sensors 125 and threat detection engine 130 sitting behind firewall 120.
Firewall 120 can include one or more commercially available network intrusion devices that allow for parsing raw packet data transmitted between unsecured network 105 and secured network 110. For example, raw packet data transmitted from unsecured network 105 to computing devices 115 in secured network 110 can be initially funneled through firewall 120.
Raw packet data can be inclusive of any data communications between computing devices 115 and other computing device not a part of a secured network 110. Raw packet data can be collectively representative of a network data flow, which may be received over the course of hours, days, months, or years. The parsed raw packet data in conjunction with the generation of metadata by sensors 125 (as further described herein) can be used to extract, collect, and generate network data that allows for the tracking of advanced and slowly developing attacks and remote access tools. This insight into network activity, including even non-malicious activity, may be reviewed and later studied by threat detection engine 130 (as further describe herein) to identify compromised computing devices 115 in secured network 110.
Sensors 125 can sit behind firewall 120 in secured network 110. Sensors 125 can provide seamless high-speed packet analysis and generate User Communication Application Records (UCARs) without otherwise interrupting day-to-day network services of secured network 110.
Sensors 125 can generate and provide metadata to threat detection engine 130. Sensors 125 may be positioned or otherwise configured at key locations within secured network 110, such as relative to critical document or information stores or with respect to particularly sensitive subsets of an otherwise protected network. Sensors 125 can be software, hardware, or a combination thereof, including but not limited to executable instructions stored in a non-transitory computer readable storage medium and otherwise executed by a processing device.
Sensors 125 can create metadata for communications data received by sensors 125. The created metadata can correlate to session-level and/or application-level extraction in order to generate events at scale. Sensors 125 can extract the metadata using deep packet inspection techniques. Metadata can include one or more of md5hash data, filenames, file-sizes, and subject information.
Threat detection engine 130 can receive data from sensors 125, as well as user and device identity data related to network interactions as well as threat intelligence from one or more threat feeds. Threat detection engine 130 can apply the user and device identity data and threat intelligence from the one or more threat feed to the generated metadata to identify a network threat. Threat detection engine 130 can monitor, store, and ingests immutable structured traffic that is representative of a fraction of the space otherwise required to store source data, for example 0.01%, or less. Threat detection engine 130 can allow for UCAR storage with real-time data enrichment and automatic enrichment between communications events and identity, device, and geographic destination. UCARs may be compressed at a ratio of 40:1 thereby allowing for months or years of retention and review.
In some instances, threat detection engine 130 may apply user and device identity data and/or threat intelligent from the one or more threat feeds against UCAR or other historical data (versus real time data). Historical data may also be considered in the context of real-time data. Based on the nature of a particular network threat and a collective history of network traffic flow over the course of time, analytics performed by threat detection engine 130 may allow for identification of compromised users, files, and network nodes. Such an identification may in turn allow for removal, rehabilitation, or further investigation.
The use of historical data may be of particular relevance in the context of a preexisting network vulnerability. Many network vulnerabilities may be related to a bug or flaw in coding that has long been present but unknown to a network administrator or device manufacturer. In such an instance, an otherwise secure enterprise (or believed to have been secured enterprise) may have long been the victim of the aforementioned vulnerability and prior to any threat intelligence having been provided with respect to the same. System 100 may use the historical information to analyze network behavior and potential exposure to intrusion or other compromising behavior once a threat feed is updated to provide notice of the vulnerability or that said vulnerability is other discovered in its own right.
Device identity data can include one or more of an Internet Protocol (IP) address, active directory userid, or other active directory userid. Device identity data can also include dynamic host configuration protocol (DHCP) macid, GeoIP information, or domain name server (DNS) data for an IP address.
Threat intelligence can be subscription based. These threat intelligence feeds alert subscribers about potential infections that have been found in one or more networks around the globe. Threat intelligence is generally representative of network activity that poses a threat to the security infrastructure of an enterprise. Threat intelligence 170 might include a definition of a network threat or threat signature. Threat intelligence might otherwise include an indicator of compromise. Such indicators are inclusive of a list of md5s or shals of malicious binaries, a list of IP addresses that are known to spread malicious files, a list of websites that are hosting malware, or a list of behaviors that are indicative of data exfiltration. Indicators might also include includes a list of email addresses that “phish,” a list of email subject lines that are used to “phish,” a list of IP addresses of mail servers that are known to spread “phishing” email communications, or list of IP addresses of mail server that are known to spread mal ware. Indicators of compromise are also inclusive of lists of potential vulnerabilities or points of exploitation. These lists might correspond to an operating system. These lists might also correspond to a specific application.
Threat detection engine 130 can use received data, such as network data (i.e., parsed packet data and metadata) received from firewall 120 and sensors 125 to determine whether as security breach of secured network 110 has taken place as well as identify computing devices 115 in secured network 110 that may have been compromised by an outside attack. To accomplish this threat detection engine 130 can apply a set of threat detection algorithms to the network data to generate threat detection data indicating threat activity associated with each of computing devices 115 that suggest that a particular computing device 115 may have been compromised. Threat detection engine 130 can then use the threat detection data to calculate a threat value for each of the individual computing devices 115 that indicates an estimated likelihood that a computing device has been compromised. A network administrator can use the threat values to determine whether a security breach of secured network 110 has occurred and to focus their efforts in identifying and eradicating security breaches within secured network 110.
A threat detection algorithm can be any type of algorithm designed to detect threat activity that may indicate that a computing device 115 has been compromised. For example, a threat detection algorithm can analyze the network data to detect mechanisms on computing devices 115 used to find open ports in secured network 110 or mechanisms attempting to reach Command and Control (C&C) servers outside of secured network 110. As another example, a threat detection algorithm can analyze the network data to identify port anomalies, such as non-standard protocols being used over standard ports. Tunneling over well know ports is a common evasion technique to bypass a firewall.
In some embodiments, a threat detection algorithm can detect executable file transfers, file extension mismatches or massive data exfiltration. For example, the threat detection algorithms can detect file transfers over any application, file extension mismatches between assigned file names and an actual file type obtained through content analysis or detecting one way file transfers that exceed a threshold file transfer size.
In some embodiments, the threat detection algorithms can identify host scanning, such as mechanisms used to scan secured network 110 for Internet Protocol (IP) addresses of computing devices 115 using File Transfer Protocol (FTP), Structured Query Language (SQL) or Secure Shell (SSH).
In some embodiments, the threat detection algorithms can detect Uniform Resource Identifier (URI) brute force attacks on computing devices 115 used as web servers or password brute force attacks on computing devices 115 that have SSH connectivity.
These are just a few examples of threat detection algorithms and are not meant to be limiting. A threat detection algorithm can be any type of algorithm used to analyze network data to identify actions, anomalies or any other indicator that a computing device is under attack or has been compromised. For example, threat detection algorithms can identify application anomalies, clicked Uniform Resource Locators (URLs) within an e-mail, connections to untrusted/shady top level domains, “side-jacking”, exploit kits, abnormal user agent fields, fast flux Domain Name System (DNS), Hyper-Text Transfer Protocol (HTTP) meterpreter sessions, File Transfer Protocol (FTP) over HTTP, encrypted reverse Transmission Control Protocol (TCP), C&C channels, botnets, etc.
Threat detection engine 130 can calculate the threat value for a computing device 115 in any number of ways and taking into account any number of factors. For example, threat detection engine 130 can calculate the threat value for a computing device 115 based on the total number of individual instances of threat activity associated with the computing device 115, the number of different types of threat activity associate with the computing device 115, the frequency of the threat activity, etc. Further, the different types of threat activity can be weighted according to how strongly they indicate that a computing device 115 has been compromised. Accordingly, an instance of a highly weighted threat activity can cause a greater increase in the threat value of a computing device 115 than an instance of a lower weighted threat activity.
Threat detection engine 130 can present a visual representation of the threat values calculated for computing devices 115. The visual representation can identify a computing device 115 (e.g, Machine Access Code (MAC) or other identifier) as well as include an indicator of the threat value for the computing device. This can include presenting a numeric threat value for the computing device 115 and/or a threat level indicating the likelihood that the computing device 115 has been compromised (e.g, high, moderate, low, etc.). In some embodiments, the indicator of the threat value can include a color scheme to represent the perceived threat level, such as red to represent a high threat, yellow to represent a moderate threat and green to represent a low threat. An administrator can use the visual representation of the threat values to identify computing devices 115 that are likely to have been compromised and manage the task of eradicating any such breaches.
In some embodiments, threat detection engine 130 can be configured to provide additional threat data regarding a computing device 115. For example, the visual representation of the threat value for a computing device 115 can be configured to be selectable by a user to request a detailed view of the threat data associated with the computing device 115. Upon receiving an input indicating that a user has selected the visual representation of the threat value, threat detection engine 130 can present a visual representation of threat detection data associated with the computing device 115. For example, the visual representation of the threat detection data can include a visual representation of a total number of individual instances of threat activity associated with the computing device 115, a visual representation of types of threat activity associated with the computing device 115, etc. Further, in some embodiments, the threat detection data can also include suggested remedial actions based on the threat detection data associated with the first computing device. A system administrator can use this data as well as suggested remedial actions to diagnose and/or correct a compromised computing device 115.
At step 205 a threat detection engine can gather network data describing performance of a secured computer network. The secured computer network can include a set of computing devices sitting behind a firewall and one or more sensors. The network data can include parsed packet data and metadata generated by the firewall and the sensors.
At step 210 the threat detection engine can apply a set of threat detection algorithms to the network data to yield threat detection data for the secured computer network. A threat detection algorithm can be any type of algorithm designed to detect threat activity that may indicate that a computing device has been compromised.
At step 215 the threat detection engine can calculate a threat value for at least a first computing device from the set of computing devices included in the secured computer network. For example, the threat detection engine can calculate a threat value for one, some or all computing devices in the secured network. The threat value can indicate an estimated likelihood that the first computing device has been compromised and/or the severity of the compromise.
At step 220 the threat detection engine can present a visual representation of the threat value for at least the first computing device from the set of computing devices. The visual representation can identify the first computing device, (e.g, Machine Access Code (MAC) or other identifier) as well as include an indicator of the threat value for the first computing device (e.g., numeric threat value and/or a threat level).
Cards 305 can be selectable to allow a user to view detailed networking data associated with a computing device. For example, in response to selecting one of card 305, the user can be presented with a visual representation of a total number of individual instances of threat activity associated with the computing device, a visual representation of types of threat activity associated with the computing device, etc.
Further user interface 300 can allow a user to manage cards 304. As shown, user interface 300 include backlog section 310, in progress section 315 and closed section 320. A user can move cards 305 to a corresponding section to indicate the cards status. This can allow an administrator to easily manage and track the status of their work.
To enable user interaction with the computing device 400, an input device 445 can represent any number of input mechanisms, such as a microphone for speech, a touch-sensitive screen for gesture or graphical input, keyboard, mouse, motion input, speech and so forth. An output device 435 can also be one or more of a number of output mechanisms known to those of skill in the art. In some instances, multimodal systems can enable a user to provide multiple types of input to communicate with the computing device 400. The communications interface 440 can generally govern and manage the user input and system output. There is no restriction on operating on any particular hardware arrangement and therefore the basic features here may easily be substituted for improved hardware or firmware arrangements as they are developed.
Storage device 430 is a non-volatile memory and can be a hard disk or other types of computer readable media which can store data that are accessible by a computer, such as magnetic cassettes, flash memory cards, solid state memory devices, digital versatile disks, cartridges, random access memories (RAMs) 425, read only memory (ROM) 420, and hybrids thereof.
The storage device 430 can include software modules 432, 434, 436 for controlling the processor 410. Other hardware or software modules are contemplated. The storage device 430 can be connected to the system bus 405. In one aspect, a hardware module that performs a particular function can include the software component stored in a computer-readable medium in connection with the necessary hardware components, such as the processor 410, bus 405, display 435, and so forth, to carry out the function.
Chipset 460 can also interface with one or more communication interfaces 490 that can have different physical interfaces. Such communication interfaces can include interfaces for wired and wireless local area networks, for broadband wireless networks, as well as personal area networks. Some applications of the methods for generating, displaying, and using the GUI disclosed herein can include receiving ordered datasets over the physical interface or be generated by the machine itself by processor 455 analyzing data stored in storage 470 or 475. Further, the machine can receive inputs from a user via user interface components 485 and execute appropriate functions, such as browsing functions by interpreting these inputs using processor 455.
It can be appreciated that exemplary systems 400 and 450 can have more than one processor 410 or be part of a group or cluster of computing devices networked together to provide greater processing capability.
For clarity of explanation, in some instances the present technology may be presented as including individual functional blocks including functional blocks comprising devices, device components, steps or routines in a method embodied in software, or combinations of hardware and software.
In some embodiments the computer-readable storage devices, mediums, and memories can include a cable or wireless signal containing a bit stream and the like. However, when mentioned, non-transitory computer-readable storage media expressly exclude media such as energy, carrier signals, electromagnetic waves, and signals per se.
Methods according to the above-described examples can be implemented using computer-executable instructions that are stored or otherwise available from computer readable media. Such instructions can comprise, for example, instructions and data which cause or otherwise configure a general purpose computer, special purpose computer, or special purpose processing device to perform a certain function or group of functions. Portions of computer resources used can be accessible over a network. The computer executable instructions may be, for example, binaries, intermediate format instructions such as assembly language, firmware, or source code. Examples of computer-readable media that may be used to store instructions, information used, and/or information created during methods according to described examples include magnetic or optical disks, flash memory, USB devices provided with non-volatile memory, networked storage devices, and so on.
Devices implementing methods according to these disclosures can comprise hardware, firmware and/or software, and can take any of a variety of form factors. Typical examples of such form factors include laptops, smart phones, small form factor personal computers, personal digital assistants, and so on. Functionality described herein also can be embodied in peripherals or add-in cards. Such functionality can also be implemented on a circuit board among different chips or different processes executing in a single device, by way of further example.
The instructions, media for conveying such instructions, computing resources for executing them, and other structures for supporting such computing resources are means for providing the functions described in these disclosures.
Although a variety of examples and other information was used to explain aspects within the scope of the appended claims, no limitation of the claims should be implied based on particular features or arrangements in such examples, as one of ordinary skill would be able to use these examples to derive a wide variety of implementations. Further and although some subject matter may have been described in language specific to examples of structural features and/or method steps, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to these described features or acts. For example, such functionality can be distributed differently or performed in components other than those identified herein. Rather, the described features and steps are disclosed as examples of components of systems and methods within the scope of the appended claims.
