Patent Application
20210021637
The present invention relates generally to artificial intelligence (AI), and, more particularly, to a method and a system for detecting and mitigating network breaches.
The importance of information security threat identification, analysis, management, and prevention has grown dramatically in recent years and continues to expand. For example, with the increasing use of the Internet and electronic communication, such as e-mail, for business, personal, and entertainment purposes, efficient, safe, accurate, and reliable electronic communication is essential. Without such communications, tremendous economic and other damage can result, and the utility of electronic communication is compromised. Effectively identifying, analyzing, and managing threats to information security is therefore critical.
Spam, piracy, hacking, phishing, and virus spreading, for example, represent important and growing threats. Unsolicited bulk e-mails, or “UBEs”, can cause serious loss in many ways. In the business context, one type of UBE, unsolicited email (UCE or “spam”) is distracting, annoying, wastes workers' time, and reduces productivity. It can clog or slow down networks, and spread computer viruses and pornography, leading to further complications and losses. Excessive UBEs may lead to workers disregarding actual solicited e-mail.
In a phishing attack, an individual (e.g., a person, an employee of a company, an individual of a computing device) receives a message, commonly in the form of an e-mail, directing the individual to perform an action, such as opening an e-mail attachment or following (e.g., using a cursor controlled device or touch screen) an embedded link. If such message were from a trusted source (e.g., co-worker, bank, utility company), such action might carry little risk. Nevertheless, in a phishing attack, such message is from an attacker (e.g., an individual using a computing device to perform an malicious act on another computer device user) disguised as a trusted source, and an unsuspecting individual, for example, opening an attachment to view a “friend's photograph” might in fact install malicious computer software (i.e., spyware, a virus, and/or other malware) on his/her computer. Similarly, an unsuspecting individual directed (e.g., directed via an embedded link in an e-mail) to a webpage made to look like an authentic login or authentication webpage might be deceived into submitting (e.g., via a web form) his/her username, password or other sensitive information to an attacker.
While there are computer programs designed to detect and block phishing emails, phishing attacks methods are constantly being modified by attackers to evade such forms of detection. The present invention addresses some shortcoming of previous attempts to counter phishing attacks.
It is an objective of the present invention to provide a method and a system for detecting and managing phishing attack. The security product of the present invention has the following objectives. In one embodiment, the present invention enables a user to look at the activity of any other user and all of their owned devices before and after a phishing attack targeted at that user
Further, the present invention enables the user to look at the activity of the infrastructure and determine if an attack has occurred and what is the impact of that attack a. View outbound data egress—network activity
Further, the present invention enables the user to view various attacks on their infrastructure
Further, the present invention enables the user to view coordinated attacks where users belonging to the same team or working on the same projects or using similar devices are targeted at the same time as a campaign
These and other features and advantages of the present invention will become apparent from the detailed description below, in light of the accompanying drawings.
The novel features which are believed to be characteristic of the present invention, as to its structure, organization, use and method of operation, together with further objectives and advantages thereof, will be better understood from the following drawings in which a presently preferred embodiment of the invention will now be illustrated by way of various examples. It is expressly understood, however, that the drawings are for the purpose of illustration and description only and are not intended as a definition of the limits of the invention. Embodiments of this invention will now be described by way of example in association with the accompanying drawings in which:
Further areas of applicability of the present invention will become apparent from the detailed description provided hereinafter. It should be understood that the detailed description of exemplary embodiments is intended for illustration purposes only and is, therefore, not intended to necessarily limit the scope of the invention.
As used in the specification and claims, the singular forms “a”, “an” and “the” may also include plural references. For example, the term “an article” may include a plurality of articles. Those with ordinary skill in the art will appreciate that the elements in the figures are illustrated for simplicity and clarity and are not necessarily drawn to scale. For example, the dimensions of some of the elements in the figures may be exaggerated, relative to other elements, in order to improve the understanding of the present invention. There may be additional components described in the foregoing application that are not depicted on one of the described drawings. In the event such a component is described, but not depicted in a drawing, the absence of such a drawing should not be considered as an omission of such design from the specification.
Before describing the present invention in detail, it should be observed that the present invention utilizes a combination of components, which constitutes methods and systems for detecting and managing network breaches from phishing attack. Accordingly, the components have been represented, showing only specific details that are pertinent for an understanding of the present invention so as not to obscure the disclosure with details that will be readily apparent to those with ordinary skill in the art having the benefit of the description herein. As required, detailed embodiments of the present invention are disclosed herein; however, it is to be understood that the disclosed embodiments are merely exemplary of the invention, which can be embodied in various forms. Therefore, specific structural and functional details disclosed herein are not to be interpreted as limiting, but merely as a basis for the claims and as a representative basis for teaching one skilled in the art to variously employ the present invention in virtually any appropriately detailed structure. Further, the terms and phrases used herein are not intended to be limiting but rather to provide an understandable description of the invention.
References to “one embodiment”, “an embodiment”, “another embodiment”, “yet another embodiment”, “one example”, “an example”, “another example”, “yet another example”, and so on, indicate that the embodiment(s) or example(s) so described may include a particular feature, structure, characteristic, property, element, or limitation, but that not every embodiment or example necessarily includes that particular feature, structure, characteristic, property, element or limitation. Furthermore, repeated use of the phrase “in an embodiment” does not necessarily refer to the same embodiment.
The words “comprising”, “having”, “containing”, and “including”, and other forms thereof, are intended to be equivalent in meaning and be open ended in that an item or items following any one of these words is not meant to be an exhaustive listing of such item or items or meant to be limited to only the listed item or items.
While various exemplary embodiments of the disclosed systems and methods have been described below, it should be understood that they have been presented for purposes of example only, and not limitations. It is not exhaustive and does not limit the invention to the precise form disclosed. Modifications and variations are possible in light of the above teachings or may be acquired from practicing of the invention, without departing from the breadth or scope.
The present invention will now be described with reference to the accompanying drawings, which should be regarded as merely illustrative without restricting the scope and ambit of the present invention.
The application server 102 is a computing device, a software framework, or a combination thereof, that may provide a generalized approach to create the application server implementation. Various operations of the application server 102 may be dedicated to execution of procedures, such as, but are not limited to, programs, routines, or scripts stored in one or more memory units for supporting its applied applications and performing defined operations. For example, the application server 102 is configured to identify incoming email as phish using a phish check library. The application server 102 is further configured to extract malicious URLs or downloads. The application server 102 is further configured to detect other emails that might also be phished. The application server 102 is further configured to detect outbound phish activity and identify user/computer/IP as infected. The application server 102 is further configured to use the user/computer/IP as key to look in outbound access logs to look for clicking of malicious URLs or download of malicious software. The application server 102 is further configured to model a user fingerprint of the user 110. The application server 102 is further configured to look for external or internal IP traffic. The application server 102 is further configured to look for Ip address activity inbound and outbound. The application server 102 is further configured to run all access logs and syslogs through security engine and extract all risks. The application server 102 is further configured to extract all users, devices, IP addresses and names from the risks. The application server 102 is further configured to monitor internal network activity through syslog and look for user/device/IP address behavior. The application server 102 is further configured to build fingerprinting and behavior anomaly and profiles. The application server 102 also enables the user 110 to look at the activity of any other user and all of their owned devices before and after a phishing attack targeted at that user 110. The application server 102 also enables the user 110 to look at the activity of the infrastructure and determine if an attack has occurred and what is the impact of that attack. The application server 102 also enables the user 110 to view various attacks on their infrastructure. The application server 102 also enables the user 110 to view coordinated attacks where users belonging to the same team or working on the same projects or using similar devices are targeted at the same time as a campaign. Various other operations of the application server 102 have been described in detail in conjunction with
Examples of the application server 102 include, but are not limited to, a personal computer, a laptop, or a network of computer systems. The application server 102 may be realized through various web-based technologies such as, but not limited to, a Java web-framework, a .NET framework, a PHP (Hypertext Preprocessor) framework, or any other web-application framework. The application server 102 may operate on one or more operating systems such as Windows, Android, Unix, Ubuntu, Mac OS, or the like.
The database server 104 may include suitable logic, circuitry, interfaces, and/or code, executable by the circuitry that may be configured to perform one or more data management and storage operations such as receiving, storing, processing, and transmitting queries, data, or content. In an embodiment, the database server 104 may be a data management and storage computing device that is communicatively coupled to the application server 102 or the user computing device 108 via the network 106 to perform the one or more operations.
In an exemplary embodiment, the database server 104 may be configured to manage and store “risky” or “suspicious” data (communication, content and activity) in optimized storage and ML optimized data structures. In an exemplary embodiment, the database server 104 may be configured to manage and store recent emails.
In an embodiment, the database server 104 may be configured to receive a query from the application server 102 for retrieval of the stored information. Based on the received query, the database server 104 may be configured to communicate the requested information to the application server 102. Examples of the database server 104 may include, but are not limited to, a personal computer, a laptop, or a network of computer systems.
The network 106 may include suitable logic, circuitry, interfaces, and/or code, executable by the circuitry that may be configured to transmit messages and requests between various entities, such as the application server 102, the database server 104, and the user computing device 108. Examples of the network 106 include, but are not limited to, a wireless fidelity (Wi-Fi) network, a light fidelity (Li-Fi) network, a local area network (LAN), a wide area network (WAN), a metropolitan area network (MAN), a satellite network, the Internet, a fiber optic network, a coaxial cable network, an infrared (IR) network, a radio frequency (RF) network, and combinations thereof. Various entities in the system environment 100 may connect to the network 106 in accordance with various wired and wireless communication protocols, such as Transmission Control Protocol and Internet Protocol (TCP/IP), User Datagram Protocol (UDP), Long Term Evolution (LTE) communication protocols, or any combination thereof.
An embodiment of the present invention, or portions thereof, may be implemented as computer readable code on the computer system 300. In one example, the application server 102 of
Workflow
In an embodiment, the application server 102 may be configured to identify one or more incoming emails. The one or more emails may be identified as Phish using a phish check library. Further, the application server 102 may be configured to predict or extract “call to action” i.e., one or more texts near a link or button or filename of the attachments.
In an embodiment, the application server 102 may be configured to perform social engineering attack prediction and phish sandbox. In such a scenario, the application server 102 may analyze the content and call to action using machine learning (ML). Further, the application server 102 may detect one or more attempts to phish and social engineering attack to a user (such as the user 110). The application server 102 may further detect potentially direct or indirect monetary attack. The application server 102 may further execute URL in the phish sandbox with fake credentials/workflow and convert into profile to watch using phish credential generation service.
In an embodiment, the application server 102 may be configured to extract malicious URLs or downloads. The application server 102 may be further configured to detect other emails that might also be phish (using similarity) and identify one or more users/computers/IPs as infected. The application server 102 may be further configured to detect outbound phish activity and identify the one or more users/computers/IPs as infected. The application server 102 may be further configured to use the one or more users/computers/IPs as key to look (or search) into one or more outbound access logs. The one or more outbound access logs may be looked or searched to identify for clicking of malicious URLs or download of malicious software.
In an embodiment, the application server 102 may be configured to model or generate a user fingerprint for the user (such as the user 110). The user fingerprint may be modeled or generated based on one or more sites (visited by the user) including site classification (type, known, or unknown), and also including “frequency”, “duration gap”, “size of request”, “size of response”.
In an embodiment, the application server 102 may be configured to identify the one or more users/computers/IPs as infected based on the one or more URL clicks or download activities. The application server 102 may be further configured to identify other similar users/computers/IPs as infected and name as “At Risk Watchlist”.
In an embodiment, the application server 102 may be further configured to look or search for external IP traffic. The application server 102 may use one or more techniques including user agent, frequency, gap duration, http version, http requests or types, download, upload, query strings in the one or more URLs, one or more POST contents, excessive request length, excessive response length, non-standard PORTs, non-standard http methods, and URLs/Queries to look or search for the external IP traffic. The application server 102 may maintain one or more counters for each of the above.
In an embodiment, the application server 102 may be configured to look for internal IP—external IP connections properties and detect if it is “bad” or not. In a scenario where it is bad, the application server 102 may be further configured to find similar bad internal IP—external IP tuples. The application server 102 may be further configured to calculate and maintain a tuple counter, and one or more metrics are updated every time any tuple is observed including “Frequency”, “Gap between connections”, “Size of connections”, HTTP Version, HTTP Methods, PORTS, Request Length, and Response Length.
In an embodiment, the application server 102 may be further configured to look for external IPs that are known bad and look for other external IPs that are being accessed by internal IPs also accessing the known bad external IPs. The application server 102 may be further configured to look for other external IPs that are similar to bad IPs.
In an embodiment, the application server 102 may be further configured to look for IP address activity inbound and outbound and identify at least one of (a) low variance external activity, (b) high frequency, low duration (short lived, periodic probes or attacks), (c) low frequency, similar duration, (d) historically suspicious but dormant, and (e) auto tiering and auto classification of raw data, for example, (i) selectively and automatically tag incoming data (emails, web activity, network activity, API activity, database activity) with severity (using ML and historical definitions of “normal” and predefined rules) and (ii) store “risky” or “suspicious” data (communication, content, and activity) in optimized storage and ML optimized data structures (such as the database server 104).
In an embodiment, the application server 102 may be further configured to run all access logs and syslogs through security engine and extract all risks. The application server 102 may be further configured to extract all users, devices, IP addresses, and names from the risks. The application server 102 may be further configured to monitor internal network activity through syslog and look for the user/device/IP address behavior. For example, the application server 102 may look for the number of access to highly valuable, PII data, the number of actions with root or admin privileges, the number of actions tampering/deleting/editing access logs or syslogs, the number of instances of multiple access events or logon events in a short period of time, the number of actions of using identification and authentication mechanisms, the number of actions where privileges are elevated, the number of edit/deletions to account info using root/admin access, the number of actions where logs are initialized or stopped or paused, and the number of actions where system level objects such as database tables or stored procedures are created/deleted.
In an embodiment, the application server 102 may be further configured to build fingerprinting & behavior anomaly profiles. The fingerprinting & behavior anomaly profiles may be build using:
In an embodiment, the application server 102 may be further configured to perform tuple behavior anomaly detection. The application server 120 may be configured to execute appropriate algorithms or instructions stored in its memory to perform the tuple behavior anomaly detection. The application server 102 may implement or execute various anomaly detection techniques to perform the tuple behavior anomaly detection. For example, the various anomaly detection techniques includes, but are not limited to, (a.) top and bottom percentiles, (b.) outside standard deviation of average behavior of similar tuples, (c.) deviation from profile based on historical profile of the tuple, (d.) deviation from profile based on historical profile of the first entity in the tuple across all activity with all second entities, and (e.) deviation from profile based on historical profile of the second entity in the tuple across all activity with all first entities.
In an embodiment, the application server 102 may be further configured to perform the tiered access determination. The tiered access determination may be performed by autocorrelating timeseries of access to high value and low value data and/or autocorrelating timeseries of access to high value and uploading of high value data.
In an embodiment, the application server 102 may be further configured to perform predictive quarantining. If the user/device/computer/Wi-Fi/IP address is determined to be anomalous, one or more quarantining activities may be issued. For example, the access may be blocked. The credentials may be revoked. The credentials may be refreshed. The re-authorization may be requested. The access may be throttled. Also, the application server 102 may be further configured to perform predictive sandboxing where a device, laptop, or server is sandboxed and may not allow to access any other part of the network. No traffic is allowed to go into that device and access is also not allowed.
In an embodiment, the application server 102 may be further configured to perform user attack propagation determination with event generation. The application server 102 may determine whether the attack has started, whether the attack has completed, and the data/service loss. In an embodiment, the application server 102 may be further configured to perform predictive rerouting. For example, if a user is likely phished, his communication is automatically rerouted through a deep proxy that can generate fake data and pretend to service the request while invoking a second review and out of band notification. In another example, if a user is about to get phished, reroute them to a proxy. Let proxy make a call to phish URL, download what the phish URL is asking, analyze and decide to warn the user again or let it go. Execute URL in sandbox with fake credentials/workflow and convert into profile to watch using phish credential generation service.
In an embodiment, other additional features to capture in fingerprinting are may include: (1) Multidimensional Tupling—The application server 102 may look at the data and transform it into tuples that capture activity and relationship between two entities. For each tuple, the application server 102 may create multiple metrics such as IP Address—IP Address, IP Address—URL, IP Address—Host, IP Address—Application, IP Address—Service, IP Address—Access, Hostname—IP Address, Hostname—URL, Hostname—Hostname, Hostname—Application, Hostname—Service, User—IP Address, User—Hostname, User—URL, User—Application, IP, Address—Login, IP Address—FileAccess, IP Address—SQL, IP Address—URL, IP Address—Service, Hostname—Login, Hostname—FileAccess, Hostname—SQL, Hostname—Service, Hostname—URL, Hostname—Access, User—Login, User—FileAccess, User—SQL, User—Service, User—Access, User—Vulnerability, IP Address—Vulnerability, and Hostname—Vulnerability, (2) Tuple Graph driven extended fingerprinting including sequence-enhanced fingerprints. Here, using the defined tuples and external data, the application server 102 may build a graph of the following entities (IP address, Hostname, URL, User, Applications, Service, Logins, FileAccess, SQL, Service). These graphs are used to establish relationships and for generating extended relationships and behavior including the sequence of activities that involve connected entities in any given time window or in a defined grouping such as geo-centricity, organizational centricity and other such schemes to define and categorize, (3) Cross Tuple Behavior Model. Here, the application server 102 may build a behavior model of every entity across tuples. The application server 102 may also build behavior model of similar entities or related entities, and (4) Predictive Behavior including
Predictive Access Correction—the application server 102 reduces or removes ability of entity to access previously accessible assets
In an embodiment, the application server 102 may be further configured to generate extensible tuple sets. The application server 102 may execute appropriate algorithms or instructions stored in its memory to expand to new tuple definitions of any type including entity-to-entity (e.g., IP-IP), entity-to-action (e.g., IP-login), or entity-to-behavior (e.g., IP-excessive logins), and define fingerprints for the tuples and build tuple behavior profiles as timeseries.
In an embodiment, the application server 102 may be further configured to perform extensible, auto activity categorization. The application server 102 may execute appropriate algorithms or instructions stored in its memory to perform the categorization. The application server 102 is able to automatically categorize various activities into various categories using categorization techniques such as topic modeling. The application server 102 generates a semantic layer that describes the activity. The application server 102 also has the ability to apply additional layers of semantic understanding. The additional layers of semantic understanding may be applied by combining categories with other categories to generate super categories. The application server 102 further automatically determines an appropriate level of categorization hierarchy based on the signal content of each generated layer i.e., whether a generated layer contains a good distribution across the categorical values.
In an embodiment, the application server 102 may be further configured to perform predictive mitigation. For example, the application server 102 may perform the predictive quarantining by disabling ability of an entity to communicate, contact, or access assets based on prediction of compromise. The application server 102 may perform predictive sandboxing by, disabling ability of an entity to log in, startup, or access network and systems based on prediction of compromise. The application server 102 may perform predictive access correction by reducing or removing ability of entity to access previously accessible assets based on prediction of compromise. The application server 102 may perform predictive re-routing by redirecting traffic, requests, communication, content and activity through secure channel to a proxy for further analysis and policy action based on prediction of compromise. The application server 102 may perform predictive credentials lifecycle management including upgrade, downgrading, reassessing, reviewing, creation and deletion of credentials based on prediction of compromise. The application server 102 may perform predictive policy enforcement including policy management & governance based on prediction of compromise. The application server 102 may perform predictive high stakes action approval & double verification based on prediction of compromise. The application server 102 may perform predictive time to live and exponential slowdown for entities accessing data, services, compute on the network based on prediction of compromise. The application server 102 may perform predictive network & geo fencing & time fencing to limit access to data, services, compute to a certain geo region or network/subnetwork or time window of entities based on prediction of compromise.
In an embodiment, the key APIs includes:
In an embodiment, the real-time recommendations may include identification and reporting of (1) Users similar to ones that are being attacked, (2) Emails similar to the ones found as phish (both incoming & outgoing), (3) Users similar to ones who clicked on phish or downloaded malware, and (4) Users and similar users (and IPs, hostnames) who are exhibiting compromised activity.
In an embodiment, the security product disclosed in the present invention facilitates various objectives. For example, the security product of the present invention:
Although particular embodiments of the invention have been described in detail for purposes of illustration, various modifications and enhancements may be made without departing from the spirit and scope of the invention.
