Patent Grant
10721262
The present disclosure relates to systems and techniques for data integration, analysis, and visualization. More specifically, systems and methods are disclosed that facilitate the generation and presentation of alerts relating to a cyber attack on a resource of an organization. Furthermore, systems and methods are disclosed for the collection and processing of responses from a human analyst to such alerts.
Embodiments of the present disclosure generally relate to data processing and visualization.
Strategically important computer resources of an organization (“resources”), such as, for example, trading systems, industrial control systems, confidential databases, or more generally any application providing value to an organization, are continuously exposed to the threat of cyber attacks (“attacks”). Those attacks, if successful, may disrupt business processes, expose confidential data, create substantial liability, and undermine public trust in the organization. Because the perpetrator of a cyber attack can choose from a vast variety of different attack strategies and techniques, cyber attacks can be very difficult to timely detect.
The systems, methods, and devices described herein each have several aspects, no single one of which is solely responsible for its desirable attributes. Without limiting the scope of this disclosure, several non-limiting features will now be discussed briefly.
As mentioned above, substantial incentives exist for actors, such as organized criminals, foreign intelligence services, or activists, to launch a cyber attack against the resources of an organization. These attacks may be conducted with different goals, such as, for example, stealing confidential information (“exfiltration”) or causing damage to the organization. Cyber attackers have different tools and techniques at their disposal, such as, for example, the exploitation of various security vulnerabilities or intentional backdoors in software and hardware components, the use of “phishing” and other “social engineering” techniques to acquire access credentials, and the use of “brute force” cracking techniques to find authentication credentials for resources of interest. While many of such attack techniques leave behind some type of indicator that could be used to infer that a cyber attack is or has been in progress, it may be extremely difficult to “connect the dots” and collect and appropriately interpret those indicators.
Because of the different types of potential techniques and strategies available to the perpetrator of a cyber attack, a great variety of different types of records and information may be indicators of a cyber attack. For example, a user's activity records on a computer network may contain indicators of certain types of cyber attacks. Various types of records and logs may contain indicators of a cyber attack. For example, firewall logs, authentication records, Virtual Private Network (VPN) connection records, database server records, etc., may contain indicators of various types of cyber attacks. An indicator may include any data, information, or things, such as an activity, an event from an operating system event log, an access history and/or the like.
Faced with constraints imposed by limited resources for auditing an organization's computer resources for cyber attacks, it may be desirable to focus the auditing process on computer resources of particular business or strategic importance for the organization. Those particularly important computer resources are referred to herein as resources. Such resources may include, for example, a trading system, a database of confidential information such as tax returns, a database of confidential health information, or a control system for an important industrial process or a piece of equipment such as, for example, a centrifuge. Because of the high value of such resources, they may present prime targets for different types of attackers. Advantageously, centering an analysis of indicators of a potential cyber attack around the resource potentially being attacked may provide a way of associating, grouping and reconciling different events by determining that those different events may be directed against a common resource.
A cyber attack against a resource may comprise multiple steps that each involves specific techniques and strategies. For example, a cyber attack may use a particular technique, such as exploitation of a software vulnerability in a web server, to gain access to an internal company network, then use stolen authentication credentials to access the resource, copy data off the resource, and transmit the data out of the organization's network through an encrypted connection. Each of these different steps and techniques may create unique indicators; as such, the full extent of activity of a cyber attack may only be recognized when multiple such different indicators are reviewed and brought into context.
An indicator, viewed in isolation, does not necessarily confirm or deny that a cyber attack is or is not being perpetrated; rather, an indicator may be probative, even if only slightly so, by virtue of being positively or negatively correlated with a cyber attack. For example, an authentication failure on a corporate server, viewed in isolation, may not justify a conclusion that a resource to which this server belongs is being attacked. Viewed together with other indicators, however, knowledge of the fact that there was an authentication failure may assist in determining whether or not a cyber attack is taking place.
As discussed, various types of information (“indicators”) can assist in deducing that an attack is in progress. For example, an unusual number of failed authentications on a server of the organization may be indicative of an attacker seeking to gain unauthorized access to that server. Similarly, the presence of malicious software (“malware”) on one of the organization's computers, suspicious network traffic, or other factors may be indicative of an attack in progress. Relevant indicators may be collected on different devices on a network, and may be used to enable a comprehensive analysis of a potential cyber attack on a resource. When reviewing such indicators, an analyst may be able to deduce that an attack on an organization's resource is in progress. In many instances, it may be that no single indicator is available that conclusively establishes whether or not a cyber attack is in progress. As such, it may be advantageous to review multiple indicators in context to make this determination. Because these indicators may be present in a large number of different systems that may need to be queried using different protocols and techniques, and the indicators received may be present in different formats and structures, collecting and aggregating the indicators to facilitate a comprehensive review poses unique challenges. It will be appreciated that an auditor who is relieved by an automated system from the tenuous task of gathering, converting, and aggregating indicators will be more efficient in reviewing the information contained therein, and real-time monitoring and detection of cyber attacks may be enabled by such automated systems.
Even with all indicators available for review, it may still be hard to distinguish a cyber attack from regular activity occurring in the course of business of an organization. Because of the large number of different tools and techniques available to an attacker, it is difficult to infer that a cyber attack is ongoing by exclusively looking at one or a limited number of indicators. For example, failed authentication attempts to an organization's servers may indicate the presence of an attacker seeking to “brute force” his way into the server, but such failed authentication attempts may also indicate that a legitimate user has simply forgotten their password.
It is additionally desirable for an organization to detect a cyber attack as early as possible, so that countermeasures may be taken before the attacker's goal may be accomplished.
For the foregoing, and for other reasons, there remains a need for novel systems and methods assisting with identifying a cyber attack against an organization's resources in an early stage while not unduly alerting to activity that is not related to a cyber attack, for presenting alerts related to a suspected cyber attack activity in a way that is comprehensible and accessible to a human analyst, and for collecting and processing responses from a human analyst to such alerts in order to facilitate timely and effective countermeasure against suspected cyber attacks and inform future investigations of suspected cyber attacks.
As described herein, embodiments of the system of the present disclosure may, in some instances, combine sets of more than one indicator using a variety of operations to form one or more new indicators. Such combinations are referred to herein as aggregates. Some aggregates are, for example, counts (tallies), averages, medians, maxima, minima, quartiles, percentages, cross-correlation etc. It may be advantageous to calculate such aggregates for various reasons, including, for example, to reduce the amount of data processed and thus reduce the computational effort required, or to synergistically combine indicators to reveal additional information.
In some embodiments, the warning system may utilize indicators, or combinations of indicators, to detect “lateral movement” of a user. This refers to the phenomenon of a user or device presenting authentication credentials corresponding to more than one user. Such lateral movement may be indicative of a cyber attack. In an example embodiment, the warning system tracks lateral movement by reviewing indicators reflecting authentication attempts, and creating, from those authentication attempts, a tally of how many different users one user or device has attempted to authenticate as.
Systems are known that collect and display one or more types of indicators to a human analyst. Yet these systems may achieve limited success in facilitating the timely detection of attacks, partly because the number of possible indicators of an attack in progress may be extremely large when compared to a human analyst's capacity to review them. Additionally, the meaningful interpretation of indicators is made difficult by the failure of these existing systems to provide appropriate contextual information, such as, for example, other indicators and historical information. Furthermore, reviewing becomes easier and more effective when indicators are presented using graphical representations such as charts and graphs, and aggregate values such as totals, averages and extreme values. Some existing systems fail to adequately digest the indicators and present pertinent information in an easily accessible form. Thus, there remains a need to group, sort, aggregate, and filter the data contained in these indicators, and to present it together with relevant contextual information, in a way that allows a human analyst to review it effectively.
Additionally, it may be difficult, especially for a non-technical user, such as the CEO or a director of an organization, to determine the overall security posture of an organization's resources, in part because the amount and specificity of the information presented may not permit the user to easily draw a summarizing conclusion. This may leave an organization's leaders unable to adequately determine the exposure to risk of some of its most important resources. As such, there is a need for a summarizing indication of an individual resource's security posture, or an organization's overall security posture, that comprises a variety of indicators, but is still easily comprehensible even to a person without training in computer security.
Certain embodiments of the present disclosure may provide a risk score, or a graphical representation of such risk score, for individual resources, as well as for the organization as a whole (e.g., a “global” risk score). The risk score of each resource may be determined by combining the risk estimates for each event and alert associated with the resource. The global risk score may be determined by combining the risk score of all resources. It may be advantageous to provide a risk score that continuously rises as the number of risky events and/or alerts rise, but does not go past a certain number. Such a risk score may be more immediately comprehensible to a user because it can be scaled to a convenient range, such as 0-100. It may also be seen as reflecting the fact that for a number of non-correlated events, representing attempts of a cyber attack against a resource, the risk (e.g., the probability of at least one successful attempt of a cyber attack) monotonically increases with the number of independent attempts, but will never exceed certainty. The combination of constituent risk estimates to form a risk score may thus advantageously be done by using a continuous mathematical function monotonically converging to a desired limit. For example, if R1, R2 and R3 represent the constituent risk estimates (for example, the risk score of three individual resource), the function to calculate R(R1,R2,R3) may be defined as R(R1,R2,R3)=arc tan(R1+R2+R3)*100*2/Pi. This ensures that the risk score continuously increases when its constituents increase, but never exceeds 100.
Different resources in an organization may be accessed by different types of users in different roles and may serve different economic functions. As such, it may be advantageous for a warning system to sort, group, filter, score, and categorize alerts of a potential cyber attack by resource. In an example embodiment, the warning system may determine an estimate of how much at risk a given resource is from a cyber attack at a given point in time based on the indicators received. Additionally, if the warning system receives indicators from multiple sources, all indicating a cyber attack against the same resource, presenting those indicators to the analyst together may serve the analyst in determining that there is a cyber attack in progress against a given resource. Advantageously, this may allow for various indicators, including those corresponding to user activity that may not be sufficiently suspicious when reviewed by an analyst individually, to be related to each other and linked to an ongoing cyber attack against a resource. For example, if the administrator of an resource falls victim to a social engineering scam and a short period of time later multiple transactions are made from the resource that appear to be just below the threshold for which the administrator would have to seek internal approval, these two indicators when reviewed individually may not be sufficient for an analyst to commence closer scrutiny. If, however, these two indicators are presented to the analyst together, the analyst may be able to determine that a cyber attack against this resource is in progress and take appropriate action.
Embodiments of the present disclosure relate to a warning system that may automatically collect indicators, automatically analyze those indicators to generate alerts, automatically tag, score and group those alerts, and provide results of the automated analysis, tagging and grouping in an optimized way to an analyst. The automated analysis of the indicators may include an automated application of various criteria or rules so as to generate a visual display of the groups of related indicators so that the analyst may quickly and efficiently evaluate the alerts. In particular, the indicators may be dynamically re-grouped and/or filtered in an interactive user interface so as to enable an analyst to quickly navigate among information associated with various alerts and efficiently evaluate the groups of alerts in the context of, for example, an audit for data breach or other activity related to a cyber attack against a resource. Embodiments of the present disclosure also relate to automated scoring of the alerts. The interactive user interface may be updated based on the scoring, directing the human analyst to certain alerts (for example, alerts more likely to be associated with activity related to a cyber attack against a resource) in response to the analyst's inputs. Embodiments of the present disclosure also related to automated updating of the scoring method based on past findings. For example, if an analyst determines that an alert generated on the basis of a certain indicators was a false positive, the influence of these indicators in the alert scoring process may be reduced for future alert scoring. Conversely, if an analyst determines that an alert was issued that indeed should have been issued, the influence of the indicators present in the alert in the alert scoring process may be increased for future alert scoring. Risk scores may be continuously updated to reflect new information, such as provided from the auditor in response to alerts or events or as new indicators are received or new alerts and events are generated.
In an example embodiment, interpretation of the indicators may take place in several steps. First, one or more indicators may be interpreted by the warning system as belonging to a single event. For example, if a connection is made from an email client to an email server for the client to send an email message, corresponding indicators reflecting the successful connection may appear in both the client and the server logs, both indicating that the connection was made. Upon processing these indicators, the warning system may determine that an event, namely an email being sent, had occurred, and may assign various attributes and properties to the event, such as, for example, the time and date of the occurrence of the event, and the users, IP addresses, computers, servers or other actors involved. An event may or may not be indicative of any risk to a resource. The event may then be analyzed as to the estimated risk it poses to the resource. Often, the event will be deemed substantially irrelevant and thus not affect the resource's exposure to risk; as such, the warning system will not request a response from an analyst related to the alert. It will, nevertheless, still record the event as it may prove to be relevant contextual data for investigations of cyber attacks related to the resource. In some instances, the event will be determined to be indicative of risk to the resource; in these cases, the warning system may designate the event as an alert and request an analyst's response.
An analyst's effectiveness in detecting activity related to a cyber attack against a resource and evaluating alerts may be greatly enhanced if the analyst is presented with indicators that are contextually related to the activity being audited, or the alert being evaluated. In an example application, an analyst may be tasked with deciding whether the presence of a certain indicator represents activity related to a cyber attack against a resource. However, an individual indicator oftentimes includes insufficient information for the analyst to make such decisions. Rather, the analyst may make better decisions based upon a collection of related indicators. For example, a user entering unusually large transactions into a financial transaction system, or a phishing attack against a user may, by themselves, not be sufficiently probative for an analyst to assume that a cyber attack is in progress. Conversely, if the analyst is able to see that the same user who has been receiving phishing emails has been entering unusually large transactions, the analyst may see a pattern of activity that correlates more strongly with a cyber attack.
An analyst's effectiveness in detecting cyber attacks and evaluating alerts may further be enhanced by the analyst being presented with aggregates, such as totals, counts and averages, calculated from several indicators. For example, an analyst reviewing whether a certain user's act of e-mailing confidential documents to the user's private email account represents activity related to a cyber attack against a resource may make better decisions when presented with information regarding prior, similar activity by the user, the user's department or the user's organization.
Additionally, an analyst typically does not have the time and resources to review all activity by all users. As such, it is advantageous that auditing resources may be concentrated on the activities most likely to constitute activity related to a cyber attack against a resource. Some embodiments of the present disclosure perform scoring based on an estimate of the likelihood that a certain alert is related to activity related to a cyber attack against a resource to decide whether to present an alert to an analyst, and how to present the alert. The scoring is based on a mapping between each indicator and an estimate of the likelihood that the indicator is indicative of activity related to a cyber attack against a resource. Such a mapping is referred to as the “weight” of the corresponding indicator.
The types of activity that are or are not associated with a cyber attack, and relevance of different indicators, may change over time, and may not be known accurately. For example, novel attack techniques may be developed by attackers, and the configuration of resources may change so as to change their vulnerability profile. As such, in some embodiments, the warning system updates the weights of indicators to reflect an analyst's determination as to whether or not the issuance of a given alert was justified. For example, in an embodiment, if an analyst determines that a given alert was issued despite the absence of activity related to a cyber attack against an resource, the weights associated with the indicators based on which the alert was issued will be reduced. This allows the warning system to learn from past alerts, improving its prediction accuracy over time. To ensure that the warning system does not unduly filter out emerging patterns indicative of a cyber attack for which the existing weights are not optimal, and thus helps prevent the warning system from becoming error-prone due to self-reinforcement bias, a random offset value may be added or other random (including pseudo-random) or non-deterministic adjustment made during the filtering process to introduce an element of chance into the warning system's decision of whether an alert is displayed or not. Similarly, in another implementation, alerts with various scores may be randomly (including pseudo-randomly) displayed to the user for the same purposes.
Some currently available systems allow the analyst to search for and review individual indicators. Although these currently available systems can be helpful in discovering indicators for known types of activity related to a cyber attack, they typically require the analyst to manually repeat the same series of searches to determine related indicators, to manually calculate aggregates where the analyst desires to use them, and to manually go through large amounts of irrelevant data to find relevant indicators contained therein. Performing and continuously repeating these manual processes consumes time and resources, such that there are oftentimes more investigations than can be performed.
In contrast with these currently available systems, and as described above, according to various embodiments, the warning system of the present disclosure automatically collects indicators from a variety of sources, analyzes the indicators to generate alerts, tags and groups the alerts, and generates an interactive user interface in which, in response to inputs from the analyst, information related to the alerts and relevant indicators may be efficiently provided to the analyst. Accordingly, the analyst may be enabled to efficiently evaluate the alerts.
Additionally, the automated scoring of alerts (as mentioned above) may enable highly efficient evaluation of the most relevant alerts by an analyst. For example, the interactive user interface is generated so as to enable an analyst to quickly view critical groups of alerts (as determined by the automated scoring), and then in response to analyst inputs, view and interact with the generated information (including, for example, time-based charts and/or other information) associated with the alerts. In response to user inputs the user interface may be updated to display raw data associated with each of the generated alerts and its corresponding indicators if the analyst desires to dive deeper into data associated with a given alert.
In some embodiments, the warning system may record activities by the analysts, so as to allow for subsequent auditing of the auditing process, or of individual analysts. For example, the warning system may store each item of information presented to an analyst, and each action taken by an analyst, for example each alert response, in an audit database so that it is possible to determine which analyst was presented with what information, and what the analyst's response was. Advantageously, this may allow the organization to retroactively determine responsibilities as to an analyst's decision to take action on an alert, and thus improves accountability and confidence.
In some embodiments, the warning system allows an analyst to respond to an alert in various ways. For example, the warning system may allow the analyst to respond to an alert by “signing off” on the alert, thus determining that the resource is not being put at risk by the activity related to the alert. Alternatively, the analyst may initiate an investigation by another analyst into the alert and related events. The analyst may also choose to escalate the alert, thus notifying supervisors that action needs to be taken to prevent a cyber attack. The analyst may also submit comments to the alert, which may then be shown when the alert is subsequently presented. Advantageously, this allows for more effective information-sharing and collaboration between analysts and analysts from duplicating each other's work.
Further, as described herein, a warning system may be configured and/or designed to generate user interface data useable for rendering the various interactive user interfaces described. The user interface data may be used by the warning system, and/or another computer system, device, and/or software program (for example, a browser program), to render the interactive user interfaces. The interactive user interfaces may be displayed on, for example, electronic displays (including, for example, touch-enabled displays).
It has been noted that design of computer user interfaces “that are useable and easily learned by humans is a non-trivial problem for software developers.” (Dillon, A. (2003) User Interface Design. MacMillan Encyclopedia of Cognitive Science, Vol. 4, London: MacMillan, 453-458.) The various embodiments of interactive and dynamic user interfaces of the present disclosure are the result of significant research, development, improvement, iteration, and testing. This non-trivial development has resulted in the user interfaces described herein which may provide significant cognitive and ergonomic efficiencies and advantages over previous systems. The interactive and dynamic user interfaces include improved human-computer interactions that may provide reduced mental workloads, improved decision-making, reduced work stress, and/or the like, for an analyst using the warning system.
Further, the interactive and dynamic user interfaces described herein are enabled by innovations in efficient interactions between the user interfaces and underlying systems and components. For example, disclosed herein are improved methods of receiving user inputs, translation and delivery of those inputs to various system components (for example, retrieval of indicators), automatic and dynamic execution of complex processes in response to the input delivery (for example, grouping, filtering and scoring of alerts), automatic interaction among various components and processes of the warning system, and/or automatic and dynamic updating of the user interfaces. The interactions and presentation of data via the interactive user interfaces described herein may accordingly provide cognitive and ergonomic efficiencies and advantages over previous systems.
Advantageously, according to various embodiments, the disclosed techniques provide a more effective starting point and user interface for an investigation of potentially activity related to a cyber attack against a resource of various types. An analyst may be able to start an investigation by responding to alerts generated by the warning system that are generated based on an empirically determined estimate of likelihood of activity related to a cyber attack against an resource. This may focus the analyst's attention on reviewing activity that has historically proven to be problematic. As such, it may reduce the amount of time and effort required to perform the investigation. The disclosed techniques may also, according to various embodiments, provide a prioritization of multiple alerts related to activity related to a potential cyber attack, dynamic re-grouping of such alerts, and alert filtering. For example, the analyst may also be able to start the investigation from a high priority group of alerts, which may allow the analyst to focus on the most important investigations, and may quickly evaluate that group of alerts based on the efficient user interface generated by the warning system. In each case, the time requirements of such an investigation may be significantly reduced due to the creation and use of highly efficient representations, including visual representations such as graphs, and aggregate quantities, such as totals, counts, and averages, of related indicators.
Additional embodiments of the disclosure are described below in reference to the appended claims, which may serve as an additional summary of the disclosure.
In various embodiments, systems and/or computer systems are disclosed that comprise a computer readable storage medium having program instructions embodied therewith, and one or more processors configured to execute the program instructions to cause the one or more processors to perform operations comprising one or more aspects of the above- and/or below-described embodiments (including one or more aspects of the appended claims).
In various embodiments, computer-implemented methods are disclosed in which, by one or more processors executing program instructions, one or more aspects of the above- and/or below-described embodiments (including one or more aspects of the appended claims) are implemented and/or performed.
In various embodiments, computer program products comprising a computer readable storage medium are disclosed, wherein the computer readable storage medium has program instructions embodied therewith, the program instructions executable by one or more processors to cause the one or more processors to perform operations comprising one or more aspects of the above- and/or below-described embodiments (including one or more aspects of the appended claims).
The following drawings and the associated descriptions are provided to illustrate embodiments of the present disclosure and do not limit the scope of the claims. Aspects and many of the attendant advantages of this disclosure will become more readily appreciated as the same become better understood by reference to the following detailed description, when taken in conjunction with the accompanying drawings, wherein:
Although certain preferred embodiments and examples are disclosed below, inventive subject matter extends beyond the specifically disclosed embodiments to other alternative embodiments and/or uses and to modifications and equivalents thereof. Thus, the scope of the claims appended hereto is not limited by any of the particular embodiments described below. For example, in any method or process disclosed herein, the acts or operations of the method or process may be performed in any suitable sequence and are not necessarily limited to any particular disclosed sequence. Various operations may be described as multiple discrete operations in turn, in a manner that may be helpful in understanding certain embodiments; however, the order of description should not be construed to imply that these operations are order dependent. Additionally, the structures, systems, and/or devices described herein may be embodied as integrated components or as separate components. For purposes of comparing various embodiments, certain aspects and advantages of these embodiments are described. Not necessarily all such aspects or advantages are achieved by any particular embodiment. Thus, for example, various embodiments may be carried out in a manner that achieves or optimizes one advantage or group of advantages as taught herein without necessarily achieving other aspects or advantages as may also be taught or suggested herein.
In order to facilitate an understanding of the systems and methods discussed herein, a number of terms are defined below. The terms defined below, as well as other terms used herein, should be construed to include the provided definitions, the ordinary and customary meaning of the terms, and/or any other implied meaning for the respective terms. Thus, the definitions below do not limit the meaning of these terms, but only provide exemplary definitions.
Cyber attack: The attempt to gain access to an organization's computer resources by unauthorized means or in an unauthorized manner. A cyber attack may involve techniques such as exploitation of software or hardware vulnerabilities, social engineering such as “phishing”, using stolen authentication information, etc.
Resource: A computer-based resource or system of an organization of particular importance. For example, a resource may be a trading system, an industrial control system, a confidential database, and/or any other computer system or resource or the like. Resources may comprise multiple servers, databases, or computers.
Contextual information: Any information about a resource and its environment, such as the resource's access policy, the resource's value, the resource's physical location, or the resource's location in the organization's network topology.
Indicator: Any information that indicates a cyber attack against a resource is more or less likely. Such indicators may include, for example, computer logins and logouts, data sent and received on an organization's network, data transferred to or from a database, data changed or modified by a user, failed or successful user authentications, failed or successful attempts at exploiting a security vulnerability in a computer resource of the organization, failed or successful attempts at “phishing”, failed or successful attempts to install malicious software, or “malware”, on an organization's computers, etc. Such indicators may be gathered by hardware appliances or computing devices located within a network or computing system, software applications located within a network or computing system, and/or any other suitable methods. For example, indicators may be obtained from in proxy logs, data loss prevention (DLP) logs, firewall logs, VPN logs, operating system logs such as syslog or Windows Event Log, etc.
Phishing: Stealing authentication information of a user by defrauding the user into voluntarily giving up the information. For example, a common phishing attack may comprise sending an email to a user that falsely purports to be sent by the organization's IT department to a user and requests a user's password.
Event: An occurrence that is potentially related to a cyber attack on a resource. For example, a phishing email sent to a user of a resource, or a failed or successful login attempt by a user on a server related to a resource, or a transaction on a resource may be determined to be events. Events may be associated with a date, time, associated users, associated computers, or other information providing context to the event. Notably, some events may be generated in the ordinary cause of business; as such, an event is not necessarily related to a cyber attack on a resource.
Data exfiltration: Unauthorized removal of information (e.g., confidential information) from the control of the organization. Data exfiltration may be accomplished, for example, by copying confidential information to a removable drive, by uploading confidential information to a web server, by emailing confidential information to a recipient outside the organization, etc.
Alert: A determination from a warning system that a potential cyber attack against a resource was detected.
User activity information: Any information related to a user's activity on a computing system or network. Such user activity information may include, for example, computer logins and logouts, data inputted, data transferred, data changed or modified, data created, data outputted, data printed, IP addresses communicated with, websites communicated with, software applications executed, etc. Such user activity information may be gathered by hardware appliances or computing devices located within a network or computing system, software applications located within a network or computing system, and/or any other suitable methods. For example, user activity information may be stored in proxy logs, data loss prevention (DLP) logs, email logs etc.
Data Store: Any computer readable storage medium and/or device (or collection of data storage mediums and/or devices). Examples of data stores include, but are not limited to, optical disks (e.g., CD-ROM, DVD-ROM, etc.), magnetic disks (e.g., hard disks, floppy disks, etc.), memory circuits (e.g., solid state drives, random-access memory (RAM), etc.), and/or the like. Another example of a data store is a hosted storage environment that includes a collection of physical data storage devices that may be remotely accessible and may be rapidly provisioned as needed (commonly referred to as “cloud” storage).
Database: Any data structure (and/or combinations of multiple data structures) for storing and/or organizing data, including, but not limited to, relational databases (e.g., Oracle databases, MySQL databases, etc.), non-relational databases (e.g., NoSQL databases, etc.), in-memory databases, spreadsheets, as comma separated values (CSV) files, eXtendible markup language (XML) files, TeXT (TXT) files, flat files, spreadsheet files, and/or any other widely used or proprietary format for data storage. Databases are typically stored in one or more data stores. Accordingly, each database referred to herein (e.g., in the description herein and/or the figures of the present application) is to be understood as being stored in one or more data stores.
Example Warning System and Network Environment
The email server is responsible for routing email messages originating from the enterprise network 122 to their recipients. During operation, the email server creates email logs 172, and makes the email logs 172 available to the monitoring device 150. For example, the email logs 172 may comprise indicators relating to what messages a user sent, who the recipients of these messages were, and what type of data attachments were contained in the message.
A network printer 180 may also be connected to the enterprise network 122. The network printer 180 may create print logs 181 in the course of its operation, and make the print logs 181 available to the monitoring device 150 through the enterprise network 122. The print logs 181 may comprise indicators related to what print jobs were started, which user started each print jobs and from what computer it was sent, how many pages each print job was, and what the type, file name and file type of the printed document was.
A Data Loss Prevention (DLP) server 192 may also be connected to the enterprise network 122. The DLP server may provide DLP logs 194, which may comprise indicators related to a user's transfers of files from the enterprise network 122 to removable media (such as a USB flash drive), the user's transfer of files and/or communications within and/or outside of the enterprise network 122, and/or other user activities. The DLP server may, for example, be any commercially available or open-source DLP solution, including, for example, RSA DLP or McAfee Total Protection DLP.
An intrusion detection system (IDS) server 196 may also be connected to the enterprise network 122. The intrusion detection system may, for example, be any commercially available or open-source IDS solution, including, for example, Snort or Suricata. The intrusion detection system may make available intrusion detection system logs 198, which may comprise indicators related to potential attempts to exploit software or hardware vulnerabilities, network traffic originating from malware, and similar activity which the IDS is monitoring the network for.
The monitoring device 150 may also access logs and other activity information from sources in addition to the ones illustrated here. For example, the monitoring device 150 may access operating system logs of various computer systems, such as are provided by syslog or Windows Event Log. The monitoring device 150 may also access service logs that may be generated by a variety of services, such as a web server, database server, voice over IP server, during operation. The monitoring device 150 may also access logs from various other devices such as manageable switches, Uninterruptible Power Supplies (UPSs), hardware firewalls, wireless access points, etc.
In various embodiments, the warning system may be configured in various ways that differ from the example configuration of
Accordingly, as mentioned, in various embodiments the monitoring device is configured to collect and analyze a variety of indicators, and generate alerts based on the result of the analysis. For example, the monitoring device may receive email logs 172, proxy logs 182, DLP logs 194, intranet logs 171, application firewall logs 161, and/or various other indicators.
Some attack approaches may seek to attack the resource by an intermediate step, such as by first attacking another resource, gaining access to an administrative account on that other resource, and then commandeering the administrative account to attack the resource. Other attack approaches may forego such an intermediate step and directly seek to attack the resource. Some of these exemplary attack approaches are illustrated using dashed lines. For example, according to approach 1, the malicious agent 202 may utilize a stolen laptop 206 to access the corporate network through the VPN server. The access to the corporate network by the stolen laptop 206 may, for example, be visible in log files created on the VPN server 208. Alternatively or additionally, the attacker may decide to utilize approach 2, comprising attempts to exploit software or hardware vulnerabilities in web servers or applications of the organization, for example web server 210. Alternatively or additionally, the malicious agent 202 may, as illustrated in approach 3, seek to compromise wireless access point 214, for example, by exploiting cryptographic weaknesses in encryption and authentication schemes uses in the wireless access point 214. The malicious agent 202's attempts to do so may be indicated by logs created in the wireless access point 214, logs of the DHCP server 212, log files created in the web server 210 or the application firewall 160, and/or the like.
Alternatively or additionally, the malicious agent may seek to compromise one or more end points such as employees' laptops, personal computers, mobile phones or other devices, as illustrated in approach 4. The malicious agent 202's attempts at doing so may be indicated in the data loss prevention system logs 213. The malicious agent 202 may also seek to attack the resource directly by utilizing an exploit leveraging a software or hardware vulnerability in the resource itself, as illustrated in approach 5; such an attack may be visible in the logs of an intrusion detection system (IDS). It may be difficult or even impossible to determine that an attach as illustrated in approach 1 has occurred by only reviewing indicators contained in the wireless access logs; conversely, it may be difficult or impossible to determine that an attack as illustrated in approach 3 has occurred by only reviewing indicators contained in wireless access logs. It will be appreciated that when analyzing the risk to an resource by a cyber attack, it may be necessary to detect, and respond to, different strategies and techniques that may be chosen by potential attackers; as such, it may be advantageous to focus the analysis on the resource being attacked, rather than to focus the analysis on the individual indicator related to the attack. For similar reasons, it may also be advantageous to integrate various indicators from a diverse range of sources into a comprehensive analysis.
Example Method of Alert Generation
At block 201 the warning system begins its analysis by accessing information about a resource that is potentially at risk from cyber attack. The information about different resources may, in some embodiments, be provided to the warning system during deployment and may comprise, for example, the name of the resource, the servers, databases and other computer resources associated with the resource, and other information about the resource. In some embodiments, the warning system may utilize machine-learning techniques to automatically determine which resources, activity and other observable variables are related to which resource. For example, the warning system may observe traffic patterns, user activity, past indicators and alerts, and other information, and apply supervised learning techniques known in the art, such as support vector machines, to those observations. This may allow the warning system to determine, based on an initial classification of certain resources and activities as part of a resource, other resources and activities that are likely related to that resource. Advantageously, this allows the warning system to automatically adapt to changes in network topology and configuration, and reduces the administrative effort required. At block 202 the warning system accesses contextual data associated with the resource that is put at risk by a potential cyber attack. For example, the contextual data may include information about what users are permitted to access the resource, information about ordinary transaction patterns, or information about typical usage patterns of the resource by authorized users. The information may also include the physical location of the resource, the location of the resource within the organization's network topology, the value of the resource etc. At block 204, the warning system accesses indicators of a potential cyber attack related to the resource. Examples of such indicators include proxy logs 182, email logs 172, data loss prevention logs 194, application firewall logs 161, etc. The warning system may, for example, access the indicators by querying other devices through an network management protocol such as SNMP, gather the information from accessing the file system of a remote device and parsing its log files or by processing other types of records, such as packet captures from a firewall, logs from an intrusion detection system, anti-malware system, gateway or router. In an embodiment, the warning system may copy some or all of the indicators accessed into local storage to facilitate faster analysis. At block 206 the warning system matches the indicators accessed in block 204 against a set of rules that correspond to different types of activity potentially related to a cyber attack against a resource to determine a set of events reflecting such activity. For each event, the warning system may determine information related to the event based on the rules; for example, the warning system may extract time, date, users, servers and IP addresses involved, etc. The rules may be specifically written for the organization, or the resource, or they may be generic rules representing activity that is generally indicative of a cyber attack. In an embodiment, an analyst may, even after the system has been deployed and is in operation, be able to define arbitrary rules to process information gathered from available data sources, such log files. For example, an analyst may define rules that capture certain business-specific activity. In an embodiment, rules may be automatically learned from activity related to a resource that was previously determined to be related, or not related, to a cyber attack. For example, the warning system may extract various features, such as IP addresses, ports, signatures, packet headers and other characteristics, from past alerts that were determined by an analyst to be related to a cyber attack on a resource, or that were determined by an analyst not to be related to such an attack. Based on machine-learning methods known in the art, such as supervised learning using support-vector machines, the warning system may, from these features, infer a set of rules that can be applied to determine a set of indicators relevant for detecting future attacks.
For example, indicators from an email server may be matched against a set of rules to determine indicators related to emails that were sent to a recipient inside the organization and that appear to be social engineering attacks against an employee of the organization. As another example, proxy logs 182 may be matched against a list of known malicious domains to determine connections made by malicious software from inside the organization to detect attempts of data exfiltration to such known malicious domains. In another example, firewall logs 161 and intranet logs 171 may be matched against rules matching common probing or exploitation techniques. In yet another example, data loss prevention logs 194 may be matched against rules to determine indicators related to attempts of data exfiltration.
In block 208, contextual data associated with the events potentially related to a cyber attack on the resource is determined. For example, in an embodiment the resource event history 154 may be queried to determine whether similar events related to a potential cyber attack on the resource have occurred in the past, and if so, whether those were determined by an analyst to be false positives or genuine causes for concern. As another example, some of the contextual data associated with a potential cyber attack on the resource may include information about events related to potential cyber attacks on other resources.
At block 209, weights may optionally be determined based on the contextual data associated with a potential cyber attack on the resource as determined in block 208, the data associated with the resource is determined in block 201, and other data. In an example embodiment, a weight table 1000 may be used to determine appropriate weights.
In block 210 the information about the resource, the contextual data associated with the resource and the indicators of a potential cyber attack related to the resource as determined in block 204 are combined to determine, for each event, a risk estimate that indicates how much the resource is being put at risk by the event. In block 212 the risk estimate as determined in block 210 is compared against a threshold or in an alternative embodiment is compared against a threshold plus a random value. If the risk estimate exceeds the threshold or the threshold plus the random value control passes to block 214 wherein an alert is generated to indicate to an analyst information regarding a probably cyber attack against the resource. For example, the alert may comprise information about the time and date that the suspicious activity occurred, what resource is being put at risk, what users, what servers and what type of services are involved in the suspicious activity, and what the estimated risk is. In block 216 the one or more alerts as generated in block 214 are submitted into an alert queue 158 from where they can be presented to an analyst. Alert queue 158 can, but need not necessarily be implemented as a sequential queue, such as a First-in-First-out data structure. Alert queue 158 may also be implemented as a list within an application from which alerts can be retrieved in any order (e.g. random order). Examples of how, in an example embodiment, the alerts can be displayed are illustrated below with reference to
In block 222, the resource event history 154 is updated to reflect the new alert or the new event, whatever the case may be. For example, block 222 may comprise the warning system accessing a database storing all events and alerts for a given resource and inserting a record indicating the new event or alert, the date and time of occurrence, the risk estimate and other contextual data that may have been accessed during one of the preceding steps as illustrated in
Example Method of Alert Presentation and Feedback
At block 302, one or more alerts are retrieved from the alert queue 158. At block 304, the one or more alerts retrieved from the alert queue 158 are grouped, filtered and sorted. The alerts may dynamically be grouped and filtered, for example according to different alert types. In an embodiment, the alerts may be sorted by the risk score, for example so as to show the alerts starting with the highest risk score.
At block 306, the alerts, as grouped and filtered, are displayed to the analyst in one or more interactive user interfaces (e.g., as described below in reference to
The warning system moves on to one of blocks 308, 310, or 312 depending on the analyst's response. If the analyst chooses to dismiss the alert, the warning system will adjust the weight table 1000 to reflect the fact that it had issued an alert that should not have been issued. The warning system will thus reduce the weights of the indicators having contributed to the issuance of the alert and conversely increase those of indicators not having contributed to the alert. If the analyst chooses to confirm the alert, the warning system moves to block 310, leaving the set of weights unchanged, thus reflecting the analyst's determination that similar alerts should be issued in the future. If the analyst chooses to escalate the alert to a supervisor, the warning system moves to block 308, causing the alert to be presented to a supervisor. The alert may be presented to a supervisor in a similar manner as it was presented to the analyst, or it may be presented through email, text message or other form of communication. After the alert has been presented, the warning system moves to block 310, leaving the set of weights unchanged. After an alert has been responded to by an analyst, the warning system, in block 314, marks the alert as historic, indicating that no risk is associated with the alert any longer. When an alert is marked as historic, the warning system also recalculates the resource risk score and global risk score to reflect the removal of the alerts, and redraws any graphs or other visualizations comprising the removed alert or one of the updated risk scores.
Example Weight Table
At each intersection of a row and a column is a table element that corresponds to the weight of the indicator in its row, as related to the resource indicated in its column. For example, example table element 420 corresponds to the weight of an indicator “virus infection of resource administrator's computer” for the stock trading system resource. Some indicators, as indicated by column range 414, may relate to risk posed to a specific resource; other indicators, such as indicated by column range 412, may relate to a more general type of threat, putting several resources or all resources at risk.
Based on the weight table, different events may be assigned different risk estimates based on the resource that they correspond to. In an embodiment, the weight table 400 can be updated by the warning system based on the analyst's response to an alert, so as to suppress future alerts that were determined to be false positives and increase the type of alerts being issued that were determined to be correct.
Example Auditor User Interfaces
As mentioned above, in an embodiment, the alert score may be binned into one of, for example, three bins corresponding to a high alert, a medium alert, or a low alert. Each alert level may be associated with an indicator, icon, color, and/or the like. For example, a high alert may be associated with red (and/or another color), a medium alert may be associated with orange (and/or another color), and a low alert may be associated grey (and/or another color).
In various embodiments of the example user interfaces described below in reference to
Referring to
The historical risk graph 902 shows a graphical representation of the overall risk across all resources monitored by the warning system over time. For example, the historical risk graph 902 may show on the x-axis the last three months and on the y axis show the global risk score. The risk trend indicator 908 shows the resource that has been determined as having the greatest increase in risk over a recent period of time, such as for example, the last twenty-four hours. The highest risk system indicator 906 shows the resource with the highest risk score, and the risk score corresponding to that resource, in parentheses. By selecting the highest risk system indicator, the analyst is directed to a system overview page of the highest risk system, as illustrated in
Example user interface 1008 as shown in
The top strategies pane 1002 shows the types of activities or indicators monitored that recently generated the most events related to this resource. Advantageously, this allows the analyst to determine whether or not there is a trend of a certain suspicious activity increasing in volume, and whether or not the sources of alerts are concentrated. The open alerts counter 1009 indicates the number of alerts currently requiring a response from the analyst. The alerts and events filter field 1018 accepts text input from the analyst and allows him to filter the alerts and events being displayed. For example, the analyst may enter the name of a specific user or may enter the type of a specific suspicious activity such as authentication failure to filter the alerts displayed. Advantageously, this allows the analyst to investigate certain types of activity related to a cyber attack against a resource in greater detail. The quick action bar 1020 allows the analyst to select one out of several responses to the selected one or more alerts. For example, the analyst may be able to escalate the one or more alerts to a supervisor by selecting the escalate option, the analyst may dismiss the one or more alerts as non-critical by clicking the sign-off option, the analyst may be able to assign another analyst to conduct an investigation by clicking the initiate investigation option.
The alert and event graph 1016 displays a graphical representation of alerts and events for the resource; displays alerts and events based on their occurrence in time and their risk score. For example, alerts 1052a and 1052b are drawn in the chart with their positions representing their time of occurrence and risk score. The show historical alerts toggle switch 1019 allows the analyst, by selecting and deselecting it, to determine whether or not historical alerts, that is, alerts that have already been responded to by an analyst, should be displayed in the alert and event graph 1016. The show events toggle switch 1021 allows the analyst by enabling or disabling it to determine whether or not events should be displayed in the alert and event graph 1016. If the display of historical alerts is selected through the show historical alerts toggle switch 1019 historical events may be displayed in the alert and event graph 1016 as striped circles (or as any other indicator, icon, or color, for example), such as for historical event 1051. If the display of events is enabled in the show events toggle switch 1021, events are displayed as shaded grey circles (or as any other indicator, icon, or color, for example) in the alert and event graph 1016, such as for events 1050a and 1050b.
The alerts and events table 1022 comprises, for each event displayed in the alerts and events table 1022, a selection check box 1024, an alert or event description column 1026, alert or event type column 1028, and a status column 1030 as well as an alert or event time column 1032. The selection check box 1024 allows the analyst to include in a selection by checking, or to exclude from a selection by unchecking, the selection check box 1024, corresponding one or more alerts. This allows the analyst to choose one or more alerts to take action on. For example, the analyst may check the selection check box 1024 corresponding to one or more alerts to either sign off, escalate, or initiate an investigation as to those one or more alerts.
The alert or event description column 1026 displays a concise summary of the type and nature of activity that gave rise to an alert or event. This may include alert-specific information, such as the name of a person, computer, server etc. Advantageously, this may allow a free-text search to pick up on those details across different alerts. For example, the alert or event description column 1026 may indicate that a certain user has unsuccessfully attempted to log into a computer resource of the organization that a certain user's computer has been determined to be infected with malicious software or that a certain user has been receiving social engineering emails, the name of the user, and the email address to which they were sent. The alert or event type column 1028 indicates whether a given entry in the alerts and events table 1022 is an alert or an event. The status column 1030 indicates whether or not for a given event any action by the analyst is expected by the warning system. For example, for an event the status column will indicate that there is no action necessary by the analyst, whereas for an alert the status column 1030 may indicate that action by the analyst is requested for an alert. For example, the analyst may be requested to review and, as appropriate, decide to either escalate, sign off or initiate an investigation as to the alert. If an analyst has taken an action as to an alert, the status will change, indicating that no further action is necessary anymore because the alert has already been signed off, escalated or subjected to the initiation of an investigation by this or another analyst. The alert or event time column 1032 indicates the date and time that the alert or event was created.
Advantageously, by presenting to the analyst alerts together with events, as in the example user interface of
Escalating one or more alerts notifies a supervisor of the alerts, thus allowing the supervisor to take immediate action against a cyber attack. Selecting “Initiate Investigation” allows the analyst to assign another analyst to investigating the selected one or more alerts. Signing off on one or more alerts reflects the analyst's determination that the alert does not necessitate action. This causes the warning system to mark the selected alert as historic; the selected one or more alerts will thus no longer contribute to the resource risk score. Once an alert is marked as historic, the warning system updates the resource risk score and global risk score to reflect the removal of the alert. If the historic alerts toggle switch is set to disabled, the selected one or more alerts will also be removed from the alert and event graph 1016; otherwise, the alerts will remain on the alert and event graph 1016, but be drawn there as shaded black circle (or as any other indicator, icon, or color, for example). Other elements of the user interface, including the event counter 1004, will also be updated to reflect the removal of the alert.
In various implementations, various tables and panels may include more or fewer columns or information items than those shown in the examples of
Distinguishing non-activity related to a cyber attack against an resource on a computer network from activity related to a cyber attack on an resource is difficult, especially because of the large quantity of indicators to be reviewed, and because it may not be possible to conclude whether a certain event is or is not indicative of a cyber attack by taking into account only one, or a subset of, indicators. Embodiments of the present disclosure allow for a warning system to be implemented that gathers the various indicators, processes them using contextual information to determine the risk of a cyber attack against a resource, and generates alerts where appropriate based on the estimate of risk. The risk estimate can then be used to create alerts for review by a human analyst, and to sort, rank, aggregate and filter the alerts. When alerts are presented to a human analyst, contextual information, such as other events associated with the resource, is presented with the alert. Where appropriate, alerts may be presented using aggregates such as totals, averages, and maxima. Alerts are presented in a user interface that incorporates visual representations, such as charts and graphs, where appropriate, to allow the analyst to comfortably review large datasets and to take advantage of humans' particularly strong pattern recognition abilities related to visual stimuli.
In some embodiments, notifications of new alerts, or of other developments, such as a risk score exceeding a critical value, can be generated and automatically transmitted to a device operated by the user associated with a corresponding trigger. The notification and/or notification can be transmitted at the time that the notification is generated or at some determined time after generation of the notification and/or notification. When received by the device, the notification and/or notification can cause the device to display the notification and/or notification via the activation of an application on the device (e.g., a browser, a mobile application, etc.). For example, receipt of the notification and/or notification may automatically activate an application on the device, such as a messaging application (e.g., SMS or MMS messaging application), a standalone application (e.g., a warning system monitoring application), or a browser, for example, and display information included in the notification or additional related information. If the device is offline when the notification and/or notifications are transmitted, the application may be automatically activated when the device is online such that the notification and/or notification are displayed. As another example, receipt of the notification and/or notification may cause a browser to open and be redirected to a login page generated by the warning system so that the user can log in to the warning system and view the notification and related data. Alternatively, the notification and/or notification may include a URL of a webpage (or other online information) associated with the notification, such that when the device (e.g., a mobile device) receives the notification, a browser (or other application) is automatically activated and the URL included in the notification and/or notification is accessed via the Internet. Advantageously, this keeps analysts and other interested members of an organization informed about critical development, without requiring them to periodically check the status of the warning system.
Various embodiments of the present disclosure may be a system, a method, and/or a computer program product at any possible technical detail level of integration. The computer program product may include a computer readable storage medium (or mediums) having computer readable program instructions thereon for causing a processor to carry out aspects of the present disclosure.
For example, the functionality described herein may be performed as software instructions are executed by, and/or in response to software instructions being executed by, one or more hardware processors and/or any other suitable computing devices. The software instructions and/or other executable code may be read from a computer readable storage medium (or mediums).
The computer readable storage medium can be a tangible device that can retain and store data and/or instructions for use by an instruction execution device. The computer readable storage medium may be, for example, but is not limited to, an electronic storage device (including any volatile and/or non-volatile electronic storage devices), a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of the computer readable storage medium includes the following: a portable computer diskette, a hard disk, a solid state drive, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanically encoded device such as punch-cards or raised structures in a groove having instructions recorded thereon, and any suitable combination of the foregoing. A computer readable storage medium, as used herein, is not to be construed as being transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission media (e.g., light pulses passing through a fiber-optic cable), or electrical signals transmitted through a wire.
Computer readable program instructions described herein can be downloaded to respective computing/processing devices from a computer readable storage medium or to an external computer or external storage device via a network, for example, the Internet, a local area network, a wide area network and/or a wireless network. The network may comprise copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers and/or edge servers. A network adapter card or network interface in each computing/processing device receives computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium within the respective computing/processing device.
Computer readable program instructions (as also referred to herein as, for example, “code,” “instructions,” “module,” “application,” “software application,” and/or the like) for carrying out operations of the present disclosure may be assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, configuration data for integrated circuitry, or either source code or object code written in any combination of one or more programming languages, including an object oriented programming language such as Smalltalk, C++, or the like, and procedural programming languages, such as the “C” programming language or similar programming languages. Computer readable program instructions may be callable from other instructions or from itself, and/or may be invoked in response to detected events or interrupts. Computer readable program instructions configured for execution on computing devices may be provided on a computer readable storage medium, and/or as a digital download (and may be originally stored in a compressed or installable format that requires installation, decompression or decryption prior to execution) that may then be stored on a computer readable storage medium. Such computer readable program instructions may be stored, partially or fully, on a memory device (e.g., a computer readable storage medium) of the executing computing device, for execution by the computing device. The computer readable program instructions may execute entirely on a user's computer (e.g., the executing computing device), partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate arrays (FPGA), or programmable logic arrays (PLA) may execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform aspects of the present disclosure.
Aspects of the present disclosure are described herein with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the disclosure. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer readable program instructions.
These computer readable program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks. These computer readable program instructions may also be stored in a computer readable storage medium that can direct a computer, a programmable data processing apparatus, and/or other devices to function in a particular manner, such that the computer readable storage medium having instructions stored therein comprises an article of manufacture including instructions which implement aspects of the function/act specified in the flowchart(s) and/or block diagram(s) block or blocks.
The computer readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer implemented process, such that the instructions which execute on the computer, other programmable apparatus, or other device implement the functions/acts specified in the flowchart and/or block diagram block or blocks. For example, the instructions may initially be carried on a magnetic disk or solid state drive of a remote computer. The remote computer may load the instructions and/or modules into its dynamic memory and send the instructions over a telephone, cable, or optical line using a modem. A modem local to a server computing system may receive the data on the telephone/cable/optical line and use a converter device including the appropriate circuitry to place the data on a bus. The bus may carry the data to a memory, from which a processor may retrieve and execute the instructions. The instructions received by the memory may optionally be stored on a storage device (e.g., a solid state drive) either before or after execution by the computer processor.
The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of instructions, which comprises one or more executable instructions for implementing the specified logical function(s). In some alternative implementations, the functions noted in the blocks may occur out of the order noted in the Figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. In addition, certain blocks may be omitted in some implementations. The methods and processes described herein are also not limited to any particular sequence, and the blocks or states relating thereto can be performed in other sequences that are appropriate.
It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems that perform the specified functions or acts or carry out combinations of special purpose hardware and computer instructions. For example, any of the processes, methods, algorithms, elements, blocks, applications, or other functionality (or portions of functionality) described in the preceding sections may be embodied in, and/or fully or partially automated via, electronic hardware such application-specific processors (e.g., application-specific integrated circuits (ASICs)), programmable processors (e.g., field programmable gate arrays (FPGAs)), application-specific circuitry, and/or the like (any of which may also combine custom hard-wired logic, logic circuits, ASICs, FPGAs, etc. with custom programming/execution of software instructions to accomplish the techniques).
Any of the above-mentioned processors, and/or devices incorporating any of the above-mentioned processors, may be referred to herein as, for example, “computers,” “computer devices,” “computing devices,” “hardware computing devices,” “hardware processors,” “processing units,” and/or the like. Computing devices of the above-embodiments may generally (but not necessarily) be controlled and/or coordinated by operating system software, such as Mac OS, iOS, Android, Chrome OS, Windows OS (e.g., Windows XP, Windows Vista, Windows 7, Windows 8, Windows 10, Windows Server, etc.), Windows CE, Unix, Linux, SunOS, Solaris, Blackberry OS, VxWorks, or other suitable operating systems. In other embodiments, the computing devices may be controlled by a proprietary operating system. Conventional operating systems control and schedule computer processes for execution, perform memory management, provide file system, networking, I/O services, and provide a user interface functionality, such as a graphical user interface (“GUI”), among other things.
For example,
Computer system 800 also includes a main memory 806, such as a random access memory (RAM), cache and/or other dynamic storage devices, coupled to bus 802 for storing information and instructions to be executed by processor 804. Main memory 806 also may be used for storing temporary variables or other intermediate information during execution of instructions to be executed by processor 804. Such instructions, when stored in storage media accessible to processor 804, render computer system 800 into a special-purpose machine that is customized to perform the operations specified in the instructions. Advantageously, computer system 800 may, when configured as monitoring device 150, utilize non-uniform memory access (NUMA) architectures for performance benefits. For example, computer system 800 may designate different processors or physical processor cores to a different resource or group of resources, and may store the corresponding indicators, rules and events in a memory location “near” that processor or physical core. This allows the warning system to concentrate memory accesses on “near” memory locations during the processing of indicators, and thus allows to further gain performance benefits from parallelism.
Computer system 800 further includes a read only memory (ROM) 808 or other static storage device coupled to bus 802 for storing static information and instructions for processor 804. A storage device 810, such as a magnetic disk, optical disk, or USB thumb drive (Flash drive), etc., is provided and coupled to bus 802 for storing information and instructions.
Computer system 800 may be coupled via bus 802 to a display 812, such as a cathode ray tube (CRT) or LCD display (or touch screen), for displaying information to a computer user. An input device 814, including alphanumeric and other keys, is coupled to bus 802 for communicating information and command selections to processor 804. Another type of user input device is cursor control 816, such as a mouse, a trackball, or cursor direction keys for communicating direction information and command selections to processor 804 and for controlling cursor movement on display 812. This input device typically has two degrees of freedom in two axes, a first axis (e.g., x) and a second axis (e.g., y), that allows the device to specify positions in a plane. In some embodiments, the same direction information and command selections as cursor control may be implemented via receiving touches on a touch screen without a cursor.
Computing system 800 may include a user interface module to implement a GUI that may be stored in a mass storage device as computer executable program instructions that are executed by the computing device(s). Computer system 800 may further, as described below, implement the techniques described herein using customized hard-wired logic, one or more ASICs or FPGAs, firmware and/or program logic which in combination with the computer system causes or programs computer system 800 to be a special-purpose machine. According to one embodiment, the techniques herein are performed by computer system 800 in response to processor(s) 804 executing one or more sequences of one or more computer readable program instructions contained in main memory 806. Such instructions may be read into main memory 806 from another storage medium, such as storage device 810. Execution of the sequences of instructions contained in main memory 806 causes processor(s) 804 to perform the process steps described herein. In alternative embodiments, hard-wired circuitry may be used in place of or in combination with software instructions.
Various forms of computer readable storage media may be involved in carrying one or more sequences of one or more computer readable program instructions to processor 804 for execution. For example, the instructions may initially be carried on a magnetic disk or solid state drive of a remote computer. The remote computer can load the instructions into its dynamic memory and send the instructions over a telephone line using a modem. A modem local to computer system 800 can receive the data on the telephone line and use an infra-red transmitter to convert the data to an infra-red signal. An infra-red detector can receive the data carried in the infra-red signal and appropriate circuitry can place the data on bus 802. Bus 802 carries the data to main memory 806, from which processor 804 retrieves and executes the instructions. The instructions received by main memory 806 may optionally be stored on storage device 810 either before or after execution by processor 804.
Computer system 800 also includes a communication interface 818 coupled to bus 802. Communication interface 818 provides a two-way data communication coupling to a network link 820 that is connected to a local network 822. For example, communication interface 818 may be an integrated services digital network (ISDN) card, cable modem, satellite modem, or a modem to provide a data communication connection to a corresponding type of telephone line. As another example, communication interface 818 may be a local area network (LAN) card to provide a data communication connection to a compatible LAN (or WAN component to communicate with a WAN). Wireless links may also be implemented. In any such implementation, communication interface 818 sends and receives electrical, electromagnetic or optical signals that carry digital data streams representing various types of information.
Network link 820 typically provides data communication through one or more networks to other data devices. For example, network link 820 may provide a connection through local network 822 to a host computer 824 or to data equipment operated by an Internet Service Provider (ISP) 826. ISP 826 in turn provides data communication services through the world wide packet data communication network now commonly referred to as the “Internet” 828. Local network 822 and Internet 828 both use electrical, electromagnetic or optical signals that carry digital data streams. The signals through the various networks and the signals on network link 820 and through communication interface 818, which carry the digital data to and from computer system 800, are example forms of transmission media.
Computer system 800 can send messages and receive data, including program code, through the network(s), network link 820 and communication interface 818. In the Internet example, a server 830 might transmit a requested code for an application program through Internet 828, ISP 826, local network 822 and communication interface 818.
The received code may be executed by processor 804 as it is received, and/or stored in storage device 810, or other non-volatile storage for later execution.
As described above, in various embodiments certain functionality may be accessible by a user through a web-based viewer (such as a web browser), or other suitable software program). In such implementations, the user interface may be generated by a server computing system and transmitted to a web browser of the user (e.g., running on the user's computing system). Alternatively, data (e.g., user interface data) necessary for generating the user interface may be provided by the server computing system to the browser, where the user interface may be generated (e.g., the user interface data may be executed by a browser accessing a web service and may be configured to render the user interfaces based on the user interface data). The user may then interact with the user interface through the web-browser. User interfaces of certain implementations may be accessible through one or more dedicated software applications. In certain embodiments, one or more of the computing devices and/or systems of the disclosure may include mobile computing devices, and user interfaces may be accessible through such mobile computing devices (for example, smartphones and/or tablets). In an example embodiment, when configured as monitoring device 150, computer system 800 hosts a web server serving an HTML-based user interface to analysts connecting through a remote device.
Many variations and modifications may be made to the above-described embodiments, the elements of which are to be understood as being among other acceptable examples. All such modifications and variations are intended to be included herein within the scope of this disclosure. The foregoing description details certain embodiments. It will be appreciated, however, that no matter how detailed the foregoing appears in text, the systems and methods can be practiced in many ways. As is also stated above, it should be noted that the use of particular terminology when describing certain features or aspects of the systems and methods should not be taken to imply that the terminology is being re-defined herein to be restricted to including any specific characteristics of the features or aspects of the systems and methods with which that terminology is associated.
Conditional language, such as, among others, “can,” “could,” “might,” or “may,” unless specifically stated otherwise, or otherwise understood within the context as used, is generally intended to convey that certain embodiments include, while other embodiments do not include, certain features, elements, and/or steps. Thus, such conditional language is not generally intended to imply that features, elements and/or steps are in any way required for one or more embodiments or that one or more embodiments necessarily include logic for deciding, with or without user input or prompting, whether these features, elements and/or steps are included or are to be performed in any particular embodiment.
The term “substantially” when used in conjunction with the term “real-time” forms a phrase that will be readily understood by a person of ordinary skill in the art. For example, it is readily understood that such language will include speeds in which no or little delay or waiting is discernible, or where such delay is sufficiently short so as not to be disruptive, irritating, or otherwise vexing to a user.
Conjunctive language such as the phrase “at least one of X, Y, and Z,” or “at least one of X, Y, or Z,” unless specifically stated otherwise, is to be understood with the context as used in general to convey that an item, term, etc. may be either X, Y, or Z, or a combination thereof. For example, the term “or” is used in its inclusive sense (and not in its exclusive sense) so that when used, for example, to connect a list of elements, the term “or” means one, some, or all of the elements in the list. Thus, such conjunctive language is not generally intended to imply that certain embodiments require at least one of X, at least one of Y, and at least one of Z to each be present.
The term “a” as used herein should be given an inclusive rather than exclusive interpretation. For example, unless specifically noted, the term “a” should not be understood to mean “exactly one” or “one and only one”; instead, the term “a” means “one or more” or “at least one,” whether used in the claims or elsewhere in the specification and regardless of uses of quantifiers such as “at least one,” “one or more,” or “a plurality” elsewhere in the claims or specification.
The term “comprising” as used herein should be given an inclusive rather than exclusive interpretation. For example, a general purpose computer comprising one or more processors should not be interpreted as excluding other computer components, and may possibly include such components as memory, input/output devices, and/or network interfaces, among others.
While the above detailed description has shown, described, and pointed out novel features as applied to various embodiments, it may be understood that various omissions, substitutions, and changes in the form and details of the devices or processes illustrated may be made without departing from the spirit of the disclosure. As may be recognized, certain embodiments of the inventions described herein may be embodied within a form that does not provide all of the features and benefits set forth herein, as some features may be used or practiced separately from others. The scope of certain inventions disclosed herein is indicated by the appended claims rather than by the foregoing description. All changes which come within the meaning and range of equivalency of the claims are to be embraced within their scope.
This application is claims benefit of U.S. Provisional Patent Application No. 62/439,712, filed Dec. 28, 2016, and titled “RESOURCE-CENTRIC NETWORK CYBER ATTACK WARNING SYSTEM”. The entire disclosure of each of the above items is hereby made part of this specification as if set forth fully herein and incorporated by reference for all purposes, for all that it contains. Any and all applications for which a foreign or domestic priority claim is identified in the Application Data Sheet as filed with the present application are hereby incorporated by reference under 37 CFR 1.57 for all purposes and for all that they contain.
| Number | Name | Date | Kind |
|---|---|---|---|
| 5819226 | Gopinathan et al. | Oct 1998 | A |
| 5892900 | Ginter et al. | Apr 1999 | A |
| 5978475 | Schneier et al. | Nov 1999 | A |
| 6094643 | Anderson et al. | Jul 2000 | A |
| 6253203 | O'Flaherty et al. | Jun 2001 | B1 |
| 6430305 | Decker | Aug 2002 | B1 |
| 6725240 | Asad et al. | Apr 2004 | B1 |
| 6792422 | Stride et al. | Sep 2004 | B1 |
| 6807569 | Bhimani et al. | Oct 2004 | B1 |
| 6820135 | Dingman | Nov 2004 | B1 |
| 6978419 | Kantrowitz | Dec 2005 | B1 |
| 6980984 | Huffman et al. | Dec 2005 | B1 |
| 7017046 | Doyle et al. | Mar 2006 | B2 |
| 7069586 | Winneg et al. | Jun 2006 | B1 |
| 7168039 | Bertram | Jan 2007 | B2 |
| 7225468 | Waisman et al. | May 2007 | B2 |
| 7596285 | Brown et al. | Sep 2009 | B2 |
| 7617232 | Gabbert et al. | Nov 2009 | B2 |
| 7756843 | Palmer | Jul 2010 | B1 |
| 7770032 | Nesta et al. | Aug 2010 | B2 |
| 7801871 | Gosnell | Sep 2010 | B2 |
| 7899796 | Borthwick et al. | Mar 2011 | B1 |
| 7917376 | Bellin et al. | Mar 2011 | B2 |
| 7941321 | Greenstein et al. | May 2011 | B2 |
| 7962495 | Jain et al. | Jun 2011 | B2 |
| 8036971 | Aymeloglu et al. | Oct 2011 | B2 |
| 8046283 | Burns | Oct 2011 | B2 |
| 8054756 | Chand et al. | Nov 2011 | B2 |
| 8181253 | Zaitsev et al. | May 2012 | B1 |
| 8190893 | Benson et al. | May 2012 | B2 |
| 8196184 | Amirov et al. | Jun 2012 | B2 |
| 8214490 | Vos et al. | Jul 2012 | B1 |
| 8229902 | Vishniac et al. | Jul 2012 | B2 |
| 8239668 | Chen et al. | Aug 2012 | B1 |
| 8290838 | Thakur et al. | Oct 2012 | B1 |
| 8301904 | Gryaznov | Oct 2012 | B1 |
| 8302855 | Ma et al. | Nov 2012 | B2 |
| 8312546 | Alme | Nov 2012 | B2 |
| 8473454 | Evanitsky et al. | Jun 2013 | B2 |
| 8484115 | Aymeloglu et al. | Jul 2013 | B2 |
| 8589273 | Creeden et al. | Nov 2013 | B2 |
| 8600872 | Yan | Dec 2013 | B1 |
| 8646080 | Williamson et al. | Feb 2014 | B2 |
| 8666861 | Li et al. | Mar 2014 | B2 |
| 8683322 | Cooper | Mar 2014 | B1 |
| 8688573 | Ruknoic et al. | Apr 2014 | B1 |
| 8726379 | Stiansen et al. | May 2014 | B1 |
| 8744890 | Bernier | Jun 2014 | B1 |
| 8769412 | Gill et al. | Jul 2014 | B2 |
| 8782794 | Ramcharran | Jul 2014 | B2 |
| 8798354 | Bunzel et al. | Aug 2014 | B1 |
| 8812960 | Sun et al. | Aug 2014 | B1 |
| 8924388 | Elliot et al. | Dec 2014 | B2 |
| 8924389 | Elliot et al. | Dec 2014 | B2 |
| 8931043 | Cooper et al. | Jan 2015 | B2 |
| 8938686 | Erenrich et al. | Jan 2015 | B1 |
| 8949164 | Mohler | Feb 2015 | B1 |
| 9021260 | Falk et al. | Apr 2015 | B1 |
| 9032531 | Scorvo et al. | May 2015 | B1 |
| 9049117 | Nucci et al. | Jun 2015 | B1 |
| 9100428 | Visbal | Aug 2015 | B1 |
| 9129219 | Robertson et al. | Sep 2015 | B1 |
| 9202249 | Cohen | Dec 2015 | B1 |
| 9335897 | Goldenberg | May 2016 | B2 |
| 9338013 | Castellucci et al. | May 2016 | B2 |
| 9407652 | Kesin | Aug 2016 | B1 |
| 9516053 | Muddu | Dec 2016 | B1 |
| 9906554 | Higbee | Feb 2018 | B2 |
| 10063654 | Kirti | Aug 2018 | B2 |
| 10192058 | Jalil | Jan 2019 | B1 |
| 20010027424 | Torigoe | Oct 2001 | A1 |
| 20020065708 | Senay et al. | May 2002 | A1 |
| 20020095360 | Joao | Jul 2002 | A1 |
| 20020095658 | Shulman | Jul 2002 | A1 |
| 20020103705 | Brady | Aug 2002 | A1 |
| 20020112157 | Doyle et al. | Aug 2002 | A1 |
| 20020147805 | Leshem et al. | Oct 2002 | A1 |
| 20030126102 | Borthwick | Jul 2003 | A1 |
| 20040034570 | Davis | Feb 2004 | A1 |
| 20040111480 | Yue | Jun 2004 | A1 |
| 20040123139 | Aiello et al. | Jun 2004 | A1 |
| 20040153418 | Hanweck | Aug 2004 | A1 |
| 20040236688 | Bozeman | Nov 2004 | A1 |
| 20040250124 | Chesla et al. | Dec 2004 | A1 |
| 20050010472 | Quatse et al. | Jan 2005 | A1 |
| 20050086207 | Heuer et al. | Apr 2005 | A1 |
| 20050133588 | Williams | Jun 2005 | A1 |
| 20050149455 | Bruesewitz et al. | Jul 2005 | A1 |
| 20050154628 | Eckart et al. | Jul 2005 | A1 |
| 20050154769 | Eckart et al. | Jul 2005 | A1 |
| 20050157662 | Bingham et al. | Jul 2005 | A1 |
| 20050229256 | Banzhof | Oct 2005 | A2 |
| 20050262556 | Waisman et al. | Nov 2005 | A1 |
| 20050275638 | Kolmykov-Zotov et al. | Dec 2005 | A1 |
| 20060021050 | Cook | Jan 2006 | A1 |
| 20060026120 | Carolan et al. | Feb 2006 | A1 |
| 20060031928 | Conley et al. | Feb 2006 | A1 |
| 20060069912 | Zheng et al. | Mar 2006 | A1 |
| 20060143034 | Rothermel | Jun 2006 | A1 |
| 20060143075 | Carr et al. | Jun 2006 | A1 |
| 20060143079 | Basak et al. | Jun 2006 | A1 |
| 20060179003 | Steele et al. | Aug 2006 | A1 |
| 20060212931 | Shull et al. | Sep 2006 | A1 |
| 20060218637 | Thomas et al. | Sep 2006 | A1 |
| 20060265747 | Judge | Nov 2006 | A1 |
| 20070000999 | Kubo et al. | Jan 2007 | A1 |
| 20070011304 | Error | Jan 2007 | A1 |
| 20070038646 | Thota | Feb 2007 | A1 |
| 20070050777 | Hutchinson | Mar 2007 | A1 |
| 20070061259 | Zoldi et al. | Mar 2007 | A1 |
| 20070106582 | Baker et al. | May 2007 | A1 |
| 20070143851 | Nicodemus | Jun 2007 | A1 |
| 20070150801 | Chidlovskii et al. | Jun 2007 | A1 |
| 20070156673 | Maga | Jul 2007 | A1 |
| 20070185867 | Maga | Aug 2007 | A1 |
| 20070239606 | Eisen | Oct 2007 | A1 |
| 20070284433 | Domenica et al. | Dec 2007 | A1 |
| 20070294766 | Mir et al. | Dec 2007 | A1 |
| 20080046481 | Gould et al. | Feb 2008 | A1 |
| 20080069081 | Chand et al. | Mar 2008 | A1 |
| 20080103798 | Domenikos et al. | May 2008 | A1 |
| 20080103996 | Forman et al. | May 2008 | A1 |
| 20080104407 | Horne et al. | May 2008 | A1 |
| 20080140576 | Lewis et al. | Jun 2008 | A1 |
| 20080201580 | Savitzky et al. | Aug 2008 | A1 |
| 20080222038 | Eden et al. | Sep 2008 | A1 |
| 20080222295 | Robinson et al. | Sep 2008 | A1 |
| 20080222706 | Renaud et al. | Sep 2008 | A1 |
| 20080229422 | Hudis et al. | Sep 2008 | A1 |
| 20080243711 | Aymeloglu et al. | Oct 2008 | A1 |
| 20080255973 | El Wade et al. | Oct 2008 | A1 |
| 20080301042 | Patzer | Dec 2008 | A1 |
| 20080313132 | Hao et al. | Dec 2008 | A1 |
| 20090018996 | Hunt et al. | Jan 2009 | A1 |
| 20090076845 | Bellin et al. | Mar 2009 | A1 |
| 20090094166 | Aymeloglu et al. | Apr 2009 | A1 |
| 20090103442 | Douville | Apr 2009 | A1 |
| 20090106178 | Chu | Apr 2009 | A1 |
| 20090112745 | Stefanescu | Apr 2009 | A1 |
| 20090125359 | Knapic | May 2009 | A1 |
| 20090125459 | Norton et al. | May 2009 | A1 |
| 20090187546 | Whyte et al. | Jul 2009 | A1 |
| 20090187548 | Ji et al. | Jul 2009 | A1 |
| 20090228365 | Tomchek et al. | Sep 2009 | A1 |
| 20090228701 | Lin | Sep 2009 | A1 |
| 20090249244 | Robinson et al. | Oct 2009 | A1 |
| 20090271343 | Vaiciulis et al. | Oct 2009 | A1 |
| 20090281839 | Lynn et al. | Nov 2009 | A1 |
| 20090307049 | Elliott et al. | Dec 2009 | A1 |
| 20090313463 | Pang et al. | Dec 2009 | A1 |
| 20090319418 | Herz | Dec 2009 | A1 |
| 20090319891 | MacKinlay | Dec 2009 | A1 |
| 20090328222 | Helman et al. | Dec 2009 | A1 |
| 20100030722 | Goodson et al. | Feb 2010 | A1 |
| 20100031141 | Summers et al. | Feb 2010 | A1 |
| 20100042922 | Bradateanu et al. | Feb 2010 | A1 |
| 20100057622 | Faith et al. | Mar 2010 | A1 |
| 20100070842 | Aymeloglu et al. | Mar 2010 | A1 |
| 20100077481 | Polyakov et al. | Mar 2010 | A1 |
| 20100094765 | Nandy | Apr 2010 | A1 |
| 20100098318 | Anderson | Apr 2010 | A1 |
| 20100100963 | Mahaffey | Apr 2010 | A1 |
| 20100114887 | Conway et al. | May 2010 | A1 |
| 20100131502 | Fordham | May 2010 | A1 |
| 20100161735 | Sharma | Jun 2010 | A1 |
| 20100169192 | Zoldi et al. | Jul 2010 | A1 |
| 20100179831 | Brown et al. | Jul 2010 | A1 |
| 20100191563 | Schlaifer et al. | Jul 2010 | A1 |
| 20100235915 | Memon et al. | Sep 2010 | A1 |
| 20100262688 | Hussain et al. | Oct 2010 | A1 |
| 20100312837 | Bodapati et al. | Dec 2010 | A1 |
| 20100330801 | Rouh | Dec 2010 | A1 |
| 20110004626 | Naeymi-Rad et al. | Jan 2011 | A1 |
| 20110055074 | Chen et al. | Mar 2011 | A1 |
| 20110060910 | Gormish et al. | Mar 2011 | A1 |
| 20110061013 | Bilicki et al. | Mar 2011 | A1 |
| 20110078173 | Seligmann et al. | Mar 2011 | A1 |
| 20110093327 | Fordyce, III et al. | Apr 2011 | A1 |
| 20110099133 | Chang et al. | Apr 2011 | A1 |
| 20110099628 | Lanxner et al. | Apr 2011 | A1 |
| 20110131122 | Griffin et al. | Jun 2011 | A1 |
| 20110153384 | Horne et al. | Jun 2011 | A1 |
| 20110173093 | Psota et al. | Jul 2011 | A1 |
| 20110202555 | Cordover et al. | Aug 2011 | A1 |
| 20110208565 | Ross et al. | Aug 2011 | A1 |
| 20110213655 | Henkin | Sep 2011 | A1 |
| 20110218955 | Tang | Sep 2011 | A1 |
| 20110219450 | McDougal et al. | Sep 2011 | A1 |
| 20110225586 | Bentley et al. | Sep 2011 | A1 |
| 20110231305 | Winters | Sep 2011 | A1 |
| 20110270604 | Qi et al. | Nov 2011 | A1 |
| 20110270834 | Sokolan et al. | Nov 2011 | A1 |
| 20110289397 | Eastmond et al. | Nov 2011 | A1 |
| 20110295649 | Fine | Dec 2011 | A1 |
| 20110307382 | Siegel et al. | Dec 2011 | A1 |
| 20110314007 | Dassa et al. | Dec 2011 | A1 |
| 20110314024 | Chang et al. | Dec 2011 | A1 |
| 20120011238 | Rathod | Jan 2012 | A1 |
| 20120011245 | Gillette et al. | Jan 2012 | A1 |
| 20120022945 | Falkenborg et al. | Jan 2012 | A1 |
| 20120054284 | Rakshit | Mar 2012 | A1 |
| 20120059853 | Jagota | Mar 2012 | A1 |
| 20120066166 | Curbera et al. | Mar 2012 | A1 |
| 20120079363 | Folting et al. | Mar 2012 | A1 |
| 20120079592 | Pandrangi | Mar 2012 | A1 |
| 20120084117 | Tavares et al. | Apr 2012 | A1 |
| 20120084287 | Lakshminarayan et al. | Apr 2012 | A1 |
| 20120084866 | Stolfo | Apr 2012 | A1 |
| 20120110633 | An et al. | May 2012 | A1 |
| 20120110674 | Belani et al. | May 2012 | A1 |
| 20120131512 | Takeuchi et al. | May 2012 | A1 |
| 20120158585 | Ganti | Jun 2012 | A1 |
| 20120159362 | Brown et al. | Jun 2012 | A1 |
| 20120169593 | Mak et al. | Jul 2012 | A1 |
| 20120173381 | Smith | Jul 2012 | A1 |
| 20120215784 | King et al. | Aug 2012 | A1 |
| 20120218305 | Patterson et al. | Aug 2012 | A1 |
| 20120221553 | Wittmer et al. | Aug 2012 | A1 |
| 20120226523 | Weiss | Sep 2012 | A1 |
| 20120245976 | Kumar et al. | Sep 2012 | A1 |
| 20120254129 | Wheeler et al. | Oct 2012 | A1 |
| 20120278249 | Duggal et al. | Nov 2012 | A1 |
| 20120284791 | Miller et al. | Nov 2012 | A1 |
| 20120323888 | Osann, Jr. | Dec 2012 | A1 |
| 20120330801 | McDougal et al. | Dec 2012 | A1 |
| 20130016106 | Yip et al. | Jan 2013 | A1 |
| 20130019306 | Lagar-Cavilla et al. | Jan 2013 | A1 |
| 20130054306 | Bhalla | Feb 2013 | A1 |
| 20130057551 | Ebert et al. | Mar 2013 | A1 |
| 20130096988 | Grossman et al. | Apr 2013 | A1 |
| 20130097706 | Titonis | Apr 2013 | A1 |
| 20130097709 | Basavapatna et al. | Apr 2013 | A1 |
| 20130104236 | Ray | Apr 2013 | A1 |
| 20130110694 | Acuna-Rohter | May 2013 | A1 |
| 20130110746 | Ahn | May 2013 | A1 |
| 20130110876 | Meijer et al. | May 2013 | A1 |
| 20130139268 | An et al. | May 2013 | A1 |
| 20130151453 | Bhanot et al. | Jun 2013 | A1 |
| 20130166348 | Scotto | Jun 2013 | A1 |
| 20130166480 | Popescu et al. | Jun 2013 | A1 |
| 20130185245 | Anderson | Jul 2013 | A1 |
| 20130185307 | El-Yaniv et al. | Jul 2013 | A1 |
| 20130226318 | Procyk | Aug 2013 | A1 |
| 20130238616 | Rose et al. | Sep 2013 | A1 |
| 20130238664 | Hsu et al. | Sep 2013 | A1 |
| 20130239217 | Kindler et al. | Sep 2013 | A1 |
| 20130246170 | Gross et al. | Sep 2013 | A1 |
| 20130246537 | Gaddala | Sep 2013 | A1 |
| 20130246597 | Iizawa et al. | Sep 2013 | A1 |
| 20130262328 | Federgreen | Oct 2013 | A1 |
| 20130263019 | Castellanos et al. | Oct 2013 | A1 |
| 20130282696 | John et al. | Oct 2013 | A1 |
| 20130290825 | Arndt et al. | Oct 2013 | A1 |
| 20130297619 | Chandrasekaran et al. | Nov 2013 | A1 |
| 20130304770 | Boero et al. | Nov 2013 | A1 |
| 20130325826 | Agarwal et al. | Dec 2013 | A1 |
| 20140012724 | O'Leary et al. | Jan 2014 | A1 |
| 20140012796 | Petersen et al. | Jan 2014 | A1 |
| 20140013451 | Kulka et al. | Jan 2014 | A1 |
| 20140040371 | Gurevich et al. | Feb 2014 | A1 |
| 20140058914 | Song et al. | Feb 2014 | A1 |
| 20140059683 | Ashley | Feb 2014 | A1 |
| 20140068487 | Steiger et al. | Mar 2014 | A1 |
| 20140095363 | Caldwell | Apr 2014 | A1 |
| 20140095509 | Patton | Apr 2014 | A1 |
| 20140108380 | Gotz et al. | Apr 2014 | A1 |
| 20140108985 | Scott et al. | Apr 2014 | A1 |
| 20140123279 | Bishop et al. | May 2014 | A1 |
| 20140136285 | Carvalho | May 2014 | A1 |
| 20140143009 | Brice et al. | May 2014 | A1 |
| 20140156527 | Grigg et al. | Jun 2014 | A1 |
| 20140157172 | Peery et al. | Jun 2014 | A1 |
| 20140164502 | Khodorenko et al. | Jun 2014 | A1 |
| 20140173712 | Ferdinand | Jun 2014 | A1 |
| 20140173738 | Condry et al. | Jun 2014 | A1 |
| 20140188895 | Wang et al. | Jul 2014 | A1 |
| 20140189536 | Lange et al. | Jul 2014 | A1 |
| 20140195515 | Baker et al. | Jul 2014 | A1 |
| 20140222521 | Chait | Aug 2014 | A1 |
| 20140222752 | Isman et al. | Aug 2014 | A1 |
| 20140222793 | Sadkin et al. | Aug 2014 | A1 |
| 20140229422 | Jain et al. | Aug 2014 | A1 |
| 20140229554 | Grunin et al. | Aug 2014 | A1 |
| 20140282977 | Madhu | Sep 2014 | A1 |
| 20140283107 | Walton et al. | Sep 2014 | A1 |
| 20140344230 | Krause et al. | Nov 2014 | A1 |
| 20140358789 | Boding et al. | Dec 2014 | A1 |
| 20140358829 | Hurwitz | Dec 2014 | A1 |
| 20140359777 | Lam | Dec 2014 | A1 |
| 20140366132 | Stiansen et al. | Dec 2014 | A1 |
| 20150039565 | Lucas | Feb 2015 | A1 |
| 20150073929 | Psota et al. | Mar 2015 | A1 |
| 20150073954 | Braff | Mar 2015 | A1 |
| 20150095773 | Gonsalves et al. | Apr 2015 | A1 |
| 20150100897 | Sun et al. | Apr 2015 | A1 |
| 20150106379 | Elliot et al. | Apr 2015 | A1 |
| 20150121518 | Shmueli | Apr 2015 | A1 |
| 20150128274 | Giokas | May 2015 | A1 |
| 20150134512 | Mueller | May 2015 | A1 |
| 20150135256 | Hoy et al. | May 2015 | A1 |
| 20150161611 | Duke et al. | Jun 2015 | A1 |
| 20150163242 | Laidlaw | Jun 2015 | A1 |
| 20150188715 | Castelluci et al. | Jul 2015 | A1 |
| 20150188872 | White | Jul 2015 | A1 |
| 20150229664 | Hawthorn et al. | Aug 2015 | A1 |
| 20150248563 | Alfarano et al. | Sep 2015 | A1 |
| 20150261847 | Ducott et al. | Sep 2015 | A1 |
| 20150326601 | Grondin et al. | Nov 2015 | A1 |
| 20150338233 | Cervelli et al. | Nov 2015 | A1 |
| 20150379413 | Robertson et al. | Dec 2015 | A1 |
| 20150381649 | Schultz | Dec 2015 | A1 |
| 20160004764 | Chakerian et al. | Jan 2016 | A1 |
| 20160004864 | Falk et al. | Jan 2016 | A1 |
| 20160021139 | Stephan | Jan 2016 | A1 |
| 20160028759 | Visbal | Jan 2016 | A1 |
| 20160088000 | Siva Kumar | Mar 2016 | A1 |
| 20160099963 | Mahaffey | Apr 2016 | A1 |
| 20160226905 | Baikalov | Aug 2016 | A1 |
| 20170140663 | Sadeh-Koniecpol | May 2017 | A1 |
| 20170171231 | Reybok, Jr. et al. | Jun 2017 | A1 |
| 20170223030 | Merza | Aug 2017 | A1 |
| 20170244730 | Sancheti | Aug 2017 | A1 |
| 20170251006 | LaRosa | Aug 2017 | A1 |
| 20170251007 | Fujisawa | Aug 2017 | A1 |
| 20170251013 | Kirti | Aug 2017 | A1 |
| 20170324768 | Crabtree | Nov 2017 | A1 |
| 20180013771 | Crabtree | Jan 2018 | A1 |
| 20180091528 | Shahbaz | Mar 2018 | A1 |
| 20180103052 | Choudhury | Apr 2018 | A1 |
| 20180167402 | Scheidler | Jun 2018 | A1 |
| 20180183766 | Crabtree | Jun 2018 | A1 |
| 20180295154 | Crabtree | Oct 2018 | A1 |
| 20190089725 | Anachi | Mar 2019 | A1 |
| 20190089727 | Mulchandani | Mar 2019 | A1 |
| Number | Date | Country |
|---|---|---|
| 101729531 | Jun 2010 | CN |
| 102546446 | Jul 2012 | CN |
| 103167093 | Jun 2013 | CN |
| 103281301 | Sep 2013 | CN |
| 102054015 | May 2014 | CN |
| 102014204827 | Sep 2014 | DE |
| 102014204830 | Sep 2014 | DE |
| 102014204834 | Sep 2014 | DE |
| 1962222 | Aug 2008 | EP |
| 2487610 | Aug 2012 | EP |
| 2858018 | Apr 2015 | EP |
| 2869211 | May 2015 | EP |
| 2889814 | Jul 2015 | EP |
| 2892197 | Jul 2015 | EP |
| 2897051 | Jul 2015 | EP |
| 2963578 | Jan 2016 | EP |
| 2963595 | Jan 2016 | EP |
| 2985974 | Feb 2016 | EP |
| 3343868 | Jul 2018 | EP |
| 2011642 | Aug 2015 | NL |
| WO 2005010685 | Feb 2005 | WO |
| WO 2005116851 | Dec 2005 | WO |
| Entry |
|---|
| Official Communication for European Patent Application No. 17209693.5 dated Feb. 13, 2019. |
| Amnet, “5 Great Tools for Visualizing Your Twitter Followers,” posted Aug. 4, 2010, http://www.amnetblog.com/component/content/article/115-5-grate-tools-for-visualizing-your-twitter-followers.html. |
| Appacts, “Smart Thinking for Super Apps,” <http://www.appacts.com> Printed Jul. 18, 2013 in 4 pages. |
| Apsalar, “Data Powered Mobile Advertising,” “Free Mobile App Analytics” and various analytics related screen shots <http://apsalar.com> Printed Jul. 18, 2013 in 8 pages. |
| Capptain—Pilot Your Apps, <http://www.capptain.com> Printed Jul. 18, 2013 in 6 pages. |
| Celik, Tantek, “CSS Basic User Interface Module Level 3 (CSS3 UI),” Section 8 Resizing and Overflow, Jan. 17, 2012, retrieved from internet http://www.w3.org/TR/2012/WD-css3-ui-20120117/#resizing-amp-overflow retrieved on May 18, 2015. |
| Chaudhuri et al., “An Overview of Business Intelligence Technology,” Communications of the ACM, Aug. 2011, vol. 54, No. 8. |
| Cohn, et al., “Semi-supervised clustering with user feedback,” Constrained Clustering: Advances in Algorithms, Theory, and Applications 4.1 (2003): 17-32. |
| Countly Mobile Analytics, <http://count.ly/> Printed Jul. 18, 2013 in 9 pages. |
| Distimo—App Analytics, <http://www.distimo.com/app-analytics> Printed Jul. 18, 2013 in 5 pages. |
| Flurry Analytics, <http://www.flurry.com/> Printed Jul. 18, 2013 in 14 pages. |
| Google Analytics Official Website—Web Analytics & Reporting, <http://www.google.com/analytics.index.html> Printed Jul. 18, 2013 in 22 pages. |
| Gorr et al., “Crime Hot Spot Forecasting: Modeling and Comparative Evaluation”, Grant 98-IJ-CX-K005, May 6, 2002, 37 pages. |
| Gu et al., “Record Linkage: Current Practice and Future Directions,” Jan. 15, 2004, pp. 32. |
| Hansen et al., “Analyzing Social Media Networks with NodeXL: Insights from a Connected World”, Chapter 4, pp. 53-67 and Chapter 10, pp. 143-164, published Sep. 2010. |
| Hua et al., “A Multi-attribute Data Structure with Parallel Bloom Filters for Network Services”, HiPC 2006, LNCS 4297, pp. 277-288, 2006. |
| “HunchLab: Heat Map and Kernel Density Calculation for Crime Analysis,” Azavea Journal, printed from www.azavea.com/blogs/newsletter/v4i4/kernel-density-capabilities-added-to-hunchlab/ on Sep. 9, 2014, 2 pages. |
| Keylines.com, “An Introduction to KeyLines and Network Visualization,” Mar. 2014, <http://keylines.com/wp-content/uploads/2014/03/KeyLines-White-Paper.pdf> downloaded May 12, 2014 in 8 pages. |
| Keylines.com, “KeyLines Datasheet,” Mar. 2014, <http://keylines.com/wp-content/uploads/2014/03/KeyLines-datasheet.pdf> downloaded May 12, 2014 in 2 pages. |
| Keylines.com, “Visualizing Threats: Improved Cyber Security Through Network Visualization,” Apr. 2014, <http://keylines.com/wp-content/uploads/2014/04/Visualizing-Threats1.pdf> downloaded May 12, 2014 in 10 pages. |
| Kontagent Mobile Analytics, <http://www.kontagent.com/> Printed Jul. 18, 2013 in 9 pages. |
| Localytics—Mobile App Marketing & Analytics, <http://www.localytics.com/> Printed Jul. 18, 2013 in 12 pages. |
| Manno et al., “Introducing Collaboration in Single-user Applications through the Centralized Control Architecture,” 2010, pp. 10. |
| Mixpanel—Mobile Analytics, <https://mixpanel.com/> Printed Jul. 18, 2013 in 13 pages. |
| Open Web Analytics (OWA), <http://www.openwebanalytics.com/> Printed Jul. 19, 2013 in 5 pages. |
| Piwik—Free Web Analytics Software. <http://piwik.org/> Printed Jul. 19, 2013 in18 pages. |
| “Refresh CSS Ellipsis When Resizing Container—Stack Overflow,” Jul. 31, 2013, retrieved from internet http://stackoverflow.com/questions/17964681/refresh-css-ellipsis-when-resizing-container, retrieved on May 18, 2015. |
| Sigrist, et al., “PROSITE, a Protein Domain Database for Functional Characterization and Annotation,” Nucleic Acids Research, 2010, vol. 38, pp. D161-D166. |
| StatCounter—Free Invisible Web Tracker, Hit Counter and Web Stats, <http://statcounter.com/> Printed Jul. 19, 2013 in 17 pages. |
| TestFlight—Beta Testing on the Fly, <http://testflightapp.com/> Printed Jul. 18, 2013 in 3 pages. |
| trak.io, <http://trak.io/> printed Jul. 18, 2013 in 3 pages. |
| UserMetrix, <http://usermetrix.com/android-analytics> printed Jul. 18, 2013 in 3 pages. |
| Valentini et al., “Ensembles of Learning Machines”, M. Marinaro and R. Tagliaferri (Eds.): WIRN VIETRI 2002, LNCS 2486, pp. 3-20. |
| Vose et al., “Help File for ModelRisk Version 5,” 2007, Vose Software, pp. 349-353. [Uploaded in 2 Parts]. |
| Wang et al., “Research on a Clustering Data De-Duplication Mechanism Based on Bloom Filter,” IEEE 2010, 5 pages. |
| Wikipedia, “Multimap,” Jan. 1, 2013, https://en.wikipedia.org/w/index.php?title-Multimap&oldid=530800748. |
| Official Communication for European Patent Application No. 17209693.5 dated Feb. 5, 2018. |
| Baker et al., “The Development of a Common Enumeration of Vulnerabilities and Exposures,” Presented at the Second International Workshop on Recent Advances in Intrusion Detection, Sep. 7-9, 1999, pp. 35. |
| Bhuyan et al., “Network Anomaly Detection: Methods, Systems and Tools,” First Quarter 2014, IEEE. |
| Crosby et al., “Efficient Data Structures for Tamper-Evident Logging,” Department of Computer Science, Rice University, 2009, pp. 17. |
| FireEye—Products and Solutions Overview, <http://www.fireeye.com/products-and-solutions> Printed Jun. 30, 2014 in 3 pages. |
| FireEye, <http://www.fireeye.com/> Printed Jun. 30, 2014 in 2 pages. |
| Glaab et al., “EnrichNet: Network-Based Gene Set Enrichment Analysis,” Bioinformatics 28.18 (2012): pp. i451-i457. |
| Hur et al., “SciMiner: web-based literature mining tool for target identification and functional enrichment analysis,” Bioinformatics 25.6 (2009): pp. 838-840. |
| Lee et al., “A Data Mining and CIDF Based Approach for Detecting Novel and Distributed Intrusions,” Lecture Notes in Computer Science, vol. 1907 Nov. 11, 2000, pp. 49-65. |
| Ma et al., “A New Approach to Secure Logging,” ACM Transactions on Storage, vol. 5, No. 1, Article 2, Published Mar. 2009, 21 pages. |
| Schneier et al., “Automatic Event Stream Notarization Using Digital Signatures,” Security Protocols, International Workshop Apr. 1996 Proceedings, Springer-Veriag, 1997, pp. 155-169, https://schneier.com/paper-event-stream.pdf. |
| Schneier et al., “Cryptographic Support for Secure Logs on Untrusted Machines,” The Seventh USENIX Security Symposium Proceedings, USENIX Press, Jan. 1998, pp. 53-62, https://www.schneier.com/paper-secure-logs.pdf. |
| VirusTotal—About, <http://www.virustotal.com/en/about/> Printed Jun. 30, 2014 in 8 pages. |
| Waters et al., “Building an Encrypted and Searchable Audit Log,” Published Jan. 9, 2004, 11 pages, http://www.parc.com/content/attachments/building_encrypted_searchable_5059_parc.pdf. |
| Zheng et al., “GOEAST: a web-based software toolkit for Gene Ontology enrichment analysis,” Nucleic acids research 36.suppl 2 (2008): pp. W385-W363. |
| U.S. Appl. No. 15/796,529, Context-Aware Network-Based Malicious Activity Warning Systems, filed Oct. 27, 2017. |
| Number | Date | Country | |
|---|---|---|---|
| 20180183827 A1 | Jun 2018 | US |
| Number | Date | Country | |
|---|---|---|---|
| 62439712 | Dec 2016 | US |
