Systems and methods for correlating and distributing intrusion alert information among collaborating computer systems

• US 10,038,704 B2
• Filed: 09/04/2015
• Issued: 07/31/2018
• Est. Priority Date: 05/11/2004
• Status: Active Grant

• Current Assignee: Trustees Of Columbia University In The City Of New York (Columbia University)
• Original Assignee: Trustees Of Columbia University In The City Of New York (Columbia University)
• Inventors: Stolfo, Salvatore J., Malkin, Tal, Keromytis, Angelos D., Misra, Vishal, Locasto, Michael, Parekh, Janak
• Primary Examiner(s): Homayounmehr, Farid
• Assistant Examiner(s): Harris, Christopher C
• Application Number:
  US14/846,188
• Publication Number:
  US 20150381639A1
• Time in Patent Office: 1,061 Days
• Field of Search: None
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/1475 Passive attacks, e.g. eavesdropping or listening without modification of the traffic monitored
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

Systems and methods for correlating and distributing intrusion alert information among collaborating computer systems are provided. These systems and methods provide an alert correlator and an alert distributor that enable early signs of an attack to be detected and rapidly disseminated to collaborating systems. The alert correlator utilizes data structures to correlate alert detections and provide a mechanism through which threat information can be revealed to other collaborating systems. The alert distributor uses an efficient technique to group collaborating systems and then pass data between certain members of those groups according to a schedule. In this way data can be routinely distributed without generating excess traffic loads.

Claims

1. A method of detecting a threat to a computer system in a plurality of collaborating computer systems, the method comprising:

receiving, at a first computer system, a first bloom filter from a collaborating second computer system, the first bloom filter representing encrypted first data relating to a source of a first intrusion attempt detected by an intrusion detection system of the collaborating second computer system;

detecting, by the first computer system, a second intrusion attempt;

producing a second bloom filter by performing a cryptographic function on second data relating to a source of the second intrusion attempt that results in an output value having a plurality of digits and using a subset of the plurality of digits of the output value as an index to the second bloom filter, wherein the subset does not include all of the plurality of digits of the output value;

determining whether the second intrusion attempt correlates with the first intrusion attempt by comparing the first bloom filter and the second bloom filter; and

indicating that a threat is present if the second intrusion attempt is determined to correlate with the first intrusion attempt,

wherein receiving the first bloom filter from the collaborating second computer system comprises;

grouping the collaborating second computer system and other collaborating systems into groups so that each collaborating system in a group occupies a position in that group;

exchanging bloom filters between collaborating systems in the same position in the different groups; and

rotating the position occupied by each member of at least one of the groups according to a schedule.

2. The method of claim 1, wherein the encrypted first data relates to the source of the first intrusion attempt through a hash function.

3. The method of claim 1, wherein the cryptographic function is a hash function.

4. The method of claim 1, wherein the cryptographic function is an encryption function.

5. A system of detecting a threat to a computer system in a plurality of collaborating computer systems, the system comprising:

at least a portion of a communication network;

a first computer system that is coupled to the at least a portion of the communication network and that is configured to;

receive a first bloom filter from a collaborating second computer system, the first bloom filter representing encrypted first data relating to a source of a first intrusion attempt detected by an intrusion detection system of the collaborating second computer system;

detect a second intrusion attempt;

produce a second bloom filter by performing a cryptographic function on second data relating to a source of the second intrusion attempt that results in an output value having a plurality of digits and using a subset of the plurality of digits of the output value as an index to the second bloom filter, wherein the subset does not include all of the plurality of digits of the output value;

determine whether the second intrusion attempt correlates with the first intrusion attempt by comparing the first bloom filter and the second bloom filter; and

indicate that a threat is present if the second intrusion attempt is determined to correlate with the first intrusion attempt,

wherein when receiving the first bloom filter from the collaborating second computer system, the first computer system is configured to;

group the collaborating second computer system and other collaborating systems into groups so that each collaborating system in a group occupies a position in that group;

exchange bloom filters between collaborating systems in the same position in the different groups; and

rotating the position occupied by each member of at least one of the groups according to a schedule.

6. The system of claim 5, wherein the encrypted first data relates to the source of the first intrusion attempt through a hash function.

7. The system of claim 5, wherein the cryptographic function is a hash function.

8. The system of claim 5, wherein the cryptographic function is an encryption function.

9. A non-transitory computer readable medium containing computer executable instructions that, when executed by a processor, cause the processor to perform a method of detecting a threat to a computer system in a plurality of collaborating computer systems, the method comprising:

receiving, at a first computer system, a first bloom filter from a collaborating second computer system, the first bloom filter representing encrypted first data relating to a source of a first intrusion attempt detected by an intrusion detection system of the collaborating second computer system;

detecting, by the first computer system, a second intrusion attempt;

producing a second bloom filter by performing a cryptographic function on second data relating to a source of the second intrusion attempt that results in an output value having a plurality of digits and using a subset of the plurality of digits of the output value as an index to the second bloom filter, wherein the subset does not include all of the plurality of digits of the output value;

determining whether the second intrusion attempt correlates with the first intrusion attempt by comparing the first bloom filter and the second bloom filter; and

indicating that a threat is present if the second intrusion attempt is determined to correlate with the first intrusion attempt,

wherein receiving the first bloom filter from the collaborating second computer system comprises;

grouping the collaborating second computer system and other collaborating systems into groups so that each collaborating system in a group occupies a position in that group;

exchanging bloom filters between collaborating systems in the same position in the different groups; and

rotating the position occupied by each member of at least one of the groups according to a schedule.

10. The non-transitory computer readable medium of claim 9, wherein the encrypted first data relates to the source of the first intrusion attempt through a hash function.

11. The non-transitory computer readable medium of claim 9, wherein the cryptographic function is a hash function.

12. The non-transitory computer readable medium of claim 9, wherein the cryptographic function is an encryption function.