Predicting and preventing an attacker's next actions in a breached network

• US 10,097,577 B2
• Filed: 08/22/2017
• Issued: 10/09/2018
• Est. Priority Date: 06/08/2015
• Status: Active Grant

• Current Assignee: illusive networks LTD.
• Original Assignee: illusive networks LTD.
• Inventors: Touboul, Shlomo, Levin, Hanan, Roubach, Stephane, Mischari, Assaf, Ben David, Itai, Avraham, Itay, Ozer, Adi, Kazaz, Chen, Israeli, Ofer, Vingurt, Olga, Gareh, Liad, Grimberg, Israel, Cohen, Cobby, Sultan, Sharon, Kubovsky, Matan
• Primary Examiner(s): HOLDER, BRADLEY W
• Application Number:
  US15/682,577
• Publication Number:
  US 20180020022A1
• Time in Patent Office: 413 Days
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: H04L 2463/146 Tracing the source of attacks
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method for cyber security, including detecting, by a management server, a breach by an attacker of a resource within a network of resources, predicting, by the management server, an attacker target subnet, based on connections created during the breach, and isolating, by the management server, the target subnet in response to the predicting a target subnet.

Claims

1. A method for cyber security for a network of resources, wherein access to the resources via network connections that extend outside the network is governed by a firewall, the method comprising:

detecting, by a management server, a breach by an attacker of a resource within a network of resources;

predicting, by the management server, the attacker'"'"'s target network subnet, based on network connections created by the attacker during the detected breach;

isolating, by the management server, the predicted attacker'"'"'s target network subnet in response to said predicting the attacker'"'"'s target network subnet;

predicting, by the management server, data leakage paths from inside the network to outside the network, based on an outbound network connection opened by the attacker and detected by the management server, during the breach; and

creating, by the management server, firewall rules to re-direct the outbound network connection opened by the attacker to a resource within the network, in response to said predicting the data leakage paths, wherein the re-directed outbound network connection to a resource within the network appears to the attacker to be the attacker'"'"'s intended outbound network connection to the attacker'"'"'s intended destination outside the network.

2. The method of claim 1 comprising creating, by the management server, firewall rules to block the attacker-created outbound network connection in response to said predicting the data leakage paths.

3. A method for cyber security for a network of resources, wherein access to the resources via network connections that extend outside the network is governed by a firewall, the method comprising:

detecting, by a management server, a breach by an attacker of a resource within a network of resources, wherein access to the resources via network connections is governed by a firewall;

predicting, by the management server, which resources of the network were exposed to the attacker, based on address pointers stored on the breached resource;

creating, by the management server, firewall rules to block access to the predicted attacker exposed resources from the breached resource, in response to said predicting which resources of the network were exposed to the attacker;

predicting, by the management server, data leakage paths from inside the network to outside the network, based on an outbound network connection opened by the attacker and detected by the management server, during the breach; and

creating, by the management server, firewall rules to re-direct the outbound network connection opened by the attacker to a resource within the network, in response to said predicting the data leakage paths, wherein the re-directed outbound network connection to a resource within the network appears to the attacker to be the attacker'"'"'s intended outbound network connection to the attacker'"'"'s intended destination outside the network.

4. The method of claim 3 comprising creating, by the management server, firewall rules to block the attacker-created outbound network connection in response to said predicting the data leakage paths.