Methods and systems for improving analytics in distributed networks

• US 10,193,929 B2
• Filed: 03/13/2015
• Issued: 01/29/2019
• Est. Priority Date: 03/13/2015
• Status: Active Grant

• Current Assignee: vArmour Networks Inc
• Original Assignee: vArmour Networks Inc
• Inventors: Shieh, Choung-Yaw, Chou, Tony Wing Fai
• Primary Examiner(s): Lwin, Maung T
• Application Number:
  US14/657,210
• Publication Number:
  US 20160269442A1
• Time in Patent Office: 1,418 Days
• Field of Search: None
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Systems and methods for improving analytics in a distributed network are described herein. An example system includes at least one processor, an analytics module, and a security policy module. The security policy module is operable to define a security policy. The security policy is executed by the processor on a network packet. Furthermore, the processor collects network information from the network packet. The analytics module is operable to analyze the network information with additional group information from the security policy. The analysis is used by the processor to generate the result. Based on the generated result, the security policy module updates the security policy.

Claims

1. A system for improving analytics in a distributed network, the system comprising:

a hardware processor executing instructions stored in memory, the instructions comprising;

executing a security policy on a network packet;

collecting network information from the network packet;

generating a result from an analysis;

analyzing the network information with additional group information from the security policy, the analyzing including examining communications including network packets between at least some hosts in a group, the analyzing further including identifying patterns indicative of malicious activity in the communications;

in response to the analyzing, defining a second security policy, the second security policy applying to the group, each host of the group having a similar security attribute associated with group security attributes of the group;

updating the security policy based on the generated result, the updating the security policy including at least one of;

performing deep packet inspection on the communications, and

blocking network communications to an infected host in the group;

collecting at least one of application metadata, application information, and contextual information related to an application associated with another host in the group; and

providing the collected information;

wherein analyzing the network information correlated with the security policy includes;

analyzing network packets between a first host in the group and a second host in the group;

analyzing network packets between a third host in the group and a fourth host in a second group; and

analyzing connections between the group and the second group;

wherein the network information from the network packets regarding a current state of the distributed network is dynamic and changing over time.

2. The system of claim 1, wherein the the instructions further comprise extracting group information from the security policy, the group information including the group security attributes associated with the group.

3. The system of claim 1, wherein the updating the security policy based on the generated result includes:

permitting or denying a connection; and

modifying security system parameters for the group.

4. The system of claim 1, wherein the analyzing the network information correlated with the security policy includes at least one of the following:

determining Domain Name Server (DNS) information for the network packet;

based on the DNS information, determining if a Domain Generation Algorithm (DGA) was used to generate a domain name of a domain associated with the network packet; and

based on log information associated with the group, checking the network information for security threats.

5. The system of claim4, wherein the result includes at least one of the following:

determining that the domain associated with the network packet is valid;

determining that the domain associated with the network packet is invalid; and

determining that the domain associated with the network packet requires an elevated scrutiny.

6. The system of claim 5, wherein the elevated scrutiny includes applying a packet capture (PCAP) to further network packets associated with the domain.

7. The system of claim 1, wherein the generating of the result related to the network packet is based on log information associated with the group.

8. The system of claim 1, wherein the updating the security policy based on the generated result includes one or more of the following:

generating an enforcement policy associated with the group;

collecting Packet Capture (PCAP) to analyze contents of the network packet associated with the group; and

modifying a monitoring policy associated with the group.

9. A method for improving analytics in a distributed network, the method comprising:

defining a security policy, the security policy applying to a group, each host of the group having a similar security attribute associated with group security attributes of the group;

executing the security policy on a network packet;

collecting network information from the network packet;

analyzing the network information with additional group information from the security policy, the analyzing including examining communications including network packets between at least some hosts in the group, the examining including identifying patterns indicative of malicious activity in the communications;

generating a result from the analysis;

updating the security policy based on the generated result, the updating the security policy including at least one of;

performing deep packet inspection on the communications, and

blocking network communications to an infected host in the group;

collecting at least one of application metadata, application information, and contextual information related to an application associated with another host in the group; and

providing the collected information for the analysis;

wherein the analyzing the network information includes;

analyzing network packets between a first host in the group and a second host in the group;

analyzing network packets between a third host in the group and a fourth host in a second group; and

analyzing connections between the group and the second group;

wherein the network information from the network packets regarding a current state of the distributed network is dynamic and changing over time.

10. The method of claim 9, further comprising extracting group information from the security policy, the group information including the group security attributes associated with the group.

11. The method of claim 9, wherein the updating the security policy includes:

permitting or denying a connection; and

modifying security system parameters for the group.

12. The method of claim 9, wherein the analyzing includes at least one of the following:

determining Domain Name System (DNS) information for the network packet;

based on the DNS information, determining if a Domain Generation Algorithm (DGA) was used to generate a domain name of a domain associated with the network packet; and

based on log information associated with the group, checking the network information for security threats.

13. The method of claim 12, wherein the result includes at least one of the following:

determining that the domain associated with the network packet is valid;

determining that the domain associated with the network packet is invalid; and

determining that the domain associated with the network packet requires an elevated scrutiny.

14. The method of claim 13, wherein the elevated scrutiny includes applying a packet capture (PCAP) to further network packets associated with the domain.

15. The method of claim 9, wherein the updating the security policy includes one or more of the following:

generating an enforcement policy associated with the group;

collecting Packet Capture (PCAP) to analyze contents of the network packet associated with the group; and

modifying a monitoring policy associated with the at least one group.

16. A system for improving analytics in a distributed network, the system comprising:

a hardware processor executing instructions stored in memory, the instructions comprising;

executing a security policy on a network packet, wherein the security policy is associated with a group;

collecting network information from the network packet;

generating a result from an analysis;

performing the analysis, the analysis including analyzing the network information with additional group information from the security policy, the analyzing including examining communications including network packets between at least some hosts in a group, the analyzing further including identifying patterns indicative of malicious activity in the communications, wherein the analyzing includes at least one of;

determining Domain Name System (DNS) information for the network packet;

based on the DNS information, determining if a Domain Generation Algorithm (DGA) was used to generate a domain name of a domain associated with the network packet; and

based on log information associated with at least one group, checking the network information for security threats;

defining the security policy, the security policy applying to the group, each host of the group having a similar security attribute associated with group security attributes of the group;

updating the security policy based on the generated result, wherein the updating includes at least one of;

performing deep packet inspection on the communications;

blocking network communications to an infected host in the group;

generating an enforcement policy associated with the group;

applying Packet Capture (PCAP) to analyze contents of the network packet associated with at least one group; and

modifying a monitoring policy associated with the group;

collecting at least one of application metadata, application information, and contextual information related to an application associated with another host in the group; and

providing the collected information;

wherein analyzing the network information correlated with the security policy includes;

analyzing network packets between a first host in the group and a second host in the group;

analyzing network packets between a third host in the group and a fourth host in a second group; and

analyzing connections between the group and the second group;

wherein the network information from the network packets regarding a current state of the distributed network is dynamic and changing over time.