Scalable network security with fast response protocol

• US 10,432,674 B1
• Filed: 09/01/2017
• Issued: 10/01/2019
• Est. Priority Date: 02/01/2012
• Status: Active Grant

• Current Assignee: ServiceNow Incorporated
• Original Assignee: ServiceNow Incorporated
• Inventors: Haugsnes, Andreas Seip, Hahn, Markus
• Primary Examiner(s): Hirl, Joseph P
• Assistant Examiner(s): Shirazi, Sayed Aresh Beheshti
• Application Number:
  US15/694,166
• Time in Patent Office: 760 Days
• CPC Class Codes: G06F 16/23 Updating
• CPC Class Codes: G06F 16/245 Query processing
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud

Abstract

This disclosure provides a network security architecture that permits installation of different software security products as virtual machines (VMs). By relying on a standardized data format and communication structure, a general architecture can be created and used to dynamically build and reconfigure interaction between both similar and dissimilar security products. Use of an integration scheme having defined message types and specified query response framework provides for real-time response and easy adaptation for cross-vendor communication. Examples are provided where an intrusion detection system (IDS) can be used to detect network threats based on distributed threat analytics, passing detected threats to other security products (e.g., products with different capabilities from different vendors) to trigger automatic, dynamically configured communication and reaction. A network security provider using this infrastructure can provide hosted or managed boundary security to a diverse set of clients, each on a customized basis.

Claims

1. An apparatus comprising instructions stored on computer readable storage, the apparatus adapted to receive a query related to a possible network security threat, the instructions when executed operable to cause at least one computer to:

receive an indication indicating whether the query is required to be returned within a predetermined time limit;

in response to the indication indicating that the query is not required to be returned within the predetermined time limit, synchronously retrieve a result to the query, provide the result in a response, and update a local cached storage;

in response to the indication indicating that the query is required to be returned within the predetermined time limit, determine whether the query is of a first type, that can be answered by the local cached storage, or of a second type, that cannot be answered by the local cached storage;

if the query is of the first type, service the query with information from the local cached storage by providing a response to the query within the predetermined time limit; and

if the query is of the second type;

do not respond to the query or respond with a null response, indicating that the query cannot be answered by the local cached storage;

forward the query to at least one other information source for response data;

receive the response data from the at least one other information source; and

asynchronously update the local cached storage to contain the response data, such that subsequent queries associated with the query are able to be satisfied by the local cached storage.

2. The apparatus of claim 1, wherein the query specifies an identifier of the possible network security threat.

3. The apparatus of claim 2, wherein the response data is to be received by the at least one computer via a wide area network connection using a transmission control protocol, and wherein the instructions when executed are further to cause the at least one computer to respond to the query specifying the identifier also via the wide area network connection also using a transmission control protocol.

4. The apparatus of claim 1, wherein the instructions to forward the query to the at least one other information source comprise instructions to transmit the query to multiple destinations using a broadcast transmission format.

5. The apparatus of claim 2, wherein the instructions cause the at least one computer to respond to the query specifying the identifier in a manner which includes a network address representing a threat source associated with the possible network security threat.

6. The apparatus of claim 2, wherein the instructions when executed are further to cause the at least one computer to respond to the query specifying the identifier in a manner which identifies a domain representing a threat source associated with the possible network security threat.

7. The apparatus of claim 2, wherein the instructions when executed are further to cause the at least one computer to:

compare at least one of the information on hand, if available, with a threshold or a response from a source of the one or more other information sources with the threshold; and

respond to the query by specifying the identifier based at least in part on a result of the comparison.

8. The apparatus of claim 2, wherein the instructions, when executed, are further to cause the at least one computer to respond to the query specifying the identifier in such a way as to convey a link to a network resource that possesses more detailed information regarding the possible network security threat.

9. The apparatus of claim 1, wherein the query comprises an intrusion detection system (IDS) query.

10. The apparatus of claim 1, wherein the local cached storage comprises a cache implemented in random access memory.

11. The apparatus of claim 1, wherein the local cached storage comprises multiple partitions.

12. The apparatus of claim 11, wherein the multiple partitions comprise a level one (L1) cache and a level two (L2) cache, and wherein the update to the local cached storage is stored in the L2 cache.

13. A computer-implemented method, comprising:

receiving a query that specifies an identifier of a possible network security threat;

receiving an indication indicating whether the query is required to be returned within a predetermined time limit;

in response to the indication indicating that the query is not required to be returned within the predetermined time limit, synchronously retrieving a result to the query, providing the result in a response, and updating a local cached storage;

in response to the indication indicating that the query is required to be returned within the predetermined time limit, determining whether the query is of a first type, that can be answered by the local cached storage, or of a second type, that cannot be answered by the local cached storage;

if the query is of the first type, servicing the query with information from the local cached storage by providing a response to the query within the predetermined time limit; and

if the query is of the second type;

not responding to the query or responding with a null response, indicating that the query cannot be answered by the local cached storage;

forwarding the query to at least one other information source for response data;

receiving the response data from the at least one other information source; and

asynchronously updating the local cached storage to contain the response data, such that subsequent queries associated with the query are able to be satisfied by the local cached storage.

14. The computer-implemented method of claim 13, comprising:

forwarding the query to the at least one other information source comprising instructions to transmit the query to multiple destinations using a broadcast transmission format.

15. The computer-implemented method of claim 13, comprising:

responding to the query by specifying the identifier in a manner which includes a network address representing a threat source associated with the possible network security threat.

16. The computer-implemented method of claim 13, comprising:

responding to the query by specifying the identifier in a manner which identifies a domain representing a threat source associated with the possible network security threat.

17. A tangible, non-transitory, machine-readable medium, comprising machine-readable instructions that, when executed by one or more processors, cause the one or more processors to:

receive a query that specifies an identifier of a possible network security threat;

receive an indication indicating whether the query is required to be returned within a predetermined time limit;

in response to the indication indicating that the query is not required to be returned within the predetermined time limit, synchronously retrieve a result to the query, provide the result in a response, and update a local cached storage;

in response to the indication indicating that the query is required to be returned within the predetermined time limit, determine whether the query is of a first type, that can be answered by the local cached storage, or of a second type, that cannot be answered by the local cached storage;

if the query is of the first type, servicing the query with information from the local cached storage by providing a response to the query within the predetermined time limit; and

if the query is of the second type;

do not respond to the query or respond with a null response, indicating that the query cannot be answered by the local cached storage;

forward the query to at least one other information source for response data;

receive the response data from the at least one other information source; and

asynchronously update the local cached storage to contain the response data, such that subsequent queries associated with the query are able to be satisfied by the local cached storage.

18. The machine-readable medium of claim 17, comprising machine-readable instructions that, when executed by the one or more processors, cause the one or more processors to:

forward the query to the at least one other information source comprising instructions to transmit the query to multiple destinations using a broadcast transmission format.

19. The machine-readable medium of claim 17, comprising machine-readable instructions that, when executed by the one or more processors, cause the one or more processors to:

respond to the query by specifying the identifier in a manner which includes a network address, a domain, or both, representing a threat source associated with the possible network security threat.