Collaborative and adaptive threat intelligence for computer security

• US 10,469,514 B2
• Filed: 06/18/2015
• Issued: 11/05/2019
• Est. Priority Date: 06/23/2014
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Inventors: Wang, Jisheng, Shen, Min-yi, Palkar, Prasad, Ramachandran, Sriram
• Primary Examiner(s): Pwu, Jeffrey C
• Assistant Examiner(s): Tran, Baotram
• Application Number:
  US14/743,875
• Publication Number:
  US 20150373043A1
• Time in Patent Office: 1,601 Days
• Field of Search: None
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/6254 by anonymising data, e.g. decorrelating personal data from the owner's identification
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Collaborative and adaptive threat intelligence. Data collected on a first customer network is received. One or more local models are trained with at least the received data, where the one or more local models are related to security. An amount of data to transmit to a centralized controller is determined based at least on a result of the training one or more local models and the determined amount of data is transmitted to the centralized controller. Result data is received from the centralized controller that is a result of one or more global models trained on the centralized controller using data collected on multiple customer networks including the first customer network. The one or more local models are adjusted using the received result data and the one or more adjusted local models are trained.

Claims

1. A method for collaborative and adaptive threat intelligence, comprising:

receiving data collected on a first customer network;

training one or more local models with at least the received data, wherein the one or more local models are related to security;

determining an amount of data to transmit to a centralized controller based at least on a result of the training one or more local models;

transmitting the determined amount of data to the centralized controller;

receiving, from the centralized controller, result data that is a result of one or more global models trained on the centralized controller using data collected on a plurality of customer networks including the first customer network;

adjusting the one or more local models using the received result data, wherein the result data includes information specifying a feature modification of a feature of the one or more local models, and wherein adjusting the one or more local models includes modifying the feature of the one or more local models in accordance with the specified feature modification;

training the one or more adjusted local models; and

prior to transmitting the determined amount of data to the centralized controller, anonymizing at least a portion of that determined amount of data;

wherein anonymizing at least a portion of the determined amount of data includes removing or obfuscating one or more of the following attributes in the data;

username, Internet Protocol (IP) address, home address, social security number, credit card number, email address, and name.

2. The method of claim 1, wherein the result data received from the centralized controller includes one or more probability threat scores for one or more features respectively.

3. The method of claim 2, wherein adjusting the one or more local models includes using the received one or more probability threat scores as input into the one or more local models.

4. The method of claim 2, further comprising:

adjusting the one or more probability threat scores based at least on the received data collected on the first customer network; and

wherein adjusting the one or more local models includes using the adjusted one or more probability threat scores as input into the one or more local models.

5. The method of claim 1, wherein the training of the one or more local models is performed in accordance with machine learning methods based on at least the received data, and wherein the one or more global models are trained in accordance with machine learning methods.

6. A non-transitory machine-readable storage medium that provides instructions that, if executed by a processor, will cause said processor to perform operations comprising:

receiving data collected on a first customer network;

training one or more local models with at least the received data, wherein the one or more local models are related to security;

determining an amount of data to transmit to a centralized controller based at least on a result of the training one or more local models;

transmitting the determined amount of data to the centralized controller;

receiving, from the centralized controller, result data that is a result of one or more global models trained on the centralized controller using data collected on a plurality of customer networks including the first customer network;

adjusting the one or more local models using the received result data, wherein the result data includes information specifying a feature modification of a feature of the one or more local models, and wherein adjusting the one or more local models includes modifying the feature of the one or more local models in accordance with the specified feature modification;

training the one or more adjusted local models; and

prior to transmitting the determined amount of data to the centralized controller, anonymizing at least a portion of that determined amount of data;

wherein anonymizing at least a portion of the determined amount of data includes removing or obfuscating one or more of the following attributes in the data;

username, Internet Protocol (IP) address, home address, social security number, credit card number, email address, and name.

7. The non-transitory machine-readable storage medium of claim 6, wherein the result data received from the centralized controller includes one or more probability threat scores for one or more features respectively.

8. The non-transitory machine-readable storage medium of claim 7, wherein adjusting the one or more local models includes using the received one or more probability threat scores as input into the one or more local models.

9. The non-transitory machine-readable storage medium of claim 7, wherein the non-transitory machine-readable storage medium further provides instructions that, if executed by the processor, will cause said processor to perform the following operations:

adjusting the one or more probability threat scores based at least on the received data collected on the first customer network; and

wherein adjusting the one or more local models includes using the adjusted one or more probability threat scores as input into the one or more local models.

10. The non-transitory machine-readable storage medium of claim 6, wherein the training of the one or more local models is performed by the processor in accordance with machine learning methods based on at least the received data, and wherein the one or more global models are trained in accordance with machine learning methods.

11. An apparatus for collaborative and adaptive threat intelligence, comprising:

a processor; and

a non-transitory machine-readable storage medium containing instructions executable by said processor whereby said apparatus is operative to;

receive data collected on a first customer network;

train one or more local models with at least the received data, wherein the one or more local models are related to security;

determine an amount of data to transmit to a centralized controller based at least on a result of the training one or more local models;

transmit the determined amount of data to the centralized controller;

receive, from the centralized controller, result data that is a result of one or more global models trained on the centralized controller using data collected on a plurality of customer networks including the first customer network;

adjust the one or more local models using the received result data, wherein the result data includes information specifying a feature modification of a feature of the one or more local models, and wherein adjusting the one or more local models includes modifying the feature of the one or more local models in accordance with the specified feature modification;

train the one or more adjusted local models; and

wherein prior to transmission of the determined amount of data to the centralized controller, the apparatus is further operative to anonymize at least a portion of that determined amount of data;

wherein anonymization of at least a portion of the determined amount of data includes removal or obfuscation of one or more of the following attributes in the data;

username, Internet Protocol (IP) address, home address, social security number, credit card number, email address, and name.

12. The apparatus of claim 11, wherein the result data received from the centralized controller includes one or more probability threat scores for one or more features respectively.

13. The apparatus of claim 12, wherein adjustment of the one or more local models includes use of the one or more probability threat scores to be received as input into the one or more local models.

14. The apparatus of claim 12, wherein the non-transitory machine-readable storage medium further contains instructions executable by said processor whereby said apparatus is further operative to:

adjust the one or more probability threat scores based at least on the received data collected on the first customer network; and

wherein adjusting the one or more local models includes using the adjusted one or more probability threat scores as input into the one or more local models.

15. The apparatus of claim 11, wherein the training of the one or more local models is performed by execution of the instructions by the processor in accordance with machine learning methods based on at least the received data, and wherein the one or more global models are trained in accordance with machine learning methods.