Space and time efficient threat detection

• US 10,616,248 B2
• Filed: 01/23/2019
• Issued: 04/07/2020
• Est. Priority Date: 01/30/2015
• Status: Active Grant

• Current Assignee: Anomali, Inc.
• Original Assignee: Anomali, Inc.
• Inventors: Huang, Wei, Zhou, Yizheng, Njemanze, Hugh
• Primary Examiner(s): Murphy, J. Brant
• Assistant Examiner(s): Gundry, Stephen T
• Application Number:
  US16/255,708
• Publication Number:
  US 20190158514A1
• Time in Patent Office: 440 Days
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/6254 by anonymising data, e.g. decorrelating personal data from the owner's identification
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

A security monitoring system operated by a downstream client continually collects event information indicating events that have occurred within the computing environment of the downstream client. The monitoring system, using software provided by a threat analytics system, aggregates the event information into a secure and space efficient data structure. The monitoring system transmits the data structures storing event information to the threat analytics system for further processing. The threat analytics system also receives threat indicators from intelligence feed data sources. The threat analytics system compares the event information received from each security monitoring system against the threat indicators collected from the intelligence feed data sources to identify red flag events. The threat analytics system processes the event information to synthesize all information related to the red flag event and reports the red flag event to the downstream client.

Claims

1. A method for performing threat detection, comprising:

receiving, at a server, aggregated event data from a client system, the aggregated event data comprising a plurality of event data structures, each event data structure of the plurality of event data structures comprising event data received during a different level of time-based granularity, the aggregated event data including an obfuscated representation of entity identifiers associated with each of a plurality of different events occurring on the client system during each different level of time-based granularity and excluding the entity identifiers themselves;

in response to receiving the aggregated event data, determining, at the server, a subset of the aggregated event data in an event data structure of the plurality of event data structures having a lowest level of granularity comprising a plurality of event data that is associated with at least one cyber-threat; and

reporting a message, by the server, indicating the presence of the at least one cyber-threat for each of the plurality of event data of the subset to the client system.

2. The method of claim 1, wherein determining that the event data is associated with the at least one cyber-threat comprises determining whether a domain name associated with the event data is affiliated with a malicious entity.

3. The method of claim 1, wherein determining that the event data is associated with the at least one cyber-threat comprises comparing the event data with one or more threat indicators to determine whether at least one threat indicator of a plurality of known threat indicators is present in the event data, each threat indicator of the plurality of known threat indicators associated with at least one potential cyber-threat.

4. The method of claim 3, wherein the event data comprises an indexed hierarchy of events, a first level in the indexed hierarchy associated with a different time-based granularity relative to a second level in the indexed hierarchy.

5. The method of claim 4, wherein comparing the event data with the one or more threat indicators comprises comparing the first level in the indexed hierarchy with the one or more threat indicators and proceeding to the second level in response to determining, based on the comparing of the first level with the one or more threat indicators, that a match exists between the first level and at least one of the one or more threat indicators.

6. The method of claim 3, further comprising:

identifying an additional threat indicator not included in the one or more threat indicators; and

performing one or more real-time forensics operations on the event data to determine whether a cyber-threat associated with the additional threat indicator is present in the event data.

7. The method of claim 3, further comprising generating a second threat indicator from a first threat indicator based on data extracted from the first threat indicator, the second threat indicator included in the one or more threat indicators.

8. The method of claim 1, further comprising receiving a textual search query specifying one or more parameters for filtering threat data, and updating a multi-panel display to present the threat data filtered according to the one or more parameters.

9. The method of claim 1, further comprising receiving a plurality of threat data feeds from threat data sources that include at least one of the one or more threat indicators.

10. The method of claim 9, further comprising computing a relevance index associated with each of the plurality of threat data feeds, the relevance index for a given threat data feed indicating how relevant threat indicators included in the threat data feed are to the client system.

11. A non-transitory computer readable medium storing instructions that, when executed by a processor of a server, cause the processor to:

receive, at a server, aggregated event data from a client system, the aggregated event data comprising a plurality of event data structures, each event data structure of the plurality of event data structures comprising event data received during a different level of time-based granularity, the aggregated event data including an obfuscated representation of entity identifiers associated with each of a plurality of different events occurring on the client system during each different level of time-based granularity and excluding the entity identifiers themselves;

in response to receiving the aggregated event data, determine, at the server, a subset of the aggregated event data in an event data structure of the plurality of event data structures having a lowest level of granularity comprising a plurality of event data that is associated with at least one cyber-threat; and

report a message, by the server, indicating the presence of the at least one cyber-threat for each of the plurality of event data of the subset to the client system.

12. The non-transitory computer readable medium of claim 11, wherein determining that the event data is associated with the at least one cyber-threat comprises determining whether a domain name associated with the event data is affiliated with a malicious entity.

13. The non-transitory computer readable medium of claim 11, wherein determining that the event data is associated with the at least one cyber-threat comprises comparing the event data with one or more threat indicators to determine whether at least one threat indicator of a plurality of known threat indicators is present in the event data, each threat indicator of the plurality of known threat indicators associated with at least one potential cyber-threat.

14. The non-transitory computer readable medium of claim 13, wherein the event data comprises an indexed hierarchy of events, a first level in the indexed hierarchy associated with a different time-based granularity relative to a second level in the indexed hierarchy.

15. The non-transitory computer readable medium of claim 14, wherein comparing the event data with the one or more threat indicators comprises comparing the first level in the indexed hierarchy with the one or more threat indicators and proceeding to the second level in response to determining, based on the comparing of the first level with the one or more threat indicators, that a match exists between the first level and at least one of the one or more threat indicators.

16. The non-transitory computer readable medium of claim 13, wherein the instructions, when executed by the processor of the server, further cause the processor to:

identify an additional threat indicator not included in the one or more threat indicators; and

perform one or more real-time forensics operations on the event data to determine whether a cyber-threat associated with the additional threat indicator is present in the event data.

17. The non-transitory computer readable medium of claim 13, wherein the instructions, when executed by the processor of the server, further cause the processor to generate a second threat indicator from a first threat indicator based on data extracted from the first threat indicator, the second threat indicator included in the one or more threat indicators.

18. The non-transitory computer readable medium of claim 11, wherein the instructions, when executed by the processor of the server, further cause the processor to receive a textual search query specifying one or more parameters for filtering threat data, and update a multi-panel display to present the threat data filtered according to the one or more parameters.

19. The non-transitory computer readable medium of claim 11, wherein the instructions, when executed by the processor of the server, further cause the processor to receive a plurality of threat data feeds from threat data sources that include at least one of the one or more threat indicators.

20. The non-transitory computer readable medium of claim 19, wherein the instructions, when executed by the processor of the server, further cause the processor to compute a relevance index associated with each of the plurality of threat data feeds, the relevance index for a given threat data feed indicating how relevant threat indicators included in the threat data feed are to the client system.