Methods and apparatus providing computer and network security utilizing probabilistic policy reposturing

• US 20070143850A1
• Filed: 05/01/2006
• Published: 06/21/2007
• Est. Priority Date: 12/16/2005
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Zawadowskiy, Andrew, Kraemer, Jeffrey
• Granted Patent: US 7,882,560 B2
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

A system defines at least one key event to be monitored by at least one agent, and creates a graphical model for the at least one key event. The system observes the at least one key event. The system infers a degree of attack on the computer system based on an observation of the at least one key event in conjunction with a result of an effect the at least one key event has on the graphical model. The system then adjusts a security policy based on an output of the graphical model.

Claims

1. A method of providing computer security on a computer system, the method comprising:

defining at least one key event to be monitored by at least one agent;

creating a graphical model for the at least one key event;

observing the at least one key event;

inferring a degree of attack on the computer system based on an observation of the at least one key event in conjunction with a result of an effect the at least one key event has on the graphical model; and

adjusting a security policy based on an output of the graphical model.

2. The method of claim 1 wherein defining at least one key event to be monitored by at least one agent comprises:

defining the at least one key event to include at least one of;

i) a system call;

ii) a buffer overflow;

iii) an instance of downloaded content;

iv) an instance of CPU utilization;

v) at least one network connection;

vi) a process exception;

vii) a system configuration modification;

viii) an instance of a new software program installation;

ix) an instance of a new service installation;

x) a first time instance of a application invocation;

xi) an instance of mobile code execution;

xii) an instance of at least one root-kit detection;

xiii) an instance of memory utilization;

xiv) at least one transaction failure; and

xv) at least one loss of service.

3. The method of claim 1 wherein creating a graphical model for the at least one key event comprises:

assigning a weight to the at least one key event within the graphical model.

4. The method of claim 1 wherein creating a graphical model for the at least one key event comprises:

identifying a step in a process at which the at least one key event occurred.

5. The method of claim 1 wherein creating a graphical model for the at least one key event comprises:

creating a Bayesian network for use in detecting the degree of attack on the computer system.

6. The method of claim 1 wherein the graphical model includes a plurality of nodes and wherein creating a graphical model for the at least one key event comprises:

creating at least one subjective initial probability for each node in the plurality of nodes within the graphical model.

7. The method of claim 6 wherein creating at least one subjective initial probability for each node in the plurality of nodes within the graphical model comprises:

adjusting the at least one subjective initial probability of at least one node within the plurality of nodes, using at least one statistical datum associated with a previous security attack.

8. The method of claim 1 wherein observing the at least one key event comprises:

detecting the at least one key event is associated with a set of key events.

9. The method of claim 8 wherein detecting the at least one event is associated with a set of key events comprises:

identifying the at least one key event is related to the set of key events.

10. The method of claim 8 wherein detecting the at least one event is associated with a set of key events comprises:

identifying the at least one key event is not related to the set of key events.

11. The method of claim 8 wherein detecting the at least one event is associated with a set of key events comprises:

observing an order of the set of key events, the order including a placement of the at least one key event within the order of the set of key events.

12. The method of claim 1 wherein inferring a degree of attack on the computer system based on an observation of the at least one key event in conjunction with a result of an effect the at least one key event has on the graphical model comprises:

utilizing the Bayesian network to infer the degree of attack on the computer system.

13. The method of claim 1 wherein inferring a degree of attack on the computer system based on an observation of the at least one key event in conjunction with a result of an effect the at least one key event has on the graphical model comprises:

correlating the degree of attack to a configurable limit.

14. The method of claim 13 wherein correlating the degree of attack a configurable limit comprises:

initializing the configurable limit of the degree of attack.

15. The method of claim 13 wherein correlating the degree of attack a configurable limit comprises:

defining the configurable limit of the degree of attack as a range of configurable limits.

16. The method of claim 1 wherein inferring a degree of attack on the computer system based on an observation of the at least one key event in conjunction with a result of an effect the at least one key event has on the graphical model comprises:

modifying the degree of attack on the computer system based on the observation of the at least one key event.

17. The method of claim 1 wherein adjusting a policy based on an output of the graphical model comprises:

transitioning to a new security posture.

18. A computer apparatus comprising:

a memory;

a processor;

a communications interface;

an interconnection mechanism coupling the memory, the processor and the communications interface; and

wherein the memory is encoded with an application providing probabilistic security policy re-posturing that, when performed on the processor, provides a process for processing information, the process causing the computer apparatus to perform the operations of;

providing an event correlation engine in communication with an application file interceptor; and

wherein said event correlation engine defines at least one key event to be monitored by at least one agent, and wherein said event correlation engine creates a graphical model for the at least one key event and wherein said event correlation engine observes the at least one key event, and wherein said event correlation engine infers a degree of attack on the computer system based on an observation of the at least one key event in conjunction with a result of an effect the at least one key event has on the graphical model, and wherein said event correlation engine adjusts a security policy based on an output of the graphical model.

19. A computer readable medium encoded with computer programming logic that when executed on a process in a computerized device provides computer security, the medium comprising:

instructions for defining at least one key event to be monitored by at least one agent;

instructions for creating a graphical model for the at least one key event;

instructions for observing the at least one key event;

instructions for inferring a degree of attack on the computer system based on an observation of the at least one key event in conjunction with a result of an effect the at least one key event has on the graphical model; and

instructions for adjusting a security policy based on an output of the graphical model.

20. A computerized device comprising:

a memory;

a processor;

a communications interface;

an interconnection mechanism coupling the memory, the processor and the communications interface;

wherein the memory is encoded with a probabilistic security policy re-posturing application that when executed on the processor configures the computerized device with

a means for re-posturing a security policy, the means including;

means for defining at least one key event to be monitored by at least one agent;

means for creating a graphical model for the at least one key event;

means for observing the at least one key event;

means for inferring a degree of attack on the computer system based on an observation of the at least one key event in conjunction with a result of an effect the at least one key event has on the graphical model; and

means for adjusting a security policy based on an output of the graphical model.