Architecture for identifying electronic threat patterns

• US 20070192859A1
• Filed: 01/24/2007
• Published: 08/16/2007
• Est. Priority Date: 01/31/2006
• Status: Active Grant

• Current Assignee: Deutsche Telekom AG
• Original Assignee: Deutsche Telekom AG
• Inventors: Shahar, Yuval, Tahan, Gil, Shabtai, Assaf, Elovici, Yuval
• Granted Patent: US 7,941,851 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12

Abstract

The invention is a comprehensive conceptual and computational architecture that enables monitoring accumulated time-oriented data using knowledge related to the operation of elements of a computer network and deriving temporal abstractions from the accumulated data and the knowledge in order to identify electronic threat patterns and create alerts. The architecture of the invention supports two main modes of operation: a. an automated, continuous mode for monitoring, recognition and detection of known eThreats; and b. an interactive, human-operated intelligent tool for dynamic exploration of the contents of a security storage service to identify new temporal patterns that characterize such threats, and to add them to the monitoring database. The architecture of the invention can analyze data collected from various sources, such as end-user devices, network element, network links etc., to identify potentially infected devices, files, sub-streams or network segments.

Claims

1. A comprehensive conceptual and computational architecture that enables monitoring accumulated time-oriented data using knowledge related to the operation of elements of a computer network and deriving temporal abstractions from the accumulated data and the knowledge in order to identify electronic threat patterns and create alerts;

said architecture supporting two main modes of operation;

a. an automated, continuous mode for monitoring, recognition and detection of known eThreats; and

b. an interactive, human-operated intelligent tool for dynamic exploration of the contents of a security storage service.

2. An architecture according to claim 1, wherein said architecture is able to support the two main modes of operation by integrating:

a. a set of time-oriented security data sources;

b. a set of one or more knowledge bases specific to the process of detecting meaningful temporal patterns of not only raw data but also higher-level, abstracted concepts;

c. a temporal abstraction computational process that creates abstract patterns such as eThreats from the integration of the data and knowledge;

d. a monitoring service that continuously applies the relevant security knowledge to the accumulating data;

e. an effective visualization interface for exploration of multiple security-oriented records and their correlations over time, thus supporting also an interactive mode that enable identifying new eThreats;

f. a graphical knowledge-acquisition and maintenance tool that enables the security expert to easily add new patterns to the knowledge base, or modify existing ones; and

g. an effective visualization interface for alerts notification.

3. An architecture according to claim 1, wherein said architecture uses the Knowledge-Based Temporal Abstraction (KBTA) method to make temporal abstractions.

4. An architecture according to claim 1, wherein said architecture comprises the following modules and components that support the two main modes of operation:

a. Knowledge Acquisition Module (KAM);

b. Knowledge Base (KB);

c. KB Access Module (KBAM);

d. Temporal Abstraction Module (TAM);

e. Data, Abstractions and raised Alerts storage;

f. Persistence services module;

g. Query Module;

h. Continuous Monitoring Engine;

i. Temporal Abstraction Controller (TAC);

j. Visual Exploration Module (VEM);

k. Alert Invocation Module (AIM); and

l. Visual Monitoring Module (VMM).

5. An architecture according to claim 1, wherein said architecture supports acquiring multiple security-related ontologies such as a PC ontology, a server ontology, a cellular phones/pocket PC ontology, and network elements, in a flexible way.

6. An architecture according to claim 1, wherein said architecture enables a distributed, parallel computation for the monitoring and creation of temporal abstractions from given multiple records.

7. An architecture according to claim 1, wherein said architecture enables monitoring of eThreat patterns defined in a fuzzy fashion as a set of constraints, rather than an exact signature of each and every known threat, and thereby enables detection of instances of threats that have not been encountered before.