DISTRIBUTED SYSTEM AND METHOD FOR THE DETECTION OF eTHREATS

• US 20080313734A1
• Filed: 05/22/2008
• Published: 12/18/2008
• Est. Priority Date: 05/24/2007
• Status: Active Grant

• Current Assignee: Deutsche Telekom AG
• Original Assignee: Deutsche Telekom AG
• Inventors: Elovici, Yuval, Rozenberg, Boris, Gudes, Ehud
• Granted Patent: US 7,941,853 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06N 5/043 Distributed expert systems; Blackboards
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

The invention relates to a distributed system for detecting eThreats that propagate in a network, which comprises: (a) graphs database storing at least one propagation graph, each graph describing the typical propagation over time of one eThreat class or a legitimate executable class within the network; (b) plurality of agents that are distributed in corresponding plurality of hosts within the network, each of said agents continuously monitoring the corresponding host and reporting to a Central Decision Maker (CDM) the identity of any new suspected executable, and the time in which said suspected executable has been first detected by said agent; (c) a CDM for: (c.1) receiving all said reports from said plurality of agents; (c.2) creating from said reports for each suspected executable a corresponding propagation graph which reflects the propagation characteristics over time of said suspected executable within the network, and (c.3) comparing each of said created graphs with said stored at least one propagation graph; (c.4) upon finding a similarity above a predefined threshold between a created graph and one of the stored graphs, concluding respectively that said executable belongs to the class as defined by said stored graph; and (c.5) conveying said conclusion to said agents, for optionally taking an appropriate action.

Claims

1. A distributed system for detecting eThreats that propagate in a network, which comprises:

graphs database storing at least one propagation graph, each graph describing the typical propagation over time of one eThreat class or a legitimate executable class within the network;

plurality of agents that are distributed in corresponding plurality of hosts within the network, each of said agents continuously monitoring the corresponding host and reporting to a Central Decision Maker (CDM) the identity of any new suspected executable, and the time in which said suspected executable has been first detected by said agent;

a CDM for;

a. receiving all said reports from said plurality of agents;

b. creating from said reports for each suspected executable a corresponding propagation graph which reflects the propagation characteristics over time of said suspected executable within the network, and

c. comparing each of said created graphs with said stored at least one propagation graph;

d. upon finding a similarity above a predefined threshold between a created graph and one of the stored graphs, concluding respectively that said executable belongs to the class as defined by said stored graph; and

e. conveying said conclusion to said agents, for optionally taking an appropriate action.

2. System according to claim 1, wherein the report by the agents also comprises the identity of the report issuing agent.

3. System according to claim 1, wherein the comparison by the CDM is repeated plurality of times for each executable until a final conclusion is reached.

4. System according to claim 1, wherein each of the agents further performs analysis at the host location, for at least reaching a temporary conclusion regarding the type of the executable in question, and further sends said temporary conclusion to said CDM.

5. System according to claim 1, for the detection of worm type eThreates, wherein:

the database comprises null graphs; and

the CDM calculates from the created graph the value of α

as a function of time, and if the value of α

is found to be approximately constant within predefined limits and larger than zero during an initial propagation phase of said executable, the CDM concludes that the executable is a worm, wherein α

=(number of infected hosts at time t)/(number of infected hosts at time t−

1).

6. System according to claim 1, for the detection of worm type eThreates, wherein, one of the graphs in the database which relates to a worm-type eThreat class has a value of α

as a function of time which is approximately constant within predefined limits and larger than zero during an initial propagation phase of said executable, and the CDM concludes that the executable is a worm when a similarity above a predefined threshold is found between said created graph and said pre-stored graph which relates to a worm.

7. System according to claim 1, wherein the propagation is defined as the number of host which include an executable as a function of time.