SYSTEMS AND METHODS FOR DETECTING MALICIOUS INSIDERS USING EVENT MODELS
First Claim
1. A method for detecting a covert mission, the method comprising:
- providing an event model that models the covert mission, wherein the event model includes a plurality of ordered tasks;
observing, using a first processor, an occurrence of a first task of the plurality of ordered tasks;
in response to observing the occurrence of the first task, determining, using a second processor, that a second task of the plurality of ordered tasks occurred before the occurrence of the first task, wherein the second task precedes the first task in the event model;
determining if there is a causal relationship between the occurrence of the first task and the occurrence of the second task; and
determining that a covert mission exists based at least in part on the causal relationship.
1 Assignment
0 Petitions
Accused Products
Abstract
Systems and methods are disclosed for determining whether a mission has occurred. The disclosed systems and methods utilize event models that represent a sequence of tasks that an entity could or must take in order to successfully complete the mission. As a specific example, an event model may represent the sequence of tasks a malicious insider may complete in order to exfiltrate sensitive information. Most event models include certain tasks that must be accomplished in order for the insider to successfully exfiltrate an organization'"'"'s sensitive information. Many of the observable tasks in the attack models can be monitored using relatively little information, such as the source, time, and type of the communication. The monitored information is utilized in a traceback search through the event model for occurrences of the tasks of the event model to determine whether the mission that the event model represents occurred.
32 Citations
41 Claims
-
1. A method for detecting a covert mission, the method comprising:
-
providing an event model that models the covert mission, wherein the event model includes a plurality of ordered tasks; observing, using a first processor, an occurrence of a first task of the plurality of ordered tasks; in response to observing the occurrence of the first task, determining, using a second processor, that a second task of the plurality of ordered tasks occurred before the occurrence of the first task, wherein the second task precedes the first task in the event model; determining if there is a causal relationship between the occurrence of the first task and the occurrence of the second task; and determining that a covert mission exists based at least in part on the causal relationship. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20)
-
-
21. A system for detecting a covert mission, the system comprising:
circuitry configured to; provide an event model that models the covert mission, wherein the event model includes a plurality of ordered tasks; observe an occurrence of a first task of the plurality of ordered tasks; in response to observing the occurrence of the first task, determine that a second task of the plurality of ordered tasks occurred before the occurrence of the first task, wherein the second task precedes the first task in the event model; determine if there is a causal relationship between the occurrence of the first task and the occurrence of the second task; and determine that a covert mission exists based at least in part on the causal relationship. - View Dependent Claims (22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40)
-
41. A computer readable medium storing computer executable instructions, which, when executed by a processor, cause the processor to carryout a method for determining whether a third party observer could determine that an organization has an intent with respect to subject matter, the computer readable medium comprising:
-
providing an event model that models the covert mission, wherein the event model includes a plurality of ordered tasks; observing, using a first processor, an occurrence of a first task of the plurality of ordered tasks; in response to observing the occurrence of the first task, determining, using a second processor, that a second task of the plurality of ordered tasks occurred before the occurrence of the first task, wherein the second task precedes the first task in the event model; determining if there is a causal relationship between the occurrence of the first task and the occurrence of the second task; and determining that a covert mission exists based at least in part on the causal relationship.
-
Specification