AUTOMATIC ANALYSIS OF SECURITY RELATED INCIDENTS IN COMPUTER NETWORKS

• US 20130055399A1
• Filed: 08/29/2011
• Published: 02/28/2013
• Est. Priority Date: 08/29/2011
• Status: Active Grant

• Current Assignee: Lab A.O. Kaspersky
• Original Assignee: Kaspersky Lab ZAO
• Inventors: Zaitsev, Oleg V.
• Granted Patent: US 8,776,241 B2
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection

Abstract

Solutions for responding to security-related incidents in a computer network, including a security server, and a client-side arrangement. The security server includes an event collection module communicatively coupled to the computer network, an event analysis module operatively coupled to the event collection module, and a solution module operatively coupled to the event analysis module. The event collection module is configured to obtain incident-related information that includes event-level information from at least one client computer of the plurality of client computers, the incident-related information being associated with at least a first incident which was detected by that at least one client computer and provided to the event collection module in response to that detection. The event analysis module is configured to reconstruct at least one chain of events causally related to the first incident and indicative of a root cause of the first incident based on the incident-related information. The solution module is configured to formulate at least one recommendation for use by the at least one client computer, the at least one recommendation being based on the at least one chain of events, and including corrective/preventive action particularized for responding to the first incident.

Claims

1. A security server for responding to security-related incidents in a computer network including a plurality of client computers, the security server comprising:

an event collection module communicatively coupled to the computer network, an event analysis module operatively coupled to the event collection module, and a solution module operatively coupled to the event analysis module;

wherein the event collection module is configured to obtain incident-related information that includes event-level information from at least one client computer of the plurality of client computers, the incident-related information being associated with at least a first incident which was detected by that at least one client computer and provided to the event collection module in response to that detection;

wherein the event analysis module is configured to reconstruct at least one chain of events causally related to the first incident and indicative of a root cause of the first incident based on the incident-related information; and

wherein the solution module is configured to formulate at least one recommendation for use by the at least one client computer, the at least one recommendation being based on the at least one chain of events, and including corrective/preventive action particularized for responding to the first incident.

2. The security server of claim 1, wherein the incident-related information is limited to including essentially event-level information that is associated with the first incident.

3. The security server of claim 1, wherein the at least one recommendation for corrective action includes (a) a natural language part that describes the first incident, and (b) a corrective action part that includes instructions to be carried out on the at least one client computer for resolving the first incident.

4. The security server of claim 3, wherein the natural language part includes a report that describes the corrective action part in a natural language expression.

5. The security server of claim 3, wherein the corrective action part includes instructions specific to an individual client computer on which the first incident was detected.

6. The security server of claim 3, wherein the corrective action part includes instructions that are applicable to a plurality of different client computers.

7. The security server of claim 3, wherein the corrective action part includes instructions that are adapted to be automatically implemented by at least one client computer.

8. The security server of claim 1, wherein the solution module comprises:

a plurality of analytical modules, each configured to apply distinct decision criteria and to produce a corresponding output representing at least one suggestion for responding to the first incident; and

a decision-making system that collects the output of each of the plurality of analytical modules and selectively combines those outputs to produce the at least one recommendation for responding to the first incident.

9. The security server of claim 8, further comprising:

an incidents database communicatively coupled with the solution module, the incidents database storing the preexisting collection of known incident data, which includes event-level information and descriptive information associated with the known incidents; and

an expert system database communicatively coupled to the solution module, and storing the decision criteria.

10. The security server of claim 1, wherein the security server is configured to:

determine whether additional event-level usage history information from the at least one client computer relating to the first incident is needed for analysis of the first incident; and

in response to a determined need for the additional usage history information, cause the event collection module to request the additional usage history information from the at least one client computer.

11. The security server of claim 10, wherein the security server is configured to request additional usage history information from a client computer that is different from a client computer on which the first incident has been detected.

12. The security server of claim 1, wherein the chain of events includes events relating to transfer of information between multiple client computers.

13. The security server of claim 1, wherein the first incident was detected at a first client computer, and wherein the solution module is configured to formulate the at least one recommendation for responding to the first incident for use by a second client computer on which the first incident has not been detected.

14. The security server of claim 1, wherein the security server is configured to control a set of parameters at each of the at least one client computer, the set of parameters defining at least one of:

incident detection rules, rules for applying corrective/preventive actions, or any combination thereof.

15. A machine-implemented method for automatically responding to security-related incidents at a client computer that includes computer hardware operating under program control, the method comprising:

operating, by the client computer, at least one protection set module that is adapted to protect information stored at the client computer and to detect occurrences of security-related incidents;

logging, by the client computer, event-level records representing activity of the at least one protection set module;

detecting, by the at least one protection set module, an incident impacting information security at the client computer, the detecting being performed based on incident detection criteria;

in response to the detecting of the incident, associating, by the client computer, selected ones of the event-level records with the incident, the associating being performed based on incident associating criteria;

providing, by the client computer, the selected ones of the event-level records to a remote server to be analyzed;

receiving, by the client computer, at least one recommendation for corrective action to be carried out at the client computer, the recommendation for corrective action being received from the remote server, and including instructions for resolving the incident; and

executing, by the client computer, the instructions for resolving the incident;

receiving, by the client computer, an instruction to update at least one of;

the incident detection criteria, the incident associating criteria, or a combination thereof, with a new set of respective criteria.

16. The method of claim 15, wherein providing the selected ones of the event-level records to a remote server includes initiating, by the client computer, a transmission to the remote server that includes an indication that the incident has been detected.

17. The method of claim 15, further comprising:

receiving, by the client computer, at least one recommendation for corrective action to be carried out at the client computer, the recommendation for corrective action being received from the remote server, and including instructions for resolving a different incident which has been detected at a different client computer.

18. The method of claim 15, wherein receiving the instruction to update at least one of:

the incident detection criteria, the incident associating criteria, or a combination thereof, is in response to a communication originated from the remote server and is based on the recommendation for corrective action.

19. The method of claim 15, wherein receiving the at least one recommendation includes receiving a natural language report that describes the detected incident.

20. The method of claim 15, further comprising:

receiving, by the client computer, an instruction to provide additional event-level records that have not been associated with the incident.

21. The method of claim 15, wherein receiving the at least one recommendation for corrective action includes receiving instructions for resolving the incident that are machine-executable and tailored to a specific configuration of the client computer.

22. The method of claim 15, wherein receiving the at least one recommendation for corrective action includes receiving instructions for resolving the incident that are not client computer-specific;

and

wherein executing the instructions for resolving the incident includes determining, by the client computer, applicable instructions to be carried out.