DETECTING AND MANAGING ABNORMAL DATA BEHAVIOR

• US 20150242415A1
• Filed: 02/26/2014
• Published: 08/27/2015
• Est. Priority Date: 02/26/2014
• Status: Active Grant

• Current Assignee: iBoss
• Original Assignee: Phantom Technologies Incorporated
• Inventors: Martini, Paul Michael, Martini, Peter Anthony
• Granted Patent: US 9,195,669 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/122 using management policies backup systems G06F11/1446; file migration policies for HSM systems G06F16/185
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/303 Terminal profiles
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 4/029 Location-based management or tracking services

Abstract

Methods and systems for providing destination-specific network management are described. One example method includes determining a normal data movement profile for a computing device based on observed normal data transfer behavior by the computing device; identifying a data movement rule associated with the computing device, the data movement rule including a deviation amount, and one or more actions to take when the computing device deviates from the normal data movement profile by more than the deviation amount; detecting a data movement associated with the computing device; determining that the detected data movement exceeds the deviation amount included in the data movement rule relative to the normal data movement profile for the computing device; and performing the one or more actions associated with the data movement rule upon determining that the data movement violates the data movement rule.

Claims

1. A method performed by one or more processors, the method comprising:

determining a normal data movement profile for a particular computing device representing observed data transfer behavior over a network by the particular computing device during a particular time period, the observed data transfer behavior including messages sent and received by the particular computing device over the network monitored by a computing device different than the particular computing device, the normal data movement profile including one or more normal data movement attributes associated with the particular computing device, wherein the normal data movement attributes include values representing observed amounts of data sent and received by the computing device over the network during the particular time period;

identifying a data movement rule associated with the particular computing device, the data movement rule including a deviation amount representing a difference between an attribute of a detected data movement by the particular computing device and a corresponding normal movement attribute including a normal data movement profile for the particular computing device that represents a violation of the data movement rule, and one or more actions to take when the particular computing device deviates from the normal data movement profile by more than the deviation amount;

detecting a data movement associated with the particular computing device;

determining that the detected data movement exceeds the deviation amount included in the data movement rule relative to the normal data movement profile for the particular computing device; and

performing the one or more actions associated with the data movement rule upon determining that the data movement violates the data movement rule, wherein the one or more actions include at least one of quarantining the particular computing device, generating an alert indicating that the particular computing device has violated the data movement rule, severing one or more outbound network connections associated with the particular computing device, or disabling the particular computing device for an amount of time.

2. The method of claim 1, wherein:

the data movement profile includes an amount of data transferred during the particular time period,

the deviation amount specifies a percentage deviation from the amount of data transferred that will trigger the data movement rule, and

determining that the data movement violates the data movement rule comprises determining that an amount of data associated with the data movement is greater than the amount of data transferred by more than the deviation amount.

3. The method of claim 1, wherein:

the data movement profile includes a data transfer type distribution for the particular time period,

the deviation amount specifies a percentage deviation from the data transfer type distribution that will trigger the data movement rule, and

determining that the data movement violates the data movement rule comprises determining that an observed data transfer type distribution associated with the data movement differs from the data transfer type distribution by more than the deviation amount.

4. The method of claim 3, wherein the data transfer type distribution includes a ratio of Universal Datagram Protocol (UDP) transfers to Transmission Control Protocol (TCP) transfers.

5. The method of claim 1, wherein:

the data movement profile includes a number of simultaneous data destinations for the particular time period,

the deviation amount specifies a percentage deviation from the number of simultaneous data destinations transferred that will trigger the data movement rule, and

determining that the data movement violates the data movement rule comprises determining that a number of simultaneous data destinations for the particular computing device is greater than the number of simultaneous data destinations by more than the deviation amount.

6. The method of claim 1, wherein:

the data movement profile includes a data rate for the particular time period,

the deviation amount specifies a percentage deviation from the data rate that will trigger the data movement rule, and

determining that the data movement violates the data movement rule comprises determining that a data rate for the particular computing device is greater than the data rate by more than the deviation amount.

8. The method of claim 1, wherein detecting the data movement includes determining an amount of data being moved and determining a destination to which the data is being moved.

9. The method of claim 8, wherein determining the destination to which the data is being moved includes geo-locating an IP address to which the data is being moved.

10. The method of claim 1, wherein the data movement occurs from a private network to a public network.

11. The method of claim 1, wherein the data movement occurs from a first private network to a second private network.

12. The method of claim 1, wherein the data movement includes at least one of data being transferred from the particular computing device or data being transferred to the particular computing device.

22. The method of claim 1, wherein determining the data movement profile for the particular computing device includes a computing device different than the particular computing device monitoring messages sent and received by the particular computing device over the network.

7. (canceled)

13. A system comprising:

memory for storing data; and

one or more processors operable to perform operations comprising;

determining a normal data movement profile for a particular computing device representing observed data transfer behavior over a network by the particular computing device during a particular time period, the observed data transfer behavior including messages sent and received by the particular computing device over the network monitored by a computing device different than the particular computing device, the normal data movement profile including one or more normal data movement attributes associated with the particular computing device, wherein the normal data movement attributes include values representing observed amounts of data sent and received by the computing device over the network during the particular time period;

identifying a data movement rule associated with the particular computing device, the data movement rule including a deviation amount representing a difference between an attribute of a detected data movement by the particular computing device and a corresponding normal movement attribute including a normal data movement profile for the particular computing device that represents a violation of the data movement rule, and one or more actions to take when the particular computing device deviates from the normal data movement profile by more than the deviation amount;

detecting a data movement associated with the particular computing device;

determining that the detected data movement exceeds the deviation amount included in the data movement rule relative to the normal data movement profile for the particular computing device; and

performing the one or more actions associated with the data movement rule upon determining that the data movement violates the data movement rule, wherein the one or more actions include at least one of quarantining the particular computing device, generating an alert indicating that the particular computing device has violated the data movement rule, severing one or more outbound network connections associated with the particular computing device, or disabling the particular computing device for an amount of time.

14. The system of claim 13, wherein:

the data movement profile includes an amount of data transferred during the particular time period,

the deviation amount specifies a percentage deviation from the amount of data transferred that will trigger the data movement rule, and

determining that the data movement violates the data movement rule comprises determining that an amount of data associated with the data movement is greater than the amount of data transferred by more than the deviation amount.

15. The system of claim 13, wherein:

the data movement profile includes a data transfer type distribution for the particular time period,

the deviation amount specifies a percentage deviation from the data transfer type distribution that will trigger the data movement rule, and

determining that the data movement violates the data movement rule comprises determining that an observed data transfer type distribution associated with the data movement differs from the data transfer type distribution by more than the deviation amount.

16. The system of claim 15, wherein the data transfer type distribution includes a ratio of Universal Datagram Protocol (UDP) transfers to Transmission Control Protocol (TCP) transfers.

17. The system of claim 13, wherein:

the data movement profile includes a number of simultaneous data destinations for the particular time period,

the deviation amount specifies a percentage deviation from the number of simultaneous data destinations transferred that will trigger the data movement rule, and

determining that the data movement violates the data movement rule comprises determining that a number of simultaneous data destinations for the particular computing device is greater than the number of simultaneous data destinations by more than the deviation amount.

18. The system of claim 13, wherein:

the data movement profile includes a data rate for the particular time period,

the deviation amount specifies a percentage deviation from the data rate that will trigger the data movement rule, and

determining that the data movement violates the data movement rule comprises determining that a data rate for the particular computing device is greater than the data rate by more than the deviation amount.

19-20. -20. (canceled)

21. A non-transitory, computer-readable medium storing instructions operable when executed to cause at least one processor to perform operations comprising:

determining a normal data movement profile for a particular computing device representing observed data transfer behavior over a network by the particular computing device during a particular time period, the observed data transfer behavior including messages sent and received by the particular computing device over the network monitored by a computing device different than the particular computing device, the normal data movement profile including one or more normal data movement attributes associated with the particular computing device, wherein the normal data movement attributes include values representing observed amounts of data sent and received by the computing device over the network during the particular time period;

identifying a data movement rule associated with the particular computing device, the data movement rule including a deviation amount representing a difference between an attribute of a detected data movement by the particular computing device and a corresponding normal movement attribute including a normal data movement profile for the particular computing device that represents a violation of the data movement rule, and one or more actions to take when the particular computing device deviates from the normal data movement profile by more than the deviation amount;

detecting a data movement associated with the particular computing device;

determining that the detected data movement exceeds the deviation amount included in the data movement rule relative to the normal data movement profile for the particular computing device; and

performing the one or more actions associated with the data movement rule upon determining that the data movement violates the data movement rule, wherein the one or more actions include at least one of quarantining the particular computing device, generating an alert indicating that the particular computing device has violated the data movement rule, severing one or more outbound network connections associated with the particular computing device, or disabling the particular computing device for an amount of time.