AUTOMATED INTELLIGENCE GRAPH CONSTRUCTION AND COUNTERMEASURE DEPLOYMENT

• US 20150244734A1
• Filed: 02/25/2014
• Published: 08/27/2015
• Est. Priority Date: 02/25/2014
• Status: Active Grant

• Current Assignee: Accenture Global Solutions Limited (Accenture PLC)
• Original Assignee: VeriSign, Inc.
• Inventors: Tonn, Trevor, Olson, Ryan
• Granted Patent: US 9,886,581 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Techniques for providing information security threat assessment and amelioration are disclosed. The techniques may include obtaining fundamental data, obtaining document data, preparing fundamental instance nodes from the fundamental data, preparing document nodes from the document data, preparing edges between at least some of the nodes, storing the nodes and the edges in a manner that reflects a graph structure, and causing to be displayed at least a portion of a graph defined by at least one node and at least one edge.

Claims

1. A computer-implemented method comprising:

obtaining fundamental data;

obtaining document data;

preparing fundamental instance nodes from the fundamental data;

preparing document nodes from the document data;

preparing edges between at least some of the nodes;

storing the nodes and the edges in a manner that reflects a graph structure; and

causing to be displayed at least a portion of a graph defined by at least one node and at least one edge.

2. The method of claim 1, wherein each fundamental instance comprises data describing one of:

an IP address, a domain name, a uniform resource locator, a file system path, a software vulnerability, a software, a person'"'"'s name, an account handle, an email address, a malware family, an attack campaign, an event, an organization, a network, a file, a country, a region, or an autonomous system number.

3. The method of claim 1, wherein each document comprises data describing one of:

an intelligence report, a communication, an analysis, or a context.

4. The method of claim 1, wherein the preparing edges comprises extracting at least one fundamental data string from a fundamental instance.

5. The method of claim 1, wherein the preparing edges comprises selecting an appropriate set of one or more words.

6. The method of claim 1, further comprising matching a sub-graph comprising at least one node and at least one edge to a pattern of a known attack.

7. The method of claim 6, wherein the matching is performed upon the graph receiving an additional amount of nodes and edges.

8. The method of claim 6, wherein the matching is performed periodically.

9. The method of claim 6, wherein the matching further comprises obtaining a description of a countermeasure to the known attack.

10. The method of claim 9, further comprising automatically implementing the countermeasure.

11. Computer readable media comprising instructions which, when executed by a computer system comprising at least one electronic processor, cause the at least one electronic processor to:

obtain fundamental data;

obtain document data;

prepare fundamental instance nodes from the fundamental data;

prepare document nodes from the document data;

prepare edges between at least some of the nodes;

store the nodes and the edges in a manner that reflects a graph structure; and

cause to be displayed at least a portion of a graph defined by at least one node and at least one edge.

12. The computer readable media of claim 11, wherein each fundamental instance comprises data describing one of:

an IP address, a domain name, a uniform resource locator, a file system path, a software vulnerability, a software, a person'"'"'s name, an account handle, an email address, a malware family, an attack campaign, an event, an organization, a network, a file, a country, a region, or an autonomous system number.

13. The computer readable media of claim 11, wherein each document comprises data describing one of:

an intelligence report, a communication, an analysis, or a context.

14. The computer readable media of claim 11, wherein preparing edges comprises extracting at least one fundamental data string from a fundamental instance.

15. The computer readable media of claim 11, wherein preparing edges comprises selecting an appropriate set of one or more words.

16. The computer readable media of claim 11, wherein the instructions, when executed by the computer system comprising the at least one electronic processor, further cause the at least one electronic processor to:

match a sub-graph comprising of at least one node and at least one edge to a pattern of a known attack.

17. The computer readable media of claim 16, wherein the instructions, when executed by the computer system comprising the at least one electronic processor, further cause the at least one electronic processor to:

match a sub-graph comprising of at least one node and at least one edge to a pattern of a known attack upon the graph receiving an additional amount of nodes and edges.

18. The computer readable media of claim 16, wherein the instructions, when executed by the computer system comprising the at least one electronic processor, further cause the at least one electronic processor to:

match a sub-graph comprising of at least one node and at least one edge to a pattern of a known attack periodically.

19. The computer readable media of claim 16, wherein the instructions, when executed by the computer system comprising the at least one electronic processor, further cause the at least one electronic processor to:

match a sub-graph comprising of at least one node and at least one edge to a pattern of a known attack by obtaining a description of a countermeasure to the known attack.

20. The computer readable media of claim 19, wherein the instructions, when executed by the computer system comprising the at least one electronic processor, further cause the at least one electronic processor to:

automatically implement the countermeasure.