ADVANCED PERSISTENT THREAT DETECTION

• US 20150312266A1
• Filed: 04/28/2014
• Published: 10/29/2015
• Est. Priority Date: 04/28/2014
• Status: Active Grant

• Current Assignee: Sophos Limited (Sophos Group Ltd.)
• Original Assignee: Sophos Limited (Sophos Group Ltd.)
• Inventors: Thomas, Andrew J.
• Granted Patent: US 9,392,015 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 2463/146 Tracing the source of attacks
• CPC Class Codes: H04L 43/10 Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 65/1033 Signalling gateways

Abstract

A variety of techniques are disclosed for detection of advanced persistent threats and similar malware. In one aspect, the detection of certain network traffic at a gateway is used to trigger a query of an originating endpoint, which can use internal logs to identify a local process that is sourcing the network traffic. In another aspect, an endpoint is configured to periodically generate and transmit a secure heartbeat, so that an interruption of the heartbeat can be used to signal the possible presence of malware. In another aspect, other information such as local and global reputation information is used to provide context for more accurate malware detection.

Claims

1. A method comprising:

detecting a request for network traffic at a gateway associated with an enterprise managed by a threat management facility, the request including a destination address and the request containing a violation of a network policy for the enterprise;

identifying an endpoint coupled to the gateway that originated the request;

querying the endpoint to determine a source of the request;

locating the source on one or more other endpoints managed by the threat management facility; and

remediating the one or more other endpoints.

2. The method of claim 1 further comprising remediating the endpoint.

3. The method of claim 1 wherein remediating the one or more other endpoints includes quarantining the one or more other endpoints.

4. The method of claim 1 wherein remediating the one or more other endpoints includes quarantining the source on each of the one or more other endpoints.

5. The method of claim 1 wherein remediating the one or more other endpoints includes removing the source from the one or more other endpoints.

6. The method of claim 1 wherein remediating the one or more other endpoints includes blocking network traffic for the one or more other endpoints.

7. The method of claim 1 wherein remediating the one or more other endpoints includes blocking access to the destination by the one or more other endpoints.

8. The method of claim 1 wherein the source includes a file.

9. The method of claim 1 wherein the source includes a process.

10. The method of claim 1 wherein the violation includes a prohibited Uniform Resource Identifier in the destination.

11. The method of claim 1 wherein the violation includes a prohibited domain in the destination.

12. The method of claim 1 wherein the violation includes prohibited content in the request.

13. The method of claim 12 wherein the prohibited content includes command and control protocol traffic for an advanced persistent threat.

14. The method of claim 1 wherein the violation includes a command and control location for an advanced persistent threat in the destination.

15. The method of claim 1 wherein identifying the endpoint includes determining a machine ID for the endpoint based upon a secure heartbeat received at the gateway from the endpoint.

16. The method of claim 1 wherein querying the endpoint includes accessing a log for the endpoint of network requests from processes executing on the endpoint.

17. The method of claim 16 wherein accessing the log includes searching the log for entries corresponding to the time and the destination of the request.

18. A computer program product comprising non-transitory computer executable code embodied in a non-transitory computer readable medium that, when executing on one or more computing devices in an enterprise managed by a threat management facility, performs the steps of:

detecting a request for network traffic at a gateway associated with the enterprise, the request including a destination address and the request containing a violation of a network policy for the enterprise;

identifying an endpoint coupled to the gateway that originated the request;

querying the endpoint to determine a source of the request;

locating the source on one or more other endpoints managed by the threat management facility; and

remediating the one or more other endpoints.

19. The computer program product of claim 18 further comprising code that performs the step of remediating the endpoint.

20. A system comprising:

a gateway in an enterprise, the gateway configured to detect a request for network traffic at the gateway from an endpoint in the enterprise, the request including a destination address and the request containing a violation of a network policy for the enterprise, the gateway further configured to identify the endpoint that originated the request, and to query the endpoint to determine a source of the request on the endpoint; and

a threat management facility for managing the enterprise, the threat management facility coupled in a communicating relationship with the gateway, and the threat management facility configured to locate one or more other endpoints associated with the enterprise that contain the source, and to remediate the one or more other endpoints with respect to the source.