SYSTEM AND METHOD THEREOF FOR CREATING PROGRAMMABLE SECURITY DECISION ENGINES IN A CYBER-SECURITY SYSTEM

• US 20160021135A1
• Filed: 05/19/2015
• Published: 01/21/2016
• Est. Priority Date: 07/18/2014
• Status: Active Grant

• Current Assignee: Cybereason, Inc.
• Original Assignee: empow Cyber Security Ltd.
• Inventors: Chesla, Avi, MEDALION, Shlomi
• Granted Patent: US 9,967,279 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system and method for adaptively securing a protected entity against cyber-threats. The method comprises: determining, based on at least one input feature, at least one normalization function, wherein the at least one input feature defines an attribute of a data flow to be evaluated by the SDE; receiving at least one engine rule describing an anomaly to be evaluated; and creating an inference system including at least one inference unit, wherein each inference unit is determined based on one of the received at least one engine rule, wherein the inference system computes a score of anomaly (SoA) respective of the at least one input feature.

Claims

1. A method for generating a software decision engine (SDE) operable in a cyber-security system, comprising:

determining, based on at least one input feature, at least one normalization function, wherein the at least one input feature defines an attribute of a data flow to be evaluated by the SDE;

receiving at least one engine rule describing an anomaly to be evaluated; and

creating an inference system including at least one inference unit, wherein each inference unit is determined based on one of the received at least one engine rule, wherein the inference system computes a score of anomaly (SoA) respective of the at least one input feature.

2. The method of claim 1, further comprising:

determining at least one of;

a synchronization function to synchronize between values of the at least one input feature, and a feature function to be applied on the values of the at least one input feature.

3. The method of claim 2, further comprising:

applying the at least one normalization function to one of the at least one input feature to yield behavioral levels, wherein the score of anomaly is further computed based on the behavioral levels.

4. The method of claim 3, wherein each of the at least one normalization function is defined using at least a plurality of edge values and at least one normalization function parameter, wherein the plurality of edge values determine a degree of membership of the received input feature'"'"'s value to a certain behavioral level, wherein further the normalization function parameter sets the characteristics of the selected normalization function.

5. The method of claim 1, wherein each of the received at least one engine rule includes at least a logical operator and a value operator applied on the input feature.

6. The method of claim 5, wherein receiving the at least one engine rule further comprises:

determining the at least one engine rule based on the received input feature and the at least one normalization function.

7. The method of claim 1, wherein each inference unit outputs a degree of fulfillment index based on the at least one input feature.

8. The method of claim 1, wherein the score of anomaly is computed by any one of:

aggregating the degree of fulfillment indexes, selecting a maximum or minimum degree of fulfillment based on logical operators of the at least one engine rule, and using a centroid method.

9. The method of claim 1, wherein the at least one normalization function is determined based on at least one normalization parameter instruction.

10. The method of claim 9, wherein each of the at least one input feature is associated with a finite set of normalization functions.

11. The method of claim 10, wherein each determined normalization function is a default normalization function for one of the at least one input feature.

12. A non-transitory computer readable medium having stored thereon instructions for causing one or more processing units to execute the method according to claim 1.

19. The system of claim 11, wherein the system is further configured to:

determine the at least one engine rule based on the at least one input feature and the at least one normalization function.

13. A system for generating a software decision engine (SDE) operable in a cyber-security system, comprising:

a processing unit; and

a memory, the memory containing instructions that, when executed by the processing unit, configure the system to;

determine, based on at least one input feature, at least one normalization function, wherein the at least one input feature defines an attribute of a data flow to be evaluated by the SDE;

receive at least one engine rule describing an anomaly to be evaluated; and

create an inference system including at least one inference unit, wherein each inference unit is determined based on one of the received at least one engine rule, wherein the inference system computes a score of anomaly (SoA) respective of the at least one input feature.

14. The system of claim 13, wherein the memory is further configured to contain a plurality of normalization functions.

15. The system of claim 13, wherein the system is further configured to:

determine at least one of;

a synchronization function to synchronized between values of the least one at least one input feature, and a feature function to be applied on the values of the at least one input feature.

16. The system of claim 13, wherein the system is further configured to:

apply the at least one normalization function to one of the at least one input feature to yield behavioral levels, wherein the score of anomaly is further computed based on the behavioral levels.

17. The system of claim 16, wherein each of the at least one normalization function is defined using at least a plurality of edge values and at least one normalization function parameter, wherein the plurality of edge values determine a degree of membership of the received input feature'"'"'s value to a certain behavioral level, wherein further the normalization function parameter sets the characteristics of the selected normalization function.

18. The system of claim 13, wherein each of the received at least one engine rule includes at least a logical operator and a value operator applied on the input feature.

20. The system of claim 13, wherein each inference unit outputs a degree of fulfillment index based on the at least one input feature.

21. The system of claim 13, wherein the score of anomaly is computed by any one of:

aggregating the degree of fulfillment indexes, selecting a maximum degree of fulfillment, and using a centroid method.

22. The system of claim 13, wherein each of the at least one input feature is associated with a finite set of normalization, wherein each determined normalization function is a default normalization function for one of the at least one input feature.