THREAT DETECTION USING ENDPOINT VARIANCE

• US 20160173509A1
• Filed: 12/15/2014
• Published: 06/16/2016
• Est. Priority Date: 12/15/2014
• Status: Active Grant

• Current Assignee: Sophos Limited (Sophos Group Ltd.)
• Original Assignee: Sophos Limited (Sophos Group Ltd.)
• Inventors: Harris, Mark D., Watkiss, Neil Robert Tyndale, Ray, Kenneth D., Reed, Simon Neil, Thomas, Andrew J.
• Granted Patent: US 9,571,512 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

Threat detection is improved by monitoring variations in observable events and correlating these variations to malicious activity. The disclosed techniques can be usefully employed with any attribute or other metric that can be instrumented on an endpoint and tracked over time including observable events such as changes to files, data, software configurations, operating systems, and so forth. Correlations may be based on historical data for a particular machine, or a group of machines such as similarly configured endpoints. Similar inferences of malicious activity can be based on the nature of a variation, including specific patterns of variation known to be associated with malware and any other unexpected patterns that deviate from normal behavior. Embodiments described herein use variations in, e.g., server software updates or URL cache hits on an endpoint, but the techniques are more generally applicable to any endpoint attribute that varies in a manner correlated with malicious activity.

Claims

1. A method comprising:

selecting a metric that objectively and quantitatively characterizes an endpoint property;

monitoring a change in the metric on a group of endpoints over time;

creating a model that evaluates whether a new value for the metric at a point in time is within a range of expected values for the metric at the point in time;

instrumenting an endpoint to detect a current value for the metric at a current time;

applying the model to determine whether the current value is within the range of expected values for the metric at the current time; and

reporting an indication of compromise for the endpoint when the current value is not within the range of expected values for the metric at the current time.

2. The method of claim 1 wherein the group of endpoints includes two or more endpoints.

3. The method of claim 1 wherein the endpoint belongs to the group of endpoints.

4. The method of claim 1 further comprising, when the current value is within the range of expected values, detecting a new current value for the metric and applying the model to the new current value for the metric.

5. The method of claim 1 wherein monitoring the change in the metric over time includes acquiring historical data for the endpoint.

6. The method of claim 1 wherein monitoring the change in the metric over time includes monitoring behavior for a plurality of endpoints in an enterprise.

7. The method of claim 1 wherein the model includes a statistical model having a variance for the metric that is used to determine the range of expected values.

8. The method of claim 1 wherein the model includes a Bayesian model having a Bayesian probability that provides a threshold for determining the range of expected values.

9. The method of claim 1 wherein the model includes a frequency domain model.

10. The method of claim 1 further comprising selecting and modeling a plurality of metrics and using the plurality of metrics to detect the indication of compromise.

11. The method of claim 1 wherein the model includes a periodicity that characterizes a change in the range of expected values that varies over time.

12. The method of claim 11 wherein the periodicity is daily, weekly, or annually.

13. The method of claim 1 wherein the metric measures Uniform Resource Locators addressed by the endpoint.

14. The method of claim 1 wherein the metric measures files accessed by the endpoint.

15. The method of claim 1 wherein the metric measures updates to executables on the endpoint.

16. A computer program product comprising non-transitory computer executable code embodied in a non-transitory computer readable medium that, when executing on one or more computing devices, performs the steps of:

selecting a metric that objectively and quantitatively characterizes an endpoint property;

monitoring a change in the metric on a group of endpoints over time;

creating a model that evaluates whether a new value for the metric at a point in time is within a range of expected values for the metric at the point in time;

instrumenting an endpoint to detect a current value for the metric at a current time;

applying the model to determine whether the current value is within the range of expected values for the metric at the current time; and

reporting an indication of compromise for the endpoint when the current value is not within the range of expected values for the metric at the current time.

17. The computer program product of claim 16 further comprising code that performs the step of, when the current value is within the range of expected values, detecting a new current value for the metric and applying the model to the new current value for the metric.

18. The computer program product of claim 16 wherein the model includes one or more of a statistical model, a Bayesian model, and a frequency domain model.

19. The computer program product of claim 16 further comprising code that performs the step of selecting and modeling a plurality of metrics and using the plurality of metrics to detect the indication of compromise.

20. An endpoint comprising:

a network interface coupling the endpoint in a communicating relationship with a data network;

a memory storing a value for a metric that objectively and quantitatively characterizes an endpoint property, along with a model that evaluates whether a new value for the metric at a point in time is within a range of expected values for the metric at the point in time; and

a processor configured to detect a current value for the metric at a current time, to apply the model to determine whether the current value is within the range of expected values for the metric at the current time, and to report an indication of compromise through the network interface to a remote threat management facility when the current value is not within the range of expected values for the metric at the current time.