SPACE AND TIME EFFICIENT THREAT DETECTION

• US 20160226895A1
• Filed: 01/26/2016
• Published: 08/04/2016
• Est. Priority Date: 01/30/2015
• Status: Active Grant

• Current Assignee: Anomali, Inc.
• Original Assignee: Threat Stream, Inc.
• Inventors: HUANG, WEI, ZHOU, YIZHENG, NJEMANZE, HUGH
• Granted Patent: US 10,230,742 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/6254 by anonymising data, e.g. decorrelating personal data from the owner's identification
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

A security monitoring system operated by a downstream client continually collects event information indicating events that have occurred within the computing environment of the downstream client. The monitoring system, using software provided by a threat analytics system, aggregates the event information into a secure and space efficient data structure. The monitoring system transmits the data structures storing event information to the threat analytics system for further processing. The threat analytics system also receives threat indicators from intelligence feed data sources. The threat analytics system compares the event information received from each security monitoring system against the threat indicators collected from the intelligence feed data sources to identify red flag events. The threat analytics system processes the event information to synthesize all information related to the red flag event and reports the red flag event to the downstream client.

Claims

1. A method for performing threat detection, comprising:

receiving event data from a client system, the event data including an obfuscated representation of entity identifiers associated with different events occurring on the client system;

determining that the event data is associated with at least one cyber-threat; and

reporting the presence of the at least one cyber-threat to the client system.

2. The method of claim 1, wherein determining that the event data is associated with at least one cyber-threat comprises determining whether a domain name associated with the event data is affiliated with a malicious entity.

3. The method of claim 1, wherein determining that the event data is associated with at least one cyber-threat comprises comparing the event data with one or more threat indicators to determine whether at least one threat indicator is present in the event data, each threat indicator associated with at least one potential cyber-threat.

4. The method of claim 3, wherein the event data comprises an indexed hierarchy of events, a first level in the indexed hierarchy associated with a different time-based granularity relative to a second level in the indexed hierarchy.

5. The method of claim 4, wherein comparing the event data with the one or more threat indicators comprises comparing the first level in the indexed hierarchy with the one or more threat indicators and proceeding to the second level only when a match exists between the first level and at least one of the one or more threat indicators.

6. The method of claim 3, further comprising:

identifying an additional threat indicator not included in the one or more threat indicators;

performing one or more real-time forensics operations on the event data to determine whether a cyber-threat associated with the additional threat indicator is present in the event data.

7. The method of claim 1, wherein reporting the presence of the at least one cyber-threat comprises displaying a multi-panel display of threat data, each panel in the multi-panel display presenting the presence of the at least one threat indicator according to a different data dimension.

8. The method of claim 7, wherein the data dimension comprises at least one selected from a group consisting of time of threats, type of threats, confidence of threats being valid, severity of threats, type of threatening action, destination ports, source ports, tags, and geography.

9. The method of claim 7, further comprising receiving a user input to select a portion of a first panel in the multi-panel display, and presenting a more detailed view of the selected portion in the first panel.

10. The method of claim 9, further comprising updating an additional panel in the multi-panel display based on the selected portion in the first panel.

11. The method of claim 7, wherein at least one panel in the multi-panel display is manipulated using user touch on a display surface.

12. The method of claim 7, further comprising receiving a textual search query specifying one or more parameters for filtering the threat data, and updating the multi-panel display to present the threat data filtered according to the one or more parameters.

13. The method of claim 3, further comprising generating a second threat indicator from a first threat indicator based on data extracted from the first threat indicator, the second threat indicator included in the one or more threat indicators.

14. The method of claim 1, further comprising receiving a plurality of threat data feeds from threat data sources that include at least one of the one or more threat indicators

15. The method of claim 14, further comprising computing a relevance index associated with each of the threat data feeds, the relevance index for a given threat data feed indicating how relevant threat indicators included in the threat data feed are to the client system.

16. The method of claim 14, further comprising providing the plurality of threat data feeds to client system for purchase in a digital store.

17. The method of claim 16, further comprising enabling the client system to compare how many threat indicators are common between two or more of the plurality of threat data feeds.

18. The method of claim 3, further comprising:

processing a first threat indicator to generate an additional threat indicator based on one or more parameters of the first threat indicator; and

determining that the additional threat indicator is present in the event data.

20. The method of claim 17, further comprising receiving a first expansion parameter that expands a first threat indicator to generate an additional threat indicator associated with at least one potential cyber-threat.

21. The method of claim 18, further comprising performing a real-time forensics operations on the event data to determine whether a cyber-threat associated with the additional threat indicator is present in the event data.

19. A method for performing forensics operation on event data, the method comprising:

receiving a forensics query that specifies one or more search parameters for performing a forensics operation on event data, the event data including an obfuscated representation of entity identifiers associated with different events occurring on a client system;

identifying one or more cyber-threats that satisfy at least one of the search parameters, each threat indicator associated with at least one potential cyber-threat; and

performing a real-time forensics operations on the event data to determine whether the event data is indicative of at least one of the cyber-threats.

22. A computer readable medium storing instructions that, when executed by a processor, cause the processor to:

receive event data from a client system, the event data including an obfuscated representation of entity identifiers associated with different events occurring on the client system;

determine that the event data is associated with at least one cyber-threat; and

report the presence of the at least one cyber-threat to the client system.

23. The computer readable medium of claim 22, wherein determining that the event data is associated with at least one cyber-threat comprises comparing the event data with one or more threat indicators to determine whether at least one threat indicator is present in the event data, each threat indicator associated with at least one potential cyber-threat.

24. The computer readable medium of claim 23, wherein the event data comprises an indexed hierarchy of events, a first level in the indexed hierarchy associated with a different time-based granularity relative to a second level in the indexed hierarchy.

25. The computer readable medium of claim 24, wherein comparing the event data with the one or more threat indicators comprises comparing the first level in the indexed hierarchy with the one or more threat indicators and proceeding to the second level only when a match exists between the first level and at least one of the one or more threat indicators.