METHOD AND APPARATUS FOR IDENTIFYING AND DETECTING THREATS TO AN ENTERPRISE OR E-COMMERCE SYSTEM

• US 20160381077A1
• Filed: 09/07/2016
• Published: 12/29/2016
• Est. Priority Date: 11/04/2014
• Status: Active Grant

• Current Assignee: Corelight, Inc.
• Original Assignee: Patternex, Inc. (Corelight, Inc.)
• Inventors: Bassias, Constantinos, Korrapati, Vamsi, Veeramachaneni, Uday
• Granted Patent: US 9,661,025 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06N 5/047 Pattern matching networks; Rete networks
• CPC Class Codes: G06N 7/01 Probabilistic graphical models, e.g. probabilistic networks
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Methods and apparatuses for identifying and detecting threats to an enterprise or e-commerce system are disclosed, including grouping log lines belonging to one or more log line parameters from one or more enterprise or e-commerce system data sources and/or from incoming data traffic to the enterprise or e-commerce system; extracting one or more features from the grouped log lines into one or more features tables; using one or more statistical models on the one or more features tables to identify statistical outliers; labeling the statistical outliers to create one or more labeled features tables; using the one or more labeled features tables to create one or more rules for identifying threats to the enterprise or e-commerce system; and using the one or more rules on incoming enterprise or e-commerce system data traffic to detect threats to the enterprise or e-commerce system. Other embodiments are described and claimed.

Claims

1. A method for identifying and detecting threats to an enterprise or e-commerce system, the method comprising:

grouping log lines belonging to one or more log line parameters from one or more enterprise or e-commerce system data sources and/or from incoming data traffic to the enterprise or e-commerce system;

extracting one or more features from the grouped log lines into one or more features tables;

using one or more statistical models on the one or more features tables to identify statistical outliers;

labeling, in response to received instructions, the statistical outliers to create one or more labeled features tables; and

using the one or more labeled features tables to create one or more adaptive rules for performing at least one of;

further refining statistical models for identification of statistical outliers; and

preventing access by categorized threats to the enterprise or e-commerce system.

2. The method of claim 1, wherein the method further comprises ranking and rearranging the one or more log line parameters of the one or more features tables by probability.

3. The method of claim 1, the method further comprising using the one or more adaptive rules on the incoming data traffic to the enterprise or e-commerce system to detect threats to the enterprise or e-commerce system.

4. The method of claim 2, wherein the using the one or more rules on the incoming data traffic to the enterprise or e-commerce system to detect threats to the enterprise or e-commerce system is in real-time.

5. The method of claim 2, the method further comprising using the detected threats to modify the one or more statistical models and/or the one or more rules for identifying threats to the enterprise or e-commerce system.

6. The method of claim 2, the method further comprising blocking and/or challenging the packet flow of the detected threats.

7. The method of claim 1, wherein the one or more log line parameters comprises at least one of:

user ID, session, IP address, and URL query.

8. The method of claim 1, wherein the one or more enterprise or e-commerce system data sources comprises at least one of:

web server access logs, firewall logs, packet captures per application, active directory logs, DNS logs, forward proxy logs, external threat feeds, AV logs, user logon audits, DLP logs, LB logs, IPS/IDS logs, black listed URLs, black listed IP addresses, and black listed referrers.

9. The method of claim 1, wherein the one or more features comprises at least one of:

user session duration, length of user URL query, number of characters of user URL query, number of digits of user URL query, number of punctuations of user URL query, number of requests in user session, average time between clicks in user session, user session click rate, percentage of image requests in user session, percentage of 4xx responses in user session, percentage of 3xx responses in user session, percentage of 2xx responses in user session, percentage of zip responses in user session, percentage of binary responses in user session, percentage of head requests in user session, number of checkouts, number of credit cards added, number of promo codes added, number of gift cards added, number of times items were shipped overnight, number of times new shipping address was added, number of login failures, number of login successes, number of password resets, and total number of requests.

10. The method of claim 1, wherein the one or more statistical models comprises at least one of:

Clustering models, Hidden Markov model, and Copula models.

11. The method of claim 1, wherein the one or more rules for identifying threats to the enterprise or e-commerce system comprises a random forest classifier, learning vector quantization, and/or a neural network.

12. The method of claim 1, wherein the using one or more statistical models on the one or more features comprises using a bag of little bootstraps sampling.

13. The method of claim 1, wherein the using one or more statistical models on the one or more features tables to identify statistical outliers comprises:

distributing one or more features from the one or more features tables across two or more servers;

using the one or more statistical models on the distributed one or more features; and

aggregating results from the using the one or more statistical models on the distributed one or more features.

14. The method of claim 13, wherein the using the one or more statistical models on the distributed one or more features comprises using a bag of little bootstraps sampling.

15. The method of claim 1, wherein the labeling the statistical outliers to create one or more labeled features tables comprises presenting an administrator the statistical outliers for identification as malicious, non-malicious, or other administrator defined label.

16. An apparatus for identifying and detecting threats to an enterprise or e-commerce system, the apparatus comprising:

one or more processors;

system memory coupled to the one or more processors;

one or more non-transitory memory units coupled to the one or more processors;

and

threat identification and detection code stored on the one or more non-transitory memory units that when executed by the one or more processors are configured to perform a method, comprising;

grouping log lines belonging to one or more log line parameters from one or more enterprise or e-commerce system data sources and/or from incoming data traffic to the enterprise or e-commerce system;

extracting one or more features from the grouped log lines into one or more features tables;

using one or more statistical models on the one or more features tables to identify statistical outliers;

labeling, in response to received instructions, the statistical outliers to create one or more labeled features tables; and

using the one or more labeled features tables to create one or more adaptive rules for performing at least one of;

further refining statistical models for identification of statistical outliers; and

preventing access by categorized threats to the enterprise or e-commerce system.

17. The apparatus of claim 16, wherein the method further comprises ranking and rearranging the one or more log line parameters of the one or more features tables by probability.

18. The apparatus of claim 16, wherein the method further comprises using the one or more rules on the incoming data traffic to the enterprise or e-commerce system to detect threats to the enterprise or e-commerce system.

19. The apparatus of claim 17, wherein the using the one or more rules on the incoming data traffic to the enterprise or e-commerce system to detect threats to the enterprise or e-commerce system is in real-time.

20. The apparatus of claim 17, wherein the method further comprises using the detected threats to modify the one or more statistical models and/or the one or more rules for identifying threats to the enterprise or e-commerce system.

21. The apparatus of claim 17, wherein the method further comprises blocking and/or challenging the packet flow of the detected threats.

22. The apparatus of claim 16, wherein the one or more log line parameters comprises at least one of:

user ID, session, IP address, and URL query.

23. The apparatus of claim 16, wherein the one or more enterprise or e-commerce system data sources comprises at least one of:

web server access logs, firewall logs, packet captures per application, active directory logs, DNS logs, forward proxy logs, external threat feeds, AV logs, user logon audits, DLP logs, LB logs, IPS/IDS logs, black listed URLs, black listed IP addresses, and black listed referrers.

24. The apparatus of claim 16, wherein the one or more features comprises at least one of:

user session duration, length of user URL query, number of characters of user URL query, number of digits of user URL query, number of punctuations of user URL query, number of requests in user session, average time between clicks in user session, user session click rate, percentage of image requests in user session, percentage of 4xx responses in user session, percentage of 3xx responses in user session, percentage of 2xx responses in user session, percentage of zip responses in user session, percentage of binary responses in user session, percentage of head requests in user session, number of checkouts, number of credit cards added, number of promo codes added, number of gift cards added, number of times items were shipped overnight, number of times new shipping address was added, number of login failures, number of login successes, number of password resets, and total number of requests.

25. The apparatus of claim 16, wherein the one or more statistical models comprises at least one of:

Clustering models, Hidden Markov model, and Copula models.

26. The apparatus of claim 16, wherein the one or more rules for identifying threats to the enterprise or e-commerce system comprises a random forest classifier, learning vector quantization, and/or a neural network.

27. The apparatus of claim 16, wherein the using one or more statistical models on the one or more features comprises using a bag of little bootstraps sampling.

28. The apparatus of claim 16, wherein the using one or more statistical models on the one or more features tables to identify statistical outliers comprises:

distributing one or more features from the one or more features tables across two or more servers;

using the one or more statistical models on the distributed one or more features; and

aggregating results from the using the one or more statistical models on the distributed one or more features.

29. The apparatus of claim 28, wherein the using the one or more statistical models on the distributed one or more features comprises using a bag of little bootstraps sampling.

30. The apparatus of claim 16, wherein the labeling the statistical outliers to create one or more labeled features tables comprises presenting an administrator the statistical outliers for identification as malicious, non-malicious, or other administrator defined label.