Tactical and strategic attack detection and prediction

• US 7,530,105 B2
• Filed: 03/20/2007
• Issued: 05/05/2009
• Est. Priority Date: 03/21/2006
• Status: Active Grant

• Current Assignee: Northrop Grumman Systems Corporation (Northrop Grumman Corporation)
• Original Assignee: 21st Century Technologies, Inc.
• Inventors: Keen, Arthur A., Morgan, Robert J., Gilbert, Logan
• Primary Examiner(s): Parthasarathy; Pramila
• Application Number:
  US11/688,540
• Publication Number:
  US 20070226796A1
• Time in Patent Office: 777 Days
• Field of Search: None
• US Class Current: 726/22
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

NETWAR provides a utility that enables detection of both tactical and strategic threats against an individual entity and interrelated/affiliated networks of entities. A distributed network of sensors and evaluators are utilized to detect tactical attacks against one or more entities. Events on the general network are represented as an input graph, which is searched for matches of example pattern graphs that represent tactical attacks. The search is performed using a scalable graph matching engine and an ontology that is periodically updated by a subject matter expert or analyst. NETWAR provides the functionality to determine/understand the strategic significance of the detected tactical attacks by correlating detected tactical attacks on the individual entities to identify the true motive of these attacks as a strategic attack. NETWAR also provides predictive capability to predict future entities and sub-entities that may be targeted based on evaluation of the attack data.

Claims

1. A method comprising:

receiving input data representing activities and events on a network;

detecting tactical attacks against one or more entities by analyzing the input data;

dynamically determining when the one or more tactical attacks are indicative of a strategic attack; and

matching strategic attack graph patterns against an input graph representing the relationships and affiliations among the entities and the tactical attacks the entities have been victim to, in order to determine a strategic significance of detected tactical attacks.

2. The method of claim 1, wherein said dynamically determining comprises:

evaluating a strategic motive, tactical means, and tactical opportunities (MMO) of a potential attacker by detecting one or more strategic actions within the input data, which identify the strategic attack; and

fingerprinting the MMO for future detection of similar strategic attacks, said MMO identifying reconnaissance and attack activities.

3. The method of claim 2, wherein:

said identifying of reconnaissance and attack activities involves accessing one or more automated reconnaissance tools, including open access and online tools and tools designed for supporting strategic attack detection to identify information vulnerabilities;

said method further comprising;

observing, via the online tools, intelligence gathering, planning, testing, and collaboration activities performed on the network; and

generating multiple MMOs based on observed, known, and deduced attack and reconnaissance patterns.

4. The method of claim 1, wherein said dynamically determining further comprises:

when an entity that may potentially be attacked has vulnerabilities outside of the entity'"'"'s own network, extrapolating beyond a network of the entity being attacked to enable detection of strategic attacks in a supply chain and other domains of affiliated entities.

5. The method of claim 1, further comprising:

generating a user interface for enabling input, manipulation and control of information and data utilized during the dynamically determining step; and

outputting results of said dynamically determining step via the user interface.

6. The method of claim 1, further comprising:

forwarding information related to a detected strategic attack to an analyst for evaluation; and

enabling analyst input in assessing a level of seriousness of a detected strategic attack.

7. The method of claim 1, further comprising detecting supply chain attacks and technology-based attacks directed at a target system via an intermediary entity.

8. The method of claim 1, further comprising:

analyzing the detected tactical attacks and strategic attacks;

predicting possible occurrences of a future attack based on said analyzing a known context for precipitating said future attacks; and

outputting an alert about the predicted future attacks.

9. The method of claim 1, further comprising performing strategic attack detection within an in-memory graph search function, having a display architecture in which the set of all graph elements is known and available.

10. A method comprising:

receiving input data representing activities and events on a network;

detecting tactical attacks against one or more entities by analyzing the input data;

dynamically determining when the one or more tactical attacks are indicative of a strategic attack; and

correlating events from multiple sensors throughout the network to understand tactical attacks, wherein said correlating is completed via one or more graph analysis engines (GAEs) and includes detecting ongoing tactical attacks, performing forensics on completed tactical attacks, and predicting likely conclusions to ongoing attacks.

11. The method of claim 10, further comprising:

receiving, via the GAE, input data from data sources/sensors; and

performing a data fusion on the input data utilizing a domain ontology to fuse the input data into an Attributed Relational Graph (ARG);

wherein the GAE utilizes the domain ontology to (1) map sensor events to probable actions, (2) define threat patterns, and (3) provide ontological services to the pattern matcher.

12. A method comprising:

receiving input data representing activities and events on a network;

detecting tactical attacks against one or more entities by analyzing the input data;

dynamically determining when the one or more tactical attacks are indicative of a strategic attack;

generating an input graph representing the input data;

sampling and evaluating the input data using a graph-based search engine;

performing graph matching, anomaly detection and social network analysis within the input graph to determine presence in the input graph of tactical and strategic attack patterns; and

dynamically determining a strategic motive, tactical means, and tactical opportunities (MMO) of an attacker; and

automatically detecting and predicting strategic attacks by detecting strategic actions identified within the input graph and comprehending the MMO of the potential attacker.

13. A method comprising:

receiving input data representing activities and events on a network;

detecting tactical attacks against one or more entities by analyzing the input data;

dynamically determining when the one or more tactical attacks are indicative of a strategic attack;

enabling creation of an ontology of example attack patterns that represent known and potential attack patterns; and

enabling updates of the ontology to include newly detected attack patterns and remove patterns that are no longer classified as attack patterns.

14. The method of claim 13, wherein said enabling creation further comprises:

storing graph patterns that identify tactical attacks within the network in a tactical attack ontology; and

storing graph patterns that identify strategic attacks within the network in a strategic attack ontology;

wherein said strategic attack ontology is cyber ontology including network vulnerability, network attacks and network threats.

15. A method comprising:

receiving input data representing activities and events on a network;

detecting tactical attacks against one or more entities by analyzing the input data;

dynamically determining when the one or more tactical attacks are indicative of a strategic attack;

establishing a sensitivity cutoff, which indicates a match percentage less than a complete match desired to determine when a detected pattern is a likely candidate as an attack pattern;

performing an inexact matching search utilizing said sensitivity cutoff;

when an inexact match is identified, evaluating if the inexact match is a match of one of a current attack, a future attack, and a failed attack;

predicting a likely outcome of an ongoing attacks by analyzing partial matches of attack patterns, wherein, if a predicted attack step in the attack pattern is not observed over a pre-established time, the attack is assumed to have failed;

when the inexact match is identified as one of a current attack, a future attack and a failed attack, updating a history table of inexact matches and forwarding the inexact match along with corresponding context information for review;

when the inexact match is confirmed by an analyst as an attack, updating the ontology of attack patterns to include the inexact match; and

when the inexact match indicates a possible future predicted attack, generating an alert predicting the future attack.

16. The method of claim 15, further comprising:

when the inexact match is within a pre-set variance for the sensitivity cutoff;

tagging the sequence of activities as a potential attack;

monitoring subsequent activity to determine if the potential attack evolves into an actual attack; and

updating the ontology with a morphed attack pattern when the inexact match is determined to be an attack.

17. The method of claim 16, further comprising:

automatically accounting for evolving changes in attack pattern to enable detection of evolving attack patterns, wherein an evolved attack pattern is detected without requiring a full attack signature from input graph comparison.

18. A method comprising:

receiving input data representing activities and events on a network;

detecting tactical attacks against one or more entities by analyzing the input data;

dynamically determining when the one or more tactical attacks are indicative of a strategic attack;

storing the input data to a scalable database capable of managing a large amount of data at a time;

monitoring the network in real time;

updating the scalable database with new input data generated from the network; and

performing the analysis of the input data for detection of strategic attacks via a database graph search functionality of a graph analysis tool capable of retrieving graph elements directly from the scalable database and providing direct queries to the input graph provided within the scalable database;

wherein a clear separation of threat semantics and graph search functions for attack patterns is provided.

19. The method of claim 18, further comprising:

converting ontology-based patterns into a precise pattern query language (PQL) supported by the graph analysis tool; and

decomposing complete attack patterns stored in the strategic attack ontology into meaningful time-based sub-patterns that will match sequences of activity that are precursors to becoming a significant attack threat, wherein said decomposing enables a predictive capability for future attacks.

20. A method comprising:

receiving input data representing activities and events on a network;

detecting tactical attacks against one or more entities by analyzing the input data;

dynamically determining when the one or more tactical attacks are indicative of a strategic attack;

sequencing input data points by time; and

converting the sequenced input data points into textual descriptions of network activity.

21. A method comprising:

receiving input data representing activities and events on a network;

detecting tactical attacks against one or more entities by analyzing the input data;

dynamically determining when the one or more tactical attacks are indicative of a strategic attack;

providing fusion of data at a strategic level, wherein said fusion accounts for inputs from Internet sensors, open sources, and search engine statistics, wherein the strategic level fusion utilizes a business threat ontology and strategic level GAEs to understand strategic attacks;

wherein the business threat ontology associated with strategic level GAEs contain one or more of;

(1) descriptions of specifically identified target entities;

(2) interdependencies between the individual target entities, including as supply chain dependencies;

(3) business functions and services of the target entities;

(4) relationships between the network assets and business assets of the target entities, including strategic information, functions, and services; and

(5) information about strategic threats and the threat'"'"'s likely motives;

wherein the strategic level fusion provides attack patterns for one or more of;

(1) supply chain availability attacks;

(2) industrial espionage focused on exfiltration of information about specific technologies; and

(3) strategic infiltration of an infrastructure to be leveraged in the future.

22. A computer program product comprising:

a computer readable medium; and

program code on the computer readable medium that when executed by a processor provides the functions of;

receiving input data representing activities and events on a network;

detecting tactical attacks against one or more entities by analyzing the input data;

dynamically determining when the one or more tactical attacks are indicative of a strategic attack;

matching strategic attack graph patterns against an input graph representing the relationships and affiliations among the entities and the tactical attacks the entities have been victim to, in order to determine a strategic significance of detected tactical attacks; and

correlating events from multiple sensors throughout the network to understand tactical attacks, wherein said correlating is completed via one or more graph analysis engines (GAEs) and includes detecting ongoing tactical attacks, performing forensics on completed tactical attacks, and predicting likely conclusions to ongoing attacks.

23. The computer program product of claim 22, wherein said code for dynamically determining comprises code for:

evaluating a strategic motive, tactical means, and tactical opportunities (MMO) of a potential attacker by detecting one or more strategic actions within the input data, which identify the strategic attack; and

fingerprinting the MMO for future detection of similar strategic attacks, said MMO identifying reconnaissance and attack activities.

24. The computer program product of claim 23, wherein:

said code for identifying of reconnaissance and attack activities comprises code for accessing one or more automated reconnaissance tools, including open access and online tools and tools designed for supporting strategic attack detection to identify information vulnerabilities;

said program code further comprising code for;

observing, via the online tools, intelligence gathering, planning, testing, and collaboration activities performed on the network; and

generating multiple MMOs based on observed, known, and deduced attack and reconnaissance patterns.

25. The computer program product of claim 22, further comprising code for:

receiving, via the GAE, input data from data sources/sensors; and

performing a data fusion on the input data utilizing a domain ontology to fuse the input data into an Attributed Relational Graph (ARG);

wherein the GAE utilizes the domain ontology to (1) map sensor events to probable actions, (2) define threat patterns, and (3) provide ontological services to the pattern matcher.

26. The computer program product of claim 22, wherein said code for dynamically determining further comprises code for:

when an entity that may potentially be attacked has vulnerabilities outside of the entity'"'"'s own network, extrapolating beyond a network of the entity being attacked to enable detection of strategic attacks in a supply chain and other domains of affiliated entities.

27. The computer program product of claim 22, further comprising code for:

analyzing the detected tactical attacks and strategic attacks;

predicting possible occurrences of a future attack based on said analyzing a known context for precipitating said future attacks; and

outputting an alert about the predicted future attacks.

28. A computer program product comprising:

a computer readable medium; and

program code on the computer readable medium that when executed by a processor provides the functions of;

receiving input data representing activities and events on a network;

detecting tactical attacks against one or more entities by analyzing the input data;

dynamically determining when the one or more tactical attacks are indicative of a strategic attack;

establishing a sensitivity cutoff, which indicates a match percentage less than a complete match desired to determine when a detected pattern is a likely candidate as an attack pattern;

performing an inexact matching search utilizing said sensitivity cutoff;

when an inexact match is identified, evaluating if the inexact match is a match of one of a current attack, a future attack, and a failed attack;

predicting a likely outcome of an ongoing attacks by analyzing partial matches of attack patterns, wherein, if a predicted attack step in the attack pattern is not observed over a pre-established time, the attack is assumed to have failed;

when the inexact match is identified as one of a current attack, a future attack and a failed attack, updating a history table of inexact matches and forwarding the inexact match along with corresponding context information for review;

when the inexact match is confirmed by an analyst as an attack, updating the ontology of attack patterns to include the inexact match;

when the inexact match indicates a possible future predicted attack, generating an alert predicting the future attack.

29. The computer program product of claim 28, further comprising code for:

when the inexact match is within a pre-set variance for the sensitivity cutoff;

tagging the sequence of activities as a potential attack;

monitoring subsequent activity to determine if the potential attack evolves into an actual attack; and

updating the ontology with a morphed attack pattern when the inexact match is determined to be an attack.

30. A computer program product comprising:

a computer readable medium; and

program code on the computer readable medium that when executed by a processor provides the functions of;

receiving input data representing activities and events on a network;

detecting tactical attacks against one or more entities by analyzing the input data;

dynamically determining when the one or more tactical attacks are indicative of a strategic attack;

storing the input data to a scalable database capable of managing a large amount of data at a time;

monitoring the network in real time;

updating the scalable database with new input data generated from the network; and

performing the analysis of the input data for detection of strategic attacks via a database graph search functionality of a graph analysis tool capable of retrieving graph elements directly from the scalable database and providing direct queries to the input graph provided within the scalable database;

wherein a clear separation of threat semantics and graph search functions for attack patterns is provided.

31. A computer program product comprising:

a computer readable medium; and

program code on the computer readable medium that when executed by a processor provides the functions of;

receiving input data representing activities and events on a network;

detecting tactical attacks against one or more entities by analyzing the input data;

dynamically determining when the one or more tactical attacks are indicative of a strategic attack;

converting ontology-based patterns into a precise pattern query language (PQL) supported by the graph analysis tool; and

decomposing complete attack patterns stored in the strategic attack ontology into meaningful time-based sub-patterns that will match sequences of activity that are precursors to becoming a significant attack threat, wherein said decomposing enables a predictive capability for future attacks.

32. A computer program product comprising:

a computer readable medium; and

program code on the computer readable medium that when executed by a processor provides the functions of;

receiving input data representing activities and events on a network;

detecting tactical attacks against one or more entities by analyzing the input data;

dynamically determining when the one or more tactical attacks are indicative of a strategic attack;

providing fusion of data at a strategic level, wherein said fusion accounts for inputs from Internet sensors, open sources, and search engine statistics, wherein the strategic level fusion utilizes a business threat ontology and strategic level GAEs to understand strategic attacks;

wherein the business threat ontology associated with strategic level GAEs contain one or more of;

(1) descriptions of specifically identified target entities;

(2) interdependencies between the individual target entities, including as supply chain dependencies;

(3) business functions and services of the target entities;

(4) relationships between the network assets and business assets of the target entities, including strategic information, functions, and services; and

(5) information about strategic threats and the threat'"'"'s likely motives;

wherein the strategic level fusion provides attack patterns for one or more of;

(1) supply chain availability attacks;

(2) industrial espionage focused on exfiltration of information about specific technologies; and

(3) strategic infiltration of an infrastructure to be leveraged in the future.

33. A system comprising:

a processor;

a memory coupled to the processor; and

a utility, which executes on the processor to provide the functions of;

receiving input data representing activities and events on a network;

detecting tactical attacks against one or more entities by analyzing the input data;

dynamically determining when the one or more tactical attacks are indicative of a strategic attack;

matching strategic attack graph patterns against an input graph representing the relationships and affiliations among the entities and the tactical attacks the entities have been victim to, in order to determine a strategic significance of detected tactical attacks; and

correlating events from multiple sensors throughout the network to understand tactical attacks, wherein said correlating is completed via one or more graph analysis engines (GAEs) and includes detecting ongoing tactical attacks, performing forensics on completed tactical attacks, and predicting likely conclusions to ongoing attacks.

34. The system of claim 33, wherein said code for dynamically determining comprises code for:

evaluating a strategic motive, tactical means, and tactical opportunities (MMO) of a potential attacker by detecting one or more strategic actions within the input data, which identify the strategic attack; and

fingerprinting the MINMO for future detection of similar strategic attacks, said MMO identifying reconnaissance and attack activities.

35. The system of claim 34, wherein:

said code for identifying of reconnaissance and attack activities comprises code for accessing one or more automated reconnaissance tools, including open access and online tools and tools designed for supporting strategic attack detection to identify information vulnerabilities;

said utility further comprising code for;

observing, via the online tools, intelligence gathering, planning, testing, and collaboration activities performed on the network; and

generating multiple MMOs based on observed, known, and deduced attack and reconnaissance patterns.

36. The system of claim 33, wherein said code for dynamically determining further comprises code for:

when an entity that may potentially be attacked has vulnerabilities outside of the entity'"'"'s own network, extrapolating beyond a network of the entity being attacked to enable detection of strategic attacks in a supply chain and other domains of affiliated entities.

37. The system of claim 33, said utility further comprising code for:

analyzing the detected tactical attacks and strategic attacks;

predicting possible occurrences of a future attack based on said analyzing a known context for precipitating said future attacks; and

outputting an alert about the predicted future attacks.

38. The system of claim 33, wherein said utility further comprises code for:

generating a highly usable thin client user interface; and

publishing forensic analysis and indications and warnings.

39. A system comprising:

a processor;

a memory coupled to the processor; and

a utility, which executes on the processor to provide the functions of;

receiving input data representing activities and events on a network;

detecting tactical attacks against one or more entities by analyzing the input data;

dynamically determining when the one or more tactical attacks are indicative of a strategic attack; and

correlating events from multiple sensors throughout the network to understand tactical attacks, wherein said correlating is completed via one or more graph analysis engines (GAEs) and includes detecting ongoing tactical attacks, performing forensics on competed tactical attacks, and predicting likely conclusions to ongoing attacks;

receiving, via the GAE, input data from data sources/sensors; and

performing a data fusion on the input data utilizing a domain ontology to fuse the input data into an Attributed Relational Graph (ARG);

wherein the GAE utilizes the domain ontology to (1) map sensor events to probable actions, (2) define threat patterns, and (3) provide ontological services to the pattern matcher.

40. A system comprising:

a processor;

a memory coupled to the processor; and

a utility, which executes on the processor to provide the functions of;

receiving input data representing activities and events on a network;

detecting tactical attacks against one or more entities by analyzing the input data;

dynamically determining when the one or more tactical attacks are indicative of a strategic attack;

establishing a sensitivity cutoff, which indicates a match percentage less than a complete match desired to determine when a detected pattern is a likely candidate as an attack pattern;

performing an inexact matching search utilizing said sensitivity cutoff;

when an inexact match is identified, evaluating if the inexact match is a match of one of a current attack, a future attack, and a failed attack;

predicting a likely outcome of an ongoing attacks by analyzing partial matches of attack patterns, wherein, if a predicted attack step in the attack pattern is not observed over a pre-established time, the attack is assumed to have failed;

when the inexact match is identified as one of a current attack, a future attack and a failed attack, updating a history table of inexact matches and forwarding the inexact match along with corresponding context information for review;

when the inexact match is confirmed by an analyst as an attack, updating the ontology of attack patterns to include the inexact match; and

when the inexact match indicates a possible future predicted attack, generating an alert predicting the future attack.

41. The system of claim 40, said utility further comprising code for:

when the inexact match is within a pre-set variance for the sensitivity cutoff;

tagging the sequence of activities as a potential attack;

monitoring subsequent activity to determine if the potential attack evolves into an actual attack; and

updating the ontology with a morphed attack pattern when the inexact match is determined to be an attack.

42. A system comprising:

a processor;

a memory coupled to the processor; and

a utility, which executes on the processor to provide the functions of;

receiving input data representing activities and events on a network;

detecting tactical attacks against one or more entities by analyzing the input data;

dynamically determining when the one or more tactical attacks are indicative of a strategic attack;

storing the input data to a scalable database capable of managing a large amount of data at a time;

monitoring the network in real time;

updating the scalable database with new input data generated from the network; and

performing the analysis of the input data for detection of strategic attacks via a database graph search functionality of a graph analysis tool capable of retrieving graph elements directly from the scalable database and providing direct queries to the input graph provided within the scalable database;

wherein a clear separation of threat semantics and graph search functions for attack patterns is provided.

43. The system of claim 42, said utility further comprising code for:

converting ontology-based patterns into a precise pattern query language (PQL) supported by the graph analysis tool; and

decomposing complete attack patterns stored in the strategic attack ontology into meaningful time-based sub-patterns that will match sequences of activity that are precursors to becoming a significant attack threat, wherein said decomposing enables a predictive capability for future attacks.

44. A system comprising;

a processor;

a memory coupled to the processor; and

a utility, which executes on the processor to provide the functions of;

receiving input data representing activities and events on a network;

detecting tactical attacks against one or more entities by analyzing the input data;

dynamically determining when the one or more tactical attacks are indicative of a strategic attack;

providing fusion of data at a strategic level, wherein said fusion accounts for inputs from Internet sensors, open sources, and search engine statistics, wherein the strategic level fusion utilizes a business threat ontology and strategic level GAEs to understand strategic attacks;

wherein the business threat ontology associated with strategic level GAEs contain one or more of;

(1) descriptions of specifically identified target entities;

(2) interdependencies between the individual target entities, including as supply chain dependencies;

(3) business functions and services of the target entities;

(4) relationships between the network assets and business assets of the target entities, including strategic information, functions, and services; and

(5) information about strategic threats and the threat'"'"'s likely motives;

wherein the strategic level fusion provides attack patterns for one or more of;

(1) supply chain availability attacks;

(2) industrial espionage focused on exfiltration of information about specific technologies; and

(3) strategic infiltration of an infrastructure to be leveraged in the future.

45. A system comprising:

a processor;

a memory coupled to the processor; and

a utility, which executes on the processor to provide the functions of;

receiving input data representing activities and events on a network;

detecting tactical attacks against one or more entities by analyzing the input data;

dynamically determining;

when the one or more tactical attacks are indicative of a strategic attack;

a graph annotation engine that receives an input of strategic attack ontology and tactical attack ontology;

a graph pattern compiler and a predictive graph pattern compiler, which both receive an input of said strategic attack ontology and tactical attack ontology, wherein said pattern compilers provide an output to the external match control function;

an “

events data”

-specific ingest module, which operates to convert specific types of network events data in its standard form into the normalized graph form;

a graph analysis tool which provides a graph search engine for searching through the normalized graph form;

an external match control function; and

an attack prediction engine.

46. A system comprising;

a processor;

a memory coupled to the processor; and

a utility, which executes on the processor to provide the functions of;

receiving input data representing activities and events on a network;

detecting tactical attacks against one or more entities by analyzing the input data;

dynamically determining when the one or more tactical attacks are indicative of a strategic attack; and

correlating events from multiple sensors throughout the network to understand tactical attacks, wherein said correlating is completed via one or more graph analysis engines (GAEs) and includes detecting ongoing tactical attacks, performing forensics on competed tactical attacks, and predicting likely conclusions to ongoing attacks;

further comprising a distributed network of GAEs utilized to capture data utilized to detect tactical attacks against target entities and evaluate a context and strategic significance of the tactical attacks.