Policy based capture with replay to virtual machine

• US 8,291,499 B2
• Filed: 03/16/2012
• Issued: 10/16/2012
• Est. Priority Date: 04/01/2004
• Status: Active Grant

• Current Assignee: Fireeye Security Holdings US LLC
• Original Assignee: FireEye, Inc.
• Inventors: Aziz, Ashar, Drzewiecki, Adrian, Radhakrishnan, Ramesh, Manni, Jayaraman, Amin, Muhammad
• Primary Examiner(s): Davis, Zachary A
• Application Number:
  US13/423,057
• Publication Number:
  US 20120174186A1
• Time in Patent Office: 214 Days
• Field of Search: 713/182, 713/188, 713/187, 726 22- 25, 726/1
• US Class Current: 726/24
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 2009/45591 Monitoring or debugging support
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 9/45537 Provision of facilities of other operating environments, e.g. WINE I/O emulation G06F13/105
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/1491 : using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A suspicious activity capture system can comprise a tap configured to copy network data from a communication network, and a controller. The controller is coupled to the tap and is configured to receive the copy of the network data from the tap, analyze the copy of the network data to flag the network data as suspicious, and simulate transmission of the network data to a destination device.

Claims

1. An unauthorized activity capture system comprising:

a tap configured to copy network data from a communication network; and

a controller coupled to the tap and configured to receive the copy of the network data from the tap, compare the copy of the network data to at least one policy to determine if the copy of the network data has one or more characteristics of a computer worm, flag at least a portion of the copy of the network data as suspicious by flagging the at least a portion of the copy of the network data for replay in an analysis environment based upon the determination that the at least a portion of the compared copy of the network data has one or more characteristics of a computer worm, and replay transmission of the suspicious, flagged network data copied from the communication network to a destination device.

2. The unauthorized activity capture system of claim 1 wherein the at least one policy is configured to detect network data directed to a honey pot.

3. The unauthorized activity capture system of claim 1 wherein the at least one policy is configured to detect network data directed to a device that includes trade secret data.

4. The unauthorized activity capture system of claim 1 wherein the at least one policy is configured to detect an identity of a device to which network data is directed.

5. The unauthorized activity capture system of claim 1 wherein the at least one policy is configured to detect network data transmitted from a device that does not transmit network data in normal operation.

6. The unauthorized activity capture system of claim 1 wherein the at least one policy is configured to detect network data attempting to gain rights within the communication network.

7. The unauthorized activity capture system of claim 1 wherein the controller further comprises a virtual machine pool configured to store a virtual machine.

8. The unauthorized activity capture system of claim 1 wherein the one or more characteristics of a computer worm include being configured to duplicate itself for propagation.

9. An unauthorized activity capture system comprising:

a tap configured to copy network data from a communication network; and

a controller configured to receive the copy of the network data from the tap, compare the copy of the network data to at least one policy within a policy engine to determine if the copy of the network data has one or more characteristics of a computer worm, flag at least a portion of the copy of the network data as suspicious by flagging the at least a portion of the copy of the network data for replay in an analysis environment based upon the determination that the at least a portion of the analyzed copy of the network data has one or more characteristics of a computer worm, retrieve a virtual machine, configure a replayer to replicate the flagged at least a portion of the compared copy of the network data which contains suspicious activity to the virtual machine, and identify unauthorized activity by analyzing a behavior of the virtual machine in response to the replication of the flagged at least a portion of the compared copy of the network data.

10. The unauthorized activity capture system of claim 9 wherein the at least one policy is configured to detect network data directed to a honey pot.

11. The unauthorized activity capture system of claim 9 wherein the at least one policy is configured to detect network data directed to a device that includes trade secret data.

12. The unauthorized activity capture system of claim 9 wherein the at least one policy is configured to detect an identity of a device to which network data is directed.

13. The unauthorized activity capture system of claim 9 wherein the at least one policy is configured to detect network data transmitted from a device that does not transmit network data in normal operation.

14. The unauthorized activity capture system of claim 9 wherein the at least one policy is configured to detect network data attempting to gain rights within the communication network.

15. The unauthorized activity capture system of claim 9 wherein the unauthorized activity is the result of malware associated with the network data.

16. The unauthorized activity capture system of claim 9 wherein the controller further comprises a virtual machine pool configured to store the virtual machine.

17. The unauthorized activity capture system of claim 9 wherein the flagged at least a portion of the copy of network data is replicated between the replayer and the virtual machine over a virtual switch.

18. The unauthorized activity capture system of claim 9 wherein the one or more characteristics of a computer worm include being configured to duplicate itself for propagation.

19. An unauthorized activity capture method comprising:

copying network data from a communication network;

comparing the copied network data to at least one policy to determine if the copied network data has one or more characteristics of a computer worm;

flagging at least a portion of the copied network data as suspicious by flagging the at least a portion of the copy of the network data for replay in an analysis environment based upon the determination that the at least a portion of the compared copied network data has one or more characteristics of a computer worm; and

replaying transmission of the flagged at least a portion of the compared copied network data which was copied from the communication network to a destination device to identify unauthorized activity based on playback of the flagged suspicious at least a portion of the compared copy of the network data.

20. The method of claim 19 wherein replaying the transmission of the flagged at least a portion of the compared copied network data comprises:

retrieving a virtual machine configured to receive the flagged at least a portion of the compared copied network data;

configuring a replayer to transmit the flagged at least a portion of the compared copied network data to the virtual machine; and

performing a simulation by transmitting the flagged at least a portion of the compared copied network data to the virtual machine.

21. The method of claim 20 wherein retrieving the virtual machine includes accessing a virtual machine pool.

22. The method of claim 20 wherein the flagged at least a portion of the compared copied network data is transmitted between the replayer and the virtual machine over a virtual switch.

23. The method of claim 19 wherein the at least one policy is configured to detect network data directed to a honey pot.

24. The method of claim 19 wherein the at least one policy is configured to detect network data directed to a device that includes trade secret data.

25. The method of claim 19 wherein the at least one policy is configured to detect an identity of a device to which network data is directed.

26. The method of claim 19 wherein the at least one policy is configured to detect network data transmitted from a device that does not transmit network data in normal operation.

27. The method of claim 19 wherein the at least one policy is configured to detect network data attempting to gain rights within the communication network.

28. The method of claim 19 wherein identifying the unauthorized activity includes identifying malware associated with the network data.

29. The method of claim 19 wherein the one or more characteristics of a computer worm include being configured to duplicate itself for propagation.

30. A non-transitory computer readable medium comprising:

computer readable code configured to direct a processor to copy network data from a communication network, compare the copied network data to at least one policy within a policy engine to determine if the copied network data has one or more characteristics of a computer worm, flag at least a portion of the compared copied network data as suspicious by flagging the at least a portion of the copy of the network data for replay in an analysis environment based upon the determination that the at least a portion of the compared copied network data has one or more characteristics of a computer worm, and replay transmission of the flagged suspicious at least a portion of the compared copied network data copied from the network to a destination device to identify unauthorized activity based on playback of the flagged suspicious at least a portion of the compared copied network data.