Behavior-based security system

• US 8,424,072 B2
• Filed: 03/09/2010
• Issued: 04/16/2013
• Est. Priority Date: 03/09/2010
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Pullikottil, Jack, Manu, Mitica
• Primary Examiner(s): Mehedi, Morshed
• Application Number:
  US12/720,264
• Publication Number:
  US 20110225644A1
• Time in Patent Office: 1,134 Days
• Field of Search: 726/7, 726/23
• US Class Current: 726/7
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

Described herein are techniques for operating a security server to determine behavioral profiles for entities in a network and to detect attacks or unauthorized traffic in a network based on those behavioral profiles. In one technique, a behavioral profile may be generated based on requests for security operations to be performed that are received at a security server from an entity in a network. The behavioral profile may be generated using learning techniques, including artificial intelligence techniques such as neural networks. When the security server receives from an entity one or more requests for security operations to be performed, the security server may compare properties of the requests to the behavioral profile for the entity and properties of requests commonly sent by the entity. The security server may determine a similarity score indicating how similar the request are to the behavioral profile and to requests commonly received from the entity.

Claims

1. A method of detecting unauthorized access to a network, the network comprising at least one client computing device and at least one security server regulating access to the network for the at least one client computing device, the method comprising:

(A) receiving, at the at least one security server from a client computing device, at least one request for a security operation to be performed for an entity;

(B) using a processor, comparing properties of the at least one request to a behavioral profile for the entity to determine a similarity score for the at least one request, the similarity score is a probability of similarity that indicates a degree of similarity of the at least one request to the behavior profile of the entity, the behavioral profile generated by an artificial intelligence technique by analyzing properties of a plurality of previous requests for security operations transmitted by the entity to determine properties of authorized access requests to the network to identify expected behaviors for the entity;

(C) when the similarity score is below a threshold, increasing security restrictions on the entity, wherein the act (C) of increasing the security restrictions comprises;

(C1) performing at least one security check to confirm an identity of the entity; and

(D) adjusting the behavioral profile based on the properties of the at least one request,

wherein the act (D) of adjusting is performed when the similarity score is above the threshold and/or when the entity passes the at least one security check.

2. The method of claim 1, further comprising:

(E) when the similarity score is below the threshold, increasing a security level and/or an amount of resources available to a target of the at least one request.

3. The method of claim 1, wherein the analyzing is performed in real time by observing each of the plurality of requests as they are transmitted by the entity.

4. The method of claim 1, wherein the behavior profile is further generated by analyzing respective requests for each entity communicating in the network and establishing a respective behavioral profile for each of the entities based on the respective requests.

5. The method of claim 4, wherein the behavioral profile is further generated by

establishing at least one group behavioral profile based at least in part on a plurality of respective behavioral profiles, the group behavioral profile identifying properties of requests previously transmitted by entities in the group, and

wherein the act (B) of comparing further comprises second comparing the properties of the at least one request to a group behavioral profile for a group to which the entity belongs and determining the similarity score based at least in part on the second comparing.

6. The method of claim 5, wherein a group of the at least one group includes all entities communicating in the network.

7. The method of claim 1, further comprising:

(E) providing the behavioral profile for the entity to the client computing device.

8. The method of claim 1, wherein the act (C) of increasing comprises restricting access by the entity to at least one network resource when the similarity is below a first threshold, and blocking all communications by the entity if the similarity is below a second threshold.

9. At least one computer-readable storage memory encoded with computer-executable instructions that, when executed by a computer cause the computer to carry out, in a network comprising at least one client computing device and at least one security server regulating access to the network for the at least one client computing device, a method of detecting unauthorized access to the network, the method comprising:

(A) establishing at least one respective behavioral profile using an artificial intelligence technique to analyze properties of a plurality of requests for security operations to be performed transmitted by each entity communicating in the network, each respective behavioral profile being associated with an entity and identifying properties of requests having authorized access to the network transmitted by the entity;

(B) establishing at least one group behavioral profile based at least in part on a plurality of respective behavioral profiles, each group behavioral profile identifying properties of requests having authorized access to the network transmitted by entities in the group;

(C) receiving at the at least one security server from a client computing device at least one request for a security operation to be performed for a particular entity;

(D) identifying a group to which a particular entity belongs;

(E) comparing properties of the at least one request to a respective behavioral profile for the entity and to a group behavioral profile for the group to determine a similarity score for the at least one request, the similarity score is a probability of similarity that indicates a degree of similarity of the at least one request to the behavior profile for the entity and the group behavior profile for the group; and

(F) when the similarity score is below a threshold, increasing security restrictions on the entity, wherein the act (F) of increasing comprises restricting access by the entity to at least one network resource when the similarity is below a first threshold, and blocking all requests by the entity if the similarity is below a second threshold.

10. The at least one computer-readable memory of claim 9, further comprising:

(G) if the similarity score is above the threshold, adjusting the behavioral profile based on the properties of the at least one request.

11. The at least one computer-readable memory of claim 9, wherein the comparing of act (E) comprises using a neural network to perform the comparing.

12. The at least one computer-readable memory of claim 9, wherein the group includes all entities communicating in the network.

13. An apparatus comprising:

at least one network adapter; and

at least one processor adapted to;

receive, via the at least one network adapter, a behavioral profile for an entity from at least one security server of a network to which the at least one network adapter has established a connection;

receive at least one request to transmit into the network, on behalf of the entity, at least one request for a security operation to be performed;

compare properties of the at least one request to the behavioral profile for the entity to determine a similarity score for the at least one request, the similarity score is a probability of similarity that indicates a degree of similarity of the at least one request to the behavior profile of the entity, the behavioral profile generated by an artificial intelligence technique by analyzing properties of a plurality of previous requests for security operations transmitted by the entity to determine properties of authorized access requests to the network to identify expected behaviors for the entity;

when the similarity score is below a threshold, prevent the at least one request from being transmitted into the network

receive, via the at least one network adapter, a second behavioral profile from the at least one security server, the second behavioral profile being a group behavioral profile identifying properties of requests for security operations to be performed having authorized access to the network transmitted by entities in the group; and

determine the similarity score for the at least one request based at least in part on comparing the properties of the at least one request to the group behavioral profile.

14. The apparatus of claim 13, wherein the at least one processor is further adapted to prevent all communications from the entity from being transmitted into the network when the similarity score is below the threshold.

15. The apparatus of claim 13, wherein the at least one processor is further adapted to adjust the behavioral profile based on the properties of the at least one request when the similarity score is above the threshold.