Distributive security investigation

• US 8,839,419 B2
• Filed: 04/05/2008
• Issued: 09/16/2014
• Est. Priority Date: 04/05/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Hudis, Efim, Helman, Yair, Weisberg, Tomer, Yossef, Oren, Rafalovich, Ziv
• Primary Examiner(s): Zecher, Dede
• Assistant Examiner(s): AVERY, JEREMIAH L
• Application Number:
  US12/098,416
• Publication Number:
  US 20100031354A1
• Time in Patent Office: 2,355 Days
• Field of Search: None
• US Class Current: 726/22
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A security investigation system uses a central server to distribute requests for security information regarding an asset, receive responses, and manage the information in the responses in a case object. Requests may be distributed to various servers, each of which may have an agent that may receive the request, search various databases, logs, and other locations, and generate a response. A case object may be continually updated in some embodiments. The case object may be viewed, analyzed, and other requests generated using automated or manual tools. A case object may be sanitized for analysis without compromising sensitive information.

Claims

1. At a computer system, the computer system including a monitoring system and a case management system, the monitoring system configured to collect security information for one or more other devices, the case management system configured to investigate detected security state changes that occur at the one or more other devices, a method for investigating a security related issue, the method comprising:

receiving a security alert for a device, the device included in the one or more other devices, the security alert identifying an security related issue that occurred during operation of the device;

determining that the security related issue is of a sufficient priority to investigate by analyzing the security alert in view of collected security information for the one or more devices;

investigating the security related issue, including;

opening an investigation for the security related issue;

creating a case object for the investigation, the case object being a storage object configured to store information associated with the security related issue;

formulating a request to send to at least one device from among the one or more devices to request additional information associated with the security related issue, including;

identifying a plurality of assets related to the investigation;

adding a modifier to the request to request that additional information be returned with a specified level of detail;

sending the formulated request to the at least one device to request the additional information about the plurality of assets be returned to the computer system with the specified level of detail;

receiving one or more responses from the at least one device, the one or more responses responsive to the formulated request, the one or more responses including the additional information about the plurality of assets, the additional information related to the investigation and having the specified level of detail;

updating the case object by storing the additional information received in the one or more responses in the case object;

drawing a conclusion with respect to the security related issue by analyzing the updated case object;

automatically and iteratively refining the updated case object by;

analyzing the updated case object;

based on the analysis, automatically and without user intervention, issuing one or more additional requests for further information to the at least one device, the one or more additional requests changing the modifier to request that the requested further information have a different specified level of detail;

receiving the further information from the at least one device; and

refining the case object by consolidating the further information along with the additional information in the case object; and

drawing a further conclusion with respect to the security related issue by analyzing the consolidated information in the refined case object.

2. The method of claim 1, wherein drawing a conclusion with respect to the security related issue comprises determining that further information at a different specified level of detail would aid the investigation;

and further comprising;

formulating a further request to send to the at least one device to request further information associated with the security related issue, including;

adding a further modifier to the further request to request that further information be returned with the different specified level of detail;

sending the further request to the at least one device to request the further information about the plurality of assets be returned to the computer system with the different specified level of detail;

receiving one or more further responses from the at least one device, the one or more further responses responsive to the further request, the one or more further responses including the further information about the plurality of assets, the further information related to the investigation and having the different specified level of detail; and

further updating the updated case object by storing the further information in the updated case object.

3. The method of claim 1, wherein drawing a conclusion with respect to the security related issue comprises an automated analysis mechanism drawing a conclusion with respect to the security related issue.

4. The method of claim 1, wherein drawing a conclusion with respect to the security related issue comprises drawing a conclusion with respect to the security related issue based at least in part on input received from a user interface.

5. The method of claim 1 further comprising sanitizing the updated case object by:

identifying an asset identifier in the updated case object; and

for each instance of the asset identifier in the updated case object, replacing the asset identifier with a token.

6. The method of claim 1, wherein determining that the security related issue is of a sufficient priority to investigate comprises:

selecting a plurality of security related issues;

assigning a priority to each of the plurality of security related issues; and

selecting the security related issue based at least in part on the assigned priorities.

7. The method of claim 1, wherein identifying a plurality of assets related to the investigation comprises identifying one or more of:

a user;

a device;

a communications channel;

an application; and

a data object.

8. The method of claim 1, further comprising adding a second modifier to the formulated request to request that returned additional information have specific properties.

9. The method of claim 8, wherein adding a second modifier to the formulated request to request that returned additional information have specific properties comprises adding a second modifier to the formulated request to request that returned additional information be one of:

within a specified time range;

have a specified session descriptor;

or

have specified communications parameters.

10. The method of claim 1, wherein identifying the one or more devices comprises identifying one or more of:

a messaging server;

an email server;

a network gateway server;

an authentication server; and

a status management server.

11. A system comprising:

a database, the database storing security states for each of a plurality of monitored devices;

a monitoring system, the monitoring system configured to;

receive a security alert for a device, the device included in the plurality of devices, the security alert identifying an security related threat that occurred during operation of the device; and

determine that the security related threat is of a sufficient priority to investigate by analyzing the security alert in view of stored security states;

a case management system, the case management system configured to investigate security related threats the occur during operation of the plurality of devices, including;

open an investigation for a security related threat;

create a case object for the investigation, the case object being a storage object configured to store information associated with the security related threat;

formulating a request to send to at least one device from among the one or more devices to request additional information associated with the security related threat, including;

identify a plurality of assets related to the investigation;

add a modifier to the request to request that additional information be returned with a specified level of detail;

send the formulated request to the at least one device to request the additional information about the plurality of assets be returned to the computer system with the specified level of detail;

receive one or more responses from the at least one device, the one or more responses responsive to the formulated request, the one or more responses including the additional information about the plurality of assets, the additional information related to the investigation and having the specified level of detail;

update the case object by storing the additional information received in the one or more responses in the case object;

draw a conclusion with respect to the security related issue by analyzing the updated case object;

automatically and iteratively refine the updated case object by;

analyzing the updated case object;

based on the analysis, automatically and without user intervention, issuing one or more additional requests for further information to the at least one device, the one or more additional requests changing the modifier to request that the further information have a different specified level of detail;

receiving the further information from the at least one device; and

refining the case object by consolidating the further information along with the additional information in the case object; and

draw a further conclusion with respect to the security related issue by analyzing the consolidated information in the refined case object.

12. The system of claim 11, the case management system further comprising automated analysis logic configured to generate a second request based on the received one or more responses.

13. The system of claim 11, the case management system further configured to automatically formulate the request.

14. The system of claim 11 further comprising:

a user interface configured to transmit a command to formulate the request and to display at least a portion of the case object.

15. A computer program product for use at a computer system, the computer program product for implementing a method for investigating a security related issue, the computer program product comprising one or more computer storage devices having stored thereon computer executable instructions that, when executed, cause the computer system to perform the method including the following:

receive a selection of a security alert for a device, the device included in the plurality of devices, the security alert identifying an security related threat that occurred during operation of the device;

investigate the security related issue in response receiving the selection of the security alert, including;

open an investigation for the security related issue;

create a case object for the investigation, the case object being a storage object configured to store information associated with the security related issue;

formulate a request to send to at least one device from among the one or more devices to request additional information associated with the security related issue, including;

identify a plurality of assets related to the investigation;

add a modifier to the request to request that additional information be returned with a specified level of detail;

send the formulated request to the at least one device to request the additional information about the plurality of assets be returned to the computer system with the specified level of detail;

receive one or more responses from the at least one device, the one or more responses responsive to the formulated request, the one or more responses including the additional information about the plurality of assets, the additional information related to the investigation and having the specified level of detail;

update the case object by storing the additional information received in the one or more responses in the case object;

present at least a portion of the updated case object on a user interface to help a user draw a conclusion with respect to the security related issue;

automatically and iteratively refine the updated case object by;

analyzing the updated case object;

based on the analysis, automatically and without user intervention, issuing one or more additional requests for further information to the at least one device, the one or more additional requests changing the modifier to request that the further information have a different specified level of detail;

receiving the further information from the at least one device; and

refining the case object by consolidating the further information along with the additional information in the case object; and

draw a further conclusion with respect to the security related issue by analyzing the consolidated information in the refined case object.

16. The computer program product of claim 15, further comprising computer executable instructions that, when executed, cause the computer system to:

formulate a further request to send to the at least one device to request further information associated with the security related issue, including;

add a further modifier to the further request to request that further information be returned with a different specified level of detail;

send the further request to the at least one device to request the further information about the plurality of assets be returned to the computer system with the different specified level of detail;

receive one or more further responses from the at least one device, the one or more further responses responsive to the further request, the one or more further responses including the further information about the plurality of assets, the further information related to the investigation and having the different specified level of detail; and

further update the updated case object by storing the further information in the updated case object.

17. The computer program product of claim 15, further comprising computer executable instructions that, when executed, cause the computer system to:

compare the updated case object with a second case object to determine at least one similarity between the updated case object and the second case object.

18. The computer program product of claim 15, further comprising computer executable instructions that, when executed, cause the computer system to sanitize the updated case object by:

identifying an asset identifier in the updated case object; and

replacing the asset identifier with a token for each instance of the asset identifier in the updated case object.

19. The computer program product of claim 15, further comprising computer executable instructions that, when executed, cause the computer system to add a second modifier to the request to request that returned additional information have specific properties, including requesting one or more of:

the additional information be within a specified time range, the additional information have a specified session descriptor, and the additional information have specified communication parameters.

20. The computer program product of claim 15, wherein computer executable instructions that, when executed, cause the computer system to identify the one or more devices comprise computer executable instructions that, when executed, cause the computer system to identifying one or more of:

a messaging server;

an email server;

a network gateway server;

an authentication server; and

a status management server.