Remediating computer security threats using distributed sensor computers

• US 9,374,385 B1
• Filed: 11/07/2014
• Issued: 06/21/2016
• Est. Priority Date: 11/07/2014
• Status: Active Grant

• Current Assignee: CloudFlare Incorporated
• Original Assignee: Area 1 Security, Inc.
• Inventors: Darche, Blake, Falkowitz, Oren, Syme, Philip
• Primary Examiner(s): Patel, Nirav B
• Assistant Examiner(s): Waliullah, Mohammed
• Application Number:
  US14/536,493
• Time in Patent Office: 592 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A data processing system comprises a security control computer performing operations comprising: receiving, an advertising exchange network computer, advertising presentation data indicating presentations of advertisements to particular browsers that have browsed to particular websites; determining, based upon detection data, whether the particular websites are associated with network attacks or malware; in response, storing transit data specifying computers that have visited the particular web sites and using the transit data to determine a plurality of particular web pages to inspect for threats; based on a hierarchical structure of the particular web pages and without consideration of content of the particular web pages, identifying one or more features, of links in the particular web page or files referenced in the particular web pages, that indicate one or more security threats in the web pages; and determining remediation measures to remediate security threats that are identified in one of the particular web pages.

Claims

1. A data processing system comprising:

a plurality of sensor computers, each of which is coupled to a different corresponding compromised computer among a plurality of compromised computers in geographically distributed locations, each of the compromised computers comprising at least one malware item that is configured to direct unauthorized network activity toward one or more enterprise networks or enterprise computers, wherein the compromised computers are logically between one or more attacker computers and the one or more enterprise networks or enterprise computers, wherein each sensor computer of the plurality of sensor computers is configured as a network tap that intercepts communications directed towards or emitted from the corresponding compromised computer, but is distinct from the corresponding compromised computer;

a security control computer that is coupled to the sensor computers;

one or more non-transitory data storage media in the security control computer storing security logic comprising one or more sequences of instructions which when executed cause the security control computer to perform;

using the security control computer receiving, at the security control computer from an advertising exchange network computer, advertising presentation data indicating presentations of advertisements to particular browsers that have browsed to particular websites;

determining, based upon the detection data, whether the particular websites are associated with network attacks or malware;

in response to the determining, storing transit data specifying computers that have visited the particular websites and using the transit data to determine a plurality of particular web pages to inspect for threats;

based on a hierarchical structure of the particular web pages and without consideration of content of the particular web pages, identifying one or more features, of links in the particular web page or files referenced in the particular web pages, that indicate one or more security threats in the web pages;

determining remediation measures to remediate security threats that are identified in one of the particular web pages;

obtaining, from the sensor computers via the network tap, detection data relating to network messages that the compromised computers emit, as the compromised computers emit the network messages;

using the detection data, identifying one or more security threats that are indicated by the network messages;

determining a specified one of the remediation measures to remediate one or more of the security threats;

providing the specified one of the remediation measures to one or more of the compromised computer, the sensor computer and an enterprise computer.

2. The system of claim 1, further comprising providing the specified remediation measure only to the sensor computer, wherein the sensor computer is configured, in response to receiving the specified one of the remediation measures, to reconfigure a firewall to which the compromised computer is coupled using firewall instructions that are based upon the specified one of the remediation measures.

3. The system of claim 1, further comprising providing the specified one of the remediation measures only to the sensor computer, wherein the sensor computer is configured, in response to receiving the specified remediation measure, to reconfigure one or more of:

a firewall to which the compromised computer is coupled using firewall instructions;

or the compromised computer;

wherein the reconfiguration causes the firewall or compromised computer to drop packets, disrupt establishment of a TCP connection or UDP connection that is partway through handshake negotiation, or disrupt or tear down an existing connection session in one or more of TCP/IP or an application layer protocol.

4. The system of claim 1 wherein providing the specified one of the remediation measures comprises one or more of:

causing dropping packets associated with the compromised computer;

causing disrupting establishment of a TCP connection or UDP connection that is partway through handshake negotiation using the compromised computer;

causing disrupting an existing connection session in one or more of TCP/IP or an application layer protocol.

5. The system of claim 1, further comprising:

using the sensor computer, selecting one or more of the network messages emitted from the compromised computer and directed toward the enterprise computer;

queuing the selected one or more of the network messages in queues at the sensor computer;

inspecting and modifying the queued one or more network messages to remove one or more security threats before forwarding the queued network messages to the enterprise computer.

6. The system of claim 5, wherein the selection comprises filtering the one or more network messages emitted from the compromised computer based upon one or more ports of interest.

7. The system of claim 5, wherein the selection comprises selecting all network messages when a total message output or packet output of the compromised computer exceeds one or more specified thresholds.

8. The system of claim 1, wherein the security control computer further comprises inspecting logic that is configured to perform:

selecting, from a queue identifying a plurality of web pages, a particular web page to retrieve from one of a plurality of internet sources;

causing retrieving a copy of the particular web page from a particular internet source;

determining a reputation score for the particular web page;

determining the specified one of the remediation measures, based upon the reputation score, to remediate a particular security threat that is identified in the particular web page;

providing the specified one of the remediation measures to one or more of the compromised computer, the sensor computer and the enterprise computer.

9. The system of claim 8, wherein the inspecting logic is further configured to review each link in the particular web page, compute a link score for each redirection path associated with that link, and determine the reputation score at least in part based upon the link score.

10. The system of claim 9, wherein the inspecting logic is further configured to refrain from using a particular link to reach another web page referenced in the link when the link score is greater than a specified threshold that is associated with non-traversable links.

11. The system of claim 8, wherein the inspecting logic is further configured to inspect each of the files referenced in the particular web page, determine a status value for each of the files, and determine the reputation score at least in part based upon the status value.

12. The system of claim 8, wherein the inspecting logic is further configured to determine the reputation score at least in part based upon combining the reputation score with one or more enrichment data sources.

13. The system of claim 8, wherein the inspecting logic is further configured to determine the reputation score at least in part based upon combining the reputation score with one or more of geo-location data and one or more other enrichment sources.

14. The system of claim 8, wherein the inspecting logic is further configured to perform the selecting based upon feedback from analysis of previous web pages.

15. The system of claim 8, wherein the inspecting logic is further configured to determine the reputation score for the particular web page, determine the specified remediation measure, and provide the specified remediation measure only when the hierarchical structure of the particular web page has not changed since a last inspection of the same particular web page.

16. The system of claim 8, wherein the inspecting logic is configured to store the plurality of web pages in the queue based upon input from one or more of:

global user browsing data indicating which web pages are the subject of browsing by a plurality of geographically distributed users;

feedback from analysis of previous web pages by the inspecting logic;

a user query;

scheduling input.

17. The system of claim 1, further comprising, based upon the detection data, creating and causing displaying, in a user interface of a computer display device, one or more reports specifying a plurality of attacks directed toward the enterprise network or enterprise computer.

18. The system of claim 17, further comprising:

obtaining, from one or more enrichment services, based upon network addresses in the network messages, geo-location data indicating a particular geographic location;

creating and causing displaying, in the user interface, an aggregate number of attackers in the particular geographic location that have initiated attacks toward the enterprise network or enterprise computer.

19. A data processing system comprising:

a plurality of sensor computers, each of which is coupled to a different corresponding compromised computer among a plurality of compromised computers in geographically distributed locations, each of the compromised computers comprising at least one malware item that is configured to direct unauthorized network activity toward one or more enterprise networks or enterprise computers, wherein the compromised computers are logically between one or more attacker computers and the one or more enterprise networks or enterprise computers wherein each sensor computer of the plurality of sensor computers is configured as a network tap that intercepts communications directed towards or emitted from the corresponding compromised computer, but is distinct from the corresponding compromised computer;

a security control computer that is coupled to the sensor computers;

one or more non-transitory data storage media in the security control computer storing security logic comprising one or more sequences of instructions which when executed cause the security control computer to perform;

using the security control computer receiving, at the security control computer from an advertising exchange network computer, advertising presentation data indicating presentations of advertisements to particular browsers that have browsed to particular websites;

determining, based upon the detection data, whether the particular websites are associated with network attacks or malware;

in response to the determining, storing transit data specifying computers that have visited the particular websites and using the transit data to determine a plurality of particular web pages to inspect for threats;

based on a hierarchical structure of the particular web pages and without consideration of content of the particular web pages, identifying one or more features, of links in the particular web page or files referenced in the particular web pages, that indicate one or more security threats in the web pages;

determining remediation measures to remediate security threats that are identified in one of the particular web pages;

obtaining, from the sensor computers via the network tap, detection data relating to network messages that the compromised computers emit, as the compromised computers emit the network messages;

using the detection data, identifying one or more security threats that are indicated by the network messages;

determining a specified one of the remediation measures to remediate one or more of the security threats, wherein the specified one of the remediation measures comprises one or more of;

causing dropping packets associated with the compromised computer;

causing disrupting establishment of a TCP connection or UDP connection that is partway through handshake negotiation using the compromised computer;

causing disrupting an existing connection session in one or more of TCP/IP or an application layer protocol;

configuring one or more of the compromised computer, the sensor computer and an enterprise computer to perform the specified one of the remediation measures.

20. The system of claim 19, wherein the security control computer further comprises inspecting logic that is configured to perform:

selecting, from a queue identifying a plurality of web pages, a particular web page to retrieve from one of a plurality of internet sources;

causing retrieving a copy of the particular web page from a particular internet source;

determining a reputation score for the particular web page;

determining the specified one of the remediation measures, based upon the reputation score, to remediate a security threat that is identified in the particular web page;

providing the specified one of the remediation measures to one or more of the compromised computer, the sensor computer and the enterprise computer.

21. The system of claim 20, wherein the inspecting logic is further configured to perform the selecting based upon feedback from analysis of previous web pages.