Advanced persistent threat detection
First Claim
Patent Images
1. A system for threat detection, comprising:
- a gateway in an enterprise, the gateway including a memory, and the gateway configured to detect a request for network traffic from an endpoint in the enterprise, the request including a destination address and the request containing a violation of a network policy for the enterprise, the gateway further configured to identify the endpoint that originated the request, and to query the endpoint to determine a source process executing on the endpoint that generated the request, the gateway further configured to map the source process to one or more files on the endpoint; and
a threat management facility for managing the enterprise, the threat management facility coupled in a communicating relationship with the gateway, and the threat management facility configured to locate one or more other endpoints associated with the enterprise that contain the one or more files, and to remediate the one or more other endpoints with respect to the one or more files.
4 Assignments
0 Petitions
Accused Products
Abstract
A variety of techniques are disclosed for detection of advanced persistent threats and similar malware. In one aspect, the detection of certain network traffic at a gateway is used to trigger a query of an originating endpoint, which can use internal logs to identify a local process that is sourcing the network traffic. In another aspect, an endpoint is configured to periodically generate and transmit a secure heartbeat, so that an interruption of the heartbeat can be used to signal the possible presence of malware. In another aspect, other information such as local and global reputation information is used to provide context for more accurate malware detection.
-
Citations
20 Claims
-
1. A system for threat detection, comprising:
-
a gateway in an enterprise, the gateway including a memory, and the gateway configured to detect a request for network traffic from an endpoint in the enterprise, the request including a destination address and the request containing a violation of a network policy for the enterprise, the gateway further configured to identify the endpoint that originated the request, and to query the endpoint to determine a source process executing on the endpoint that generated the request, the gateway further configured to map the source process to one or more files on the endpoint; and a threat management facility for managing the enterprise, the threat management facility coupled in a communicating relationship with the gateway, and the threat management facility configured to locate one or more other endpoints associated with the enterprise that contain the one or more files, and to remediate the one or more other endpoints with respect to the one or more files. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15)
-
-
16. A computer program product comprising non-transitory computer executable code embodied in a non-transitory computer readable medium that, when executing on one or more computing devices in an enterprise managed by a threat management facility, performs the steps of:
-
detecting a request for network traffic at a gateway associated with the enterprise, the request including a destination address and the request containing a violation of a network policy for the enterprise; identifying an endpoint coupled to the gateway that originated the request; querying the endpoint from the gateway to determine a source process on the endpoint that generated the request; mapping the source process to one or more files on the endpoint; locating one or more other endpoints managed by the threat management facility that contain the one or more files; and remediating the one or more other endpoints. - View Dependent Claims (17, 18, 19, 20)
-
Specification