Simulation and virtual reality based cyber behavioral systems

• US 9,875,360 B1
• Filed: 07/10/2017
• Issued: 01/23/2018
• Est. Priority Date: 07/14/2016
• Status: Active Grant

• Current Assignee: IronNet Cybersecurity, Inc. (IronNet, Inc.)
• Original Assignee: IronNet Cybersecurity, Inc. (IronNet, Inc.)
• Inventors: Grossman, Robert L., Alexander, Keith B., Heath, James E., Garrett, Randy Lynn
• Primary Examiner(s): Zee, Edward
• Application Number:
  US15/645,271
• Publication Number:
  US 20180018463A1
• Time in Patent Office: 197 Days
• CPC Class Codes: A63F 13/335 using Internet
• CPC Class Codes: A63F 13/71 using secure communication between game devices and game servers, e.g. by encrypting game data or authenticating players
• CPC Class Codes: A63F 13/75 Enforcing rules, e.g. detecting foul play or generating lists of cheating players
• CPC Class Codes: A63F 2300/5553 user representation in the game field, e.g. avatar
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 3/011 Arrangements for interaction with the human body, e.g. for user immersion in virtual reality blind teaching G09B21/00
• CPC Class Codes: G06T 19/006 Mixed reality object pose determination, tracking or camera calibration for mixed reality G06T7/00
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A cybersecurity system for managing cyber behavior associated with cyber actors such that the cyber behavior can be computed and predicted and cyber interactions between the cyber actors can be created. The system includes a cyber behavioral space management module configured to receive input data, and data from the interaction engine and the analytic workflow engine, and to generate a plurality of cyber behavioral spaces based on the received data. The system includes an interaction engine configured to process cyber actor data to facilitate interactions with the cyber behavioral space, a cyber scene, a cyber map, and another cyber actor. The system includes an analytic workflow engine configured to analyze the cyber behavioral spaces and update cyber data based on the analyzed data and the interaction engine data. The system includes a visualization engine configured to compute visualizations and transmit the visualizations for display.

Claims

1. A cybersecurity system for managing cyber behavior associated with cyber actors such that the cyber behavior can be computed and predicted and cyber interactions between the cyber actors can be created, the system comprising:

a cyber behavioral space management module;

an interaction engine; and

an analytic workflow engine,

the cyber behavioral space management module, in communication with the interaction engine and the analytic workflow engine, and configured to;

receive at least one of;

input data, the input data including at least one of input cyber data, sensor data, enrichment data, and third party data,

data from the interaction engine, and

data from the analytic workflow engine;

generate a plurality of cyber behavioral spaces based on the at least one of the input data, the data from the interaction engine, and the data from the analytic workflow engine, each of the plurality of cyber behavioral spaces comprising cyber behavioral space data, the cyber behavioral space data including;

cyber data, the cyber data including at least one of the input cyber data and transformed input cyber data,

cyber actor data associated with a plurality of cyber actors, and

cyber scene data associated with a plurality of cyber scenes,

the cyber behavioral space data being defined by a plurality of dimensions, a plurality of modes, and a plurality of scales;

the interaction engine configured to;

receive first cyber actor data associated with a first cyber actor of the plurality of cyber actors, the first cyber actor including at least one of a real cyber actor and a simulated actor,

process the received first cyber actor data to facilitate at least one of;

a first interaction between the first cyber actor with at least one of;

the cyber behavioral space,

the cyber scene, and

a cyber map, the cyber map associated with at least one of the plurality of cyber behavioral spaces, and

a second interaction between the first cyber actor with a second cyber actor of the plurality of cyber actors, and

transmit data associated with at least one of the first interaction and the second interaction;

the analytic workflow engine configured to;

analyze the cyber behavioral space data associated with each of the plurality of cyber behavioral spaces to compute cyber behaviors, and

update at least one of the cyber data, the cyber actor data, and the cyber scene data based on at least one of;

the cyber behavioral space data,

the computed cyber behaviors and an assignment of the computed cyber behaviors to at least one of the cyber data, the cyber actor data, and the cyber scene data,

the first interaction, and

the second interaction, and

transmit data associated with the updated at least one of the cyber data, the cyber actor data, and the cyber scene data.

2. The cybersecurity system of claim 1, further comprising:

a query engine, in communication with the cyber behavioral space management module, the query engine configured to receive, from the first cyber actor, a query about at least one of the plurality of cyber behavioral spaces, the query associated with at least one of;

risk associated with a first cyber entity of a plurality of cyber entities;

a group of cyber entities of the plurality of cyber entities with a similar profile as the first cyber entity;

internal or external organizational constructs; and

behavior associated at least one of the first cyber entity, each cyber entity in the group of cyber entities, the first cyber actor, the second cyber actor and a third cyber actor; and

wherein the analytic workflow engine is further configured to compute and continuously update risks associated with each cyber entity of the plurality of cyber entities and each cyber actor of the plurality of cyber actors.

3. The cybersecurity system of claim 1, further comprising a simulation engine, in communication with the cyber behavioral space management module, configured to generate the plurality of cyber scenes, each of the plurality of cyber scenes including a subset of the cyber data and the cyber maps associated with the plurality of cyber behavioral spaces.

4. The cybersecurity system of claim 3, wherein the simulation engine is further configured to generate simulations, the simulations configured to:

operate on at least one of real world data and simulated data; and

provide a course of action for at least one of operations, analysis, insight, planning, training, a remediation action, and a mitigation action.

5. The cybersecurity system of claim 1, wherein the analytic workflow engine is further configured to:

create a transformed cyber behavioral space, wherein to create the transformed cyber behavioral space, the analytic workflow engine is further configured to;

transform the cyber behavioral space data into tensor data and lower rank tensor approximations; and

use machine learning to define cyber behaviors and the plurality of cyber behavioral spaces associated with the transformed cyber behavioral space.

6. The cybersecurity system of claim 5, wherein the analytic workflow engine is further configured to:

apply at least one of rules and machine learning to the transformed cyber behavioral space to define cyber behaviors that increase or decrease risk associated with at least one of;

a real cyber actor or a simulated actor;

a cyber entity;

a machine;

an organization; and

a process.

7. The cybersecurity system of claim 6, wherein the cybersecurity system is associated with a first organization, further wherein the cyber behaviors that increase or decrease risk are observable by cyber actors associated with the first organization and unobservable by cyber actors associated with a second organization, the cybersecurity system further comprising:

a cyber behavioral exchange engine, the cyber behavioral exchange engine in communication with the cyber behavioral space management module, the cyber behavioral exchange engine configured to;

transmit the cyber behaviors that increase or decrease risk to a cyber behavioral exchange engine associated with the second organization using at least one of a privacy preserving distributed machine learning algorithm and a privacy preserving communications protocol such that the cyber behaviors that increase or decrease risk can be used to analyze data in the second organization, and the cyber behavioral space data associated with the first organization is unobservable by cyber actors associated with the second organization.

8. The cybersecurity system of claim 5, wherein the first cyber actor data is further processed to:

determine at least one of;

a first cyber behavior of the cyber behaviors associated with the transformed cyber behavioral space, and

a first cyber scene of the plurality of cyber scenes associated with the transformed cyber behavioral space; and

improve operational capabilities, readiness, and training associated with responding to the first cyber behavior and the first cyber scene.

9. The cybersecurity system of claim 1, wherein the analytic workflow engine is further configured to process at least one of packet data, network traffic, computer logs, signals intelligence, visible, infrared, multi-spectral, hyperspectral, synthetic aperture radar, moving target indicator radar, technical intelligence data, and intelligence reports.

10. The cybersecurity system of claim 1, wherein each of the plurality of cyber behavioral spaces include at least one of a real-time cyber behavioral space, a historical cyber behavioral space, and a simulated cyber behavioral space.

11. The cybersecurity system of claim 1, wherein the cyber behavior includes at least one of initial reconnaissance, scanning, initial compromise, establishing a foothold, beaconing, command and control, credential capture, escalating privileges, internal reconnaissance, lateral motion, network mapping, data exfiltration, maintaining persistence, and related behaviors.

12. The cybersecurity system of claim 1, wherein:

the plurality of dimensions include a combination of source and destination addresses, time of arrival, volume, packet size, and a protocol type;

the plurality of modes include a combination of packet data, network traffic, computer logs, signals intelligence, visible, infrared, multi-spectral, hyperspectral, synthetic aperture radar, moving target indicator radar, technical intelligence data, and intelligence reports; and

the plurality of scales include a combination of temporal multi-scale data and geo-spatial data.

13. A cybersecurity system for managing cyber behavior associated with cyber actors such that the cyber behavior can be computed and predicted and cyber interactions between the cyber actors can be created, the system comprising:

a cyber behavioral space management module;

an interaction engine; and

an analytic workflow engine;

the cyber behavioral space management module, in communication with the interaction engine and the analytic workflow engine, and configured to;

receive sensor data, the sensor data including at least one of physical actor sensor data about a physical actor and physical system sensor data about a physical system, and at least one of;

input data, the input data including at least one of input cyber data, enrichment data, and third party data,

data from the interaction engine, and

data from the analytic workflow engine;

generate a plurality of cyber behavioral spaces based on the sensor data and at least one of the input data, the data from the interaction engine, and the data from the analytic workflow engine, each of the plurality of cyber behavioral spaces comprising cyber behavioral space data, the cyber behavioral space data including;

cyber data, the cyber data including at least one of the input cyber data and transformed input cyber data,

cyber actor data associated with a plurality of cyber actors, and

cyber scene data associated with a plurality of cyber scenes,

the cyber behavioral space data being defined by a plurality of dimensions, a plurality of modes, and a plurality of scales;

the interaction engine configured to;

receive first cyber actor data associated with a first cyber actor of the plurality of cyber actors, the first cyber actor including at least one of a real cyber actor and a simulated actor,

process the received first cyber actor data to facilitate at least one of;

a first interaction between the first cyber actor with at least one of;

the cyber behavioral space,

the cyber scene, and

a cyber map, the cyber map associated with at least one of the plurality of cyber behavioral spaces, and

a second interaction between the first cyber actor with a second cyber actor of the plurality of cyber actors, and

transmit data associated with at least one of the first interaction and the second interaction,

the analytic workflow engine configured to;

analyze the cyber behavioral space data associated with each of the plurality of cyber behavioral spaces to compute cyber behaviors, and

update at least one of the cyber data, the cyber actor data, and the cyber scene data based on at least one of;

the cyber behavioral space data,

the computed cyber behaviors and an assignment of the computed cyber behaviors to at least one of the cyber data, the cyber actor data, and the cyber scene data,

the first interaction,

the second interaction, and

a computation of physical behaviors about at least one of the physical system and the physical actor, and

transmit data associated with the updated at least one of the cyber data, the cyber actor data, and the cyber scene data.

14. The cybersecurity system of claim 13, further comprising:

a query engine, in communication with the cyber behavioral space management module, the query engine configured to receive, from the first cyber actor, a query about at least one of the plurality of cyber behavioral spaces, the query associated with at least one of;

risk associated with a first cyber entity of a plurality of cyber entities;

a group of cyber entities of the plurality of cyber entities with a similar profile as the first cyber entity;

internal or external organizational constructs; and

behavior associated at least one of the first cyber entity, each cyber entity in the group of cyber entities, the first cyber actor, the second cyber actor and a third cyber actor; and

wherein the analytic workflow engine is further configured to compute and continuously update risks associated with each cyber entity of the plurality of cyber entities and each cyber actor of the plurality of cyber actors.

15. The cybersecurity system of claim 13 further comprising a simulation engine, in communication with the cyber behavioral space management module, the simulation engine configured to generate the plurality of cyber scenes, each of the plurality of cyber scenes including a subset of the cyber data, the cyber scenes, and the cyber maps associated with the plurality of cyber behavioral spaces.

16. The cybersecurity system of claim 15, wherein the simulation engine is further configured to generate simulations, the simulations configured to:

operate on at least one of real world data and simulated data; and

provide a course of action for at least one of operations, analysis, insight, planning, training, a remediation action, and a mitigation action.

17. The cybersecurity system of claim 13, wherein the analytic workflow engine is further configured to:

create a transformed cyber behavioral space, wherein to create the transformed cyber behavioral space, the analytic workflow engine is further configured to;

transform the cyber behavioral space data into tensor data and lower rank tensor approximations; and

use machine learning to define cyber behaviors and the plurality of cyber behavioral spaces associated with the transformed cyber behavioral space.

18. The cybersecurity system of claim 17, wherein the analytic workflow engine is further configured to:

apply at least one of rules and machine learning to the transformed cyber behavioral space to define cyber behaviors that increase or decrease risk associated with at least one of;

a real cyber actor or a simulated actor;

a cyber entity;

a machine;

an organization; and

a process.

19. The cybersecurity system of claim 18, wherein the cybersecurity system is associated with a first organization, further wherein the cyber behaviors that increase or decrease risk are observable by cyber actors associated with the first organization and unobservable by cyber actors associated with a second organization, the cybersecurity system further comprising:

a cyber behavioral exchange engine, the cyber behavioral exchange engine in communication with the cyber behavioral space management module, the cyber behavioral exchange engine configured to;

transmit the cyber behaviors that increase or decrease risk to a cyber behavioral exchange engine associated with the second organization using at least one of a privacy preserving distributed machine learning algorithm and a privacy preserving communications protocol such that the cyber behaviors that increase or decrease risk can be used to analyze data in the second organization, and the cyber behavioral space data associated with the first organization is unobservable by cyber actors associated with the second organization.

20. The cybersecurity system of claim 17, wherein the first cyber actor data is further processed to:

determine at least one of;

a first cyber behavior of the cyber behaviors associated with the transformed cyber behavioral space, and

a first cyber scene of the plurality of cyber scenes associated with the transformed cyber behavioral space; and

improve operational capabilities, readiness, and training associated with responding to the first cyber behavior and the first cyber scene.

21. The cybersecurity system of claim 13, wherein the analytic workflow engine is further configured to process at least one of data from operational technology (OT) sensors, operational technology logs, packet data, network traffic, computer logs, signals intelligence, visible, infrared, multi-spectral, hyperspectral, synthetic aperture radar, moving target indicator radar, technical intelligence data, and intelligence reports.

22. The cybersecurity system of claim 13, wherein each of the plurality of cyber behavioral spaces include at least one of a real-time cyber behavioral space, a historical cyber behavioral space, and a simulated cyber behavioral space.

23. The cybersecurity system of claim 13, wherein the cyber behavior includes at least one of initial reconnaissance, scanning, initial compromise, establishing a foothold, beaconing, command and control, credential capture, escalating privileges, internal reconnaissance, lateral motion, network mapping, data exfiltration, maintaining persistence, and related behaviors.

24. The cybersecurity system of claim 13, wherein:

the plurality of dimensions include a combination of source and destination addresses, time of arrival, volume, packet size, and a protocol type;

the plurality of modes include a combination of packet data, network traffic, computer logs, signals intelligence, visible, infrared, multi-spectral, hyperspectral, synthetic aperture radar, moving target indicator radar, technical intelligence data, and intelligence reports; and

the plurality of scales include a combination of temporal multi-scale data and geo-spatial data.