System and method for programmably creating and customizing security applications via a graphical user interface

• US 9,892,270 B2
• Filed: 11/25/2015
• Issued: 02/13/2018
• Est. Priority Date: 07/18/2014
• Status: Active Grant

• Current Assignee: Cybereason, Inc.
• Original Assignee: empow Cyber Security Ltd.
• Inventors: Chesla, Avi
• Primary Examiner(s): To, Baotran N
• Application Number:
  US14/952,069
• Publication Number:
  US 20160078236A1
• Time in Patent Office: 811 Days
• Field of Search: 716 1, 716 22- 25
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 3/0484 for the control of specific functions or operations, e.g. selecting or manipulating an object, an image or a displayed text element, setting a parameter value or selecting a range
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system and method for programmably creating a security application via a graphical user interface. The method comprises: causing a display of a service stage GUI window including at least one security phase zone; receiving a selection of at least one security service including at least one security decision engine; causing a display of an event rule stage window including at least one event rule parameters zone; receiving a selection of at least one event rule related to the at least one SDE; causing a display of an event relationship stage GUI window including at least one rule selection zone; receiving a selection of at least one workflow rule and at least one action; and configuring the security application based on the selected at least one work rule and the selected at least one action.

Claims

1. A method for programmably creating a security application via a graphical user interface (GUI), comprising:

causing a display of a service stage GUI window including at least one security phase zone;

receiving, by the at least one security phase zone, a selection of at least one security service including at least one security decision engine (SDE);

causing a display of an event rule stage window including at least one event rule parameters zone;

receiving, by the at least one event rule parameters zone, a selection of at least one event rule related to the at least one SDE;

causing a display of an event relationship stage GUI window including at least one rule selection zone;

receiving, by the rule selection zone, a selection of at least one workflow rule and at least one action, wherein the at least one workflow rule and the at least one action defines the event relationship as determined by the at least one event rule; and

configuring the security application based on the selected at least one workflow rule and the selected at least one action.

2. The method of claim 1, further comprising:

upon receiving the selections, generating the security application.

3. The method of claim 1, wherein each security phase zone is associated with any of:

a detection phase, an investigation phase, and a mitigation phase.

4. The method of claim 1, wherein each selection is received via a user gesture by the user, wherein the user gesture includes at least one dragging and dropping of an icon into one of the zones.

5. The method of claim 1, wherein each of the at least one action is any of:

executing a security phase, executing one of the at least one security service, executing one of the at least one SDE, reporting information related to a potential security threat, ceasing execution of the at least one security service or the at least one SDE, creating a group event, terminating operation of the application, and resetting operation of the application.

6. The method of claim 5, wherein the group event defines a correlation of events, further comprising:

receiving, by the rule selection zone, a selection of the group event.

7. The method of claim 1, wherein the rule selection zone further allows a selection of at least one correlation rule, wherein each correlation rule defines the correlation between events generated by the at least one SDE.

8. The method of claim 7, wherein the at least one action is performed based on the at least one workflow rule and the at least one correlation rule.

9. The method of claim 1, further comprising:

generating a high-level programmable code based on the at least one security service, the at least one SDE, and the at least one rule selected via the GUI;

translating, by a security stack, the high-level programmable code into a set of instructions compatible with a plurality of network elements participating in each security phase associated with the at least one security phase zone; and

communicating the set of instructions to a plurality of respective drivers of the plurality of network elements.

10. The method of claim 1, further comprising:

customizing the security application via the GUI.

11. A non-transitory computer readable medium having stored thereon instructions for causing one or more processing units to execute a method for programmably creating a security application via a graphical user interface (GUI), comprising:

causing a display of a service stage GUI window including at least one security phase zone;

receiving, by the at least one security phase zone, a selection of at least one security service including at least one security decision engine (SDE);

causing a display of an event rule stage window including at least one event rule parameters zone;

receiving, by the at least one event rule parameters zone, a selection of at least one event rule related to the at least one SDE;

causing a display of an event relationship stage GUI window including at least one rule selection zone;

receiving, by the rule selection zone, a selection of at least one workflow rule and at least one action, wherein the at least one workflow rule and the at least one action defines the event relationship as determined by the at least one event rule; and

configuring the security application based on the selected at least one workflow rule and the selected at least one action.

12. A system for programmably creating a security application via a graphical user interface (GUI), comprising:

a processing unit; and

a memory, the memory containing instructions that, when executed by the processing unit, configure the system to;

cause a display of a service stage GUI window including at least one security phase zone;

receive, by the at least one security phase zone, a selection of at least one security service including at least one security decision engine (SDE);

cause a display of an event rule stage window including at least one event rule parameters zone;

receive, by the at least one event rule parameters zone, a selection of at least one event rule related to the at least one SDE;

cause a display of an event relationship stage GUI window including at least one rule selection zone;

receive, by the rule selection zone, a selection of at least one workflow rule and at least one action, wherein the at least one workflow rule and the at least one action defines the event relationship as determined by the at least one event rule; and

configure the security application based on the selected at least one work rule and the selected at least one action.

13. The system of claim 12, wherein the system is further configured to:

upon receiving the selections, generate the security application.

14. The system of claim 12, wherein each security phase zone is associated with any of:

a detection phase, an investigation phase, and a mitigation phase.

15. The system of claim 12, wherein each selection is received via a user gesture by the user, wherein the user gesture includes at least one dragging and dropping of an icon into one of the zones.

16. The system of claim 12, wherein each of the at least one action is any of:

executing a security phase, executing one of the at least one security service, executing one of the at least one SDE, reporting information related to a potential security threat, ceasing execution of the at least one security service or the at least one SDE, creating a group event, terminating operation of the application, and resetting operation of the application.

17. The system of claim 16, wherein the system is further configured to:

receive, by the rule selection zone, a selection of the group event.

18. The system of claim 12, wherein the rule selection zone further allows a selection of at least one correlation rule, wherein each correlation rule defines the correlation between events generated by the at least one SDE.

19. The system of claim 18, wherein the at least one action is performed based on the at least one workflow rule and the at least one correlation rule.

20. The system of claim 12, wherein the system is further configured to:

generate a high-level programmable code based on the at least one security service, the at least one SDE, and the at least one rule selected via the GUI;

translate, by a security stack, the high-level programmable code into a set of instructions compatible with a plurality of network elements participating in each security phase associated with the at least one security phase zone; and

communicate the set of instructions to a plurality of respective drivers of the plurality of network elements.

21. The system of claim 12, wherein the system is further configured to:

customize the security application via the GUI.