Threat detection using a time-based cache of reputation information on an enterprise endpoint

• US 9,967,264 B2
• Filed: 09/14/2014
• Issued: 05/08/2018
• Est. Priority Date: 09/14/2014
• Status: Active Grant

• Current Assignee: Sophos Limited (Sophos Group Ltd.)
• Original Assignee: Sophos Limited (Sophos Group Ltd.)
• Inventors: Harris, Mark D., Reed, Simon Neil, Ray, Kenneth D., Watkiss, Neil Robert Tyndale, Thomas, Andrew J., Cook, Robert W.
• Primary Examiner(s): Shiferaw, Eleni A
• Assistant Examiner(s): Steinle, Andrew J
• Application Number:
  US14/485,790
• Publication Number:
  US 20160080399A1
• Time in Patent Office: 1,332 Days
• Field of Search: None
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Threat detection instrumentation is simplified by providing and updating labels for computing objects in a context-sensitive manner. This may include simple labeling schemes to distinguish between objects, e.g., trusted/untrusted processes or corporate/private data. This may also include more granular labeling schemes such as a three-tiered scheme that identifies a category (e.g., financial, e-mail, game), static threat detection attributes (e.g., signatures, hashes, API calls), and explicit identification (e.g., what a file or process calls itself). By tracking such data for various computing objects and correlating these labels to malware occurrences, rules can be written for distribution to endpoints to facilitate threat detection based on, e.g., interactions of labeled objects, changes to object labels, and so forth. In this manner, threat detection based on complex interactions of computing objects can be characterized in a platform independent manner and pre-processed on endpoints without requiring significant communications overhead with a remote threat management facility.

Claims

1. A method comprising:

detecting an action at an endpoint;

transmitting a first indication of compromise from the endpoint to a remote threat management facility, the first indication of compromise including a description of the action, wherein the description of the action includes an identifier of a process, executing on the endpoint, that took the action, wherein the description of the action further includes a second identifier of an object programmatically associated with the process through the action;

at the endpoint, receiving from the remote threat management facility a reputation score for the action and a time to live for the action, the reputation score based on the description of the action including the process and the object programmatically associated with the process through the action;

caching the description and the reputation score in an event cache on the endpoint for a duration equal to the time to live;

accumulating a plurality of the descriptions and reputation scores that have not expired in the event cache;

expiring at least one of the descriptions and reputation scores by removing the at least one of the descriptions and reputation scores from the event cache after the time to live;

generating a threat detection when a pattern of the descriptions and reputation scores in the event cache indicates malicious software operating on the endpoint; and

communicating the threat detection to the threat management facility.

2. The method of claim 1 wherein the object includes a URL accessed by the action.

3. The method of claim 1 wherein the object includes a filename accessed by the action.

4. The method of claim 1 further comprising taking a remedial action at the endpoint when malicious activity is detected.

5. The method of claim 1 wherein the reputation score is based on a geographical distribution of the description on a plurality of endpoints.

6. The method of claim 1 wherein the reputation score is based on a number of prior occurrences of the description on a plurality of endpoints.

7. The method of claim 1 wherein the object is programmatically associated with the process through the action by at least one of triggering the action, being acted upon by the action, receiving data from the action, or providing data to the action.

8. A computer program product comprising non-transitory computer executable code embodied in a non-transitory computer readable medium that, when executing on one or more computing devices, performs the steps of:

detecting an action at an endpoint;

transmitting a first indication of compromise from the endpoint to a remote threat management facility, the indication of compromise including a description of the action, wherein the description of the action includes an identifier of a process, executing on the endpoint, that took the action, wherein the description of the action further includes a second identifier of an object associated with the process through the action;

at the endpoint, receiving from the remote threat management facility a reputation score for the action and a time to live for the action, the reputation score based on the description of the action including the process and the object programmatically associated with the process through the action;

caching the description and the reputation score in an event cache on the endpoint for a duration equal to the time to live;

accumulating a plurality of the descriptions and reputation scores that have not expired in the event cache;

expiring at least one of the descriptions and reputation scores by removing the at least one of the descriptions and reputation scores from the event cache after the time to live;

generating a threat detection when a pattern of the descriptions and reputation scores in the event cache indicates malicious software operating on the endpoint; and

communicating the threat detection to the threat management facility.

9. The computer program product of claim 8 wherein the object includes a URL accessed by the action.

10. The computer program product of claim 8 wherein the object includes a filename accessed by the action.

11. The computer program product of claim 8 wherein the code further performs the step of taking a remedial action at the endpoint when malicious activity is detected.

12. The computer program product of claim 8 wherein the reputation score is based on a geographical distribution of the description on a plurality of endpoints.

13. The computer program product of claim 8 wherein the reputation score is based on a number of prior occurrences of the description on a plurality of endpoints.

14. A system comprising:

a threat management facility configured to manage threats to an enterprise; and

an endpoint of the enterprise having a memory and a processor, the memory storing an object and a process, and the processor configured to detect an action at the endpoint, to transmit an indication of compromise from the endpoint to a remote threat management facility, the indication of compromise including a description of the action, wherein the description of the action includes an identifier of the process, executing on the endpoint, that took the action, wherein the description of the action further includes a second identifier of the object associated with the process through the action, to receive from the threat management facility a reputation score for the action and a time to live for the action, the reputation score based on the description of the action including the process and the object programmatically associated with the process through the action, to cache the description and the reputation score in an event cache on the endpoint for a duration equal to the time to live, to accumulate a plurality of the descriptions and reputation scores that have not expired in the event cache, to expire at least one of the descriptions and reputation scores by removing the at least one of the descriptions and reputation scores from the event cache after the time to live, and to generate a threat detection for communication to the threat management facility when a pattern of the descriptions and reputation scores in the event cache indicates malicious software operating on the endpoint.

15. The system of claim 14 wherein the object includes at least one of a URL and a filename accessed by the action.