Advanced persistent threat mitigation

• US 10,205,738 B2
• Filed: 07/12/2016
• Issued: 02/12/2019
• Est. Priority Date: 07/12/2016
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Subramanya, Sindhu, Pulicat Gopalakrishnan, Anand, Rambhia, Payal Shah, Magar, Amey, Cheng, Lio, Huang, Ningjia
• Primary Examiner(s): Zaidi, Syed A
• Application Number:
  US15/208,176
• Publication Number:
  US 20180020017A1
• Time in Patent Office: 945 Days
• Field of Search: 726 25
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: H04L 41/0816 the condition being an adaptation, e.g. in response to network events
• CPC Class Codes: H04L 41/0853 by actively collecting configuration information or by backing up configuration information
• CPC Class Codes: H04L 41/0863 by rolling back to previous configuration versions
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

A method is presented in which a system reduces the risk of an advanced persistent threat (“APT”) detected at one or more network devices by implementing one or more mitigation actions depending on the nature of the detected threat. Accordingly, in response to detecting the risk of an APT at one or more network devices, a centralized controller implements one or more mitigation actions to minimize the vulnerability of an enterprise network to unauthorized access to one or more network resources. A centralized controller may therefore instruct one or more network devices to take appropriate mitigation actions depending on the nature of an APT detected on one or more network devices.

Claims

1. A method comprising:

at a network controller, receiving management plane information associated with a configuration of one or more network devices in a network;

determining whether the configuration of the one or more network devices has changed based on the management plane information;

receiving a list of one or more interfaces connecting one or more neighbor devices to the one or more network devices when a configuration change has occurred on the one or more network devices or the one or more network devices has not responded to one or more polling signals; and

in response to determining that the configuration of the one or more network devices has changed, executing one or more mitigation actions in the network, the one or more mitigation actions comprising tearing down the one or more interfaces connecting the one or more neighbor devices to the one or more network devices when a configuration change has occurred or the one or more network devices is determined to not be reachable.

2. The method of claim 1, wherein the management plane information is received in response to a management information request sent from the network controller.

3. The method of claim 1, wherein determining whether the configuration of the one or more network devices has changed is based at least on data received from a threat detection subsystem.

4. The method of claim 1, wherein determining whether the configuration of the one or more network devices has changed further comprises determining whether the change to the configuration of the one or more network devices was authorized.

5. The method of claim 4, wherein the executing one or more mitigation actions further comprises:

sending to one or more users associated with the one or more network devices a notification that the configuration associated with the one or more network devices has changed; and

installing a pre-approved configuration file on the one or more network devices.

6. The method of claim 1, wherein determining whether the configuration of the one or more network devices has changed further comprises determining whether the network controller has received the management plane information associated with the configuration of the one or more network devices within a predetermined time interval.

7. The method of claim 6, further comprising:

receiving a list of one or more network devices when a configuration change has occurred on the one or more network devices or the one or more network devices has not responded to one or more polling signals within a predetermined time interval; and

removing from a network access list the one or more network devices when a configuration change has occurred or the one or more network devices is determined to not be reachable.

8. The method of claim 1, wherein determining whether the configuration of the one or more network devices has changed further comprises determining whether a hash computation associated with one or more configuration images on the one or more network devices has changed.

9. The method of claim 8, wherein the executing one or more mitigation actions further comprises:

installing a pre-approved configuration image on the one or more network devices when the hash computation associated with one or more configuration images has changed; and

rebooting the one or more network devices using the pre-approved configuration image.

10. The method of claim 1, wherein determining whether the configuration of the one or more network devices has changed further comprises determining whether one or more passwords associated with the one or more network devices has changed.

11. The method of claim 10, wherein the executing one or more mitigation actions further comprises:

clearing one or more remote access lines to the one or more network devices when the one or more passwords has changed;

removing, from a network access list, one or more users associated with the one or more remote access lines; and

resetting the one or more passwords associated with the one or more network devices when the one or more passwords have changed.

12. The method of claim 1, wherein determining whether the configuration of the one or more network devices has changed further comprises determining whether one or more memory devices has been inserted into the one or more network devices.

13. The method of claim 12, wherein the executing one or more mitigation actions further comprises sending an alarm communication to one or more users associated with the one or more network devices.

14. An apparatus comprising:

a network interface unit that enables network communications with one or more network devices; and

a processor, coupled to the network interface unit, and configured to;

receive management plane information associated with a configuration of the one or more network devices in a network;

determine whether the configuration of the one or more network devices has changed based on the management plane information;

receive a list of one or more interfaces connecting one or more neighbor devices to the one or more network devices when a configuration change has occurred on the one or more network devices or the one or more network devices has not responded to one or more polling signals; and

in response to determining that the configuration of the one or more network devices has changed, execute one or more mitigation actions in the network, the one or more mitigation actions comprising tearing down the one or more interfaces connecting the one or more neighbor devices to the one or more network devices when a configuration change has occurred or the one or more network devices is determined to not be reachable.

15. The apparatus of claim 14, wherein the processor is configured to determine whether the configuration of the one or more network devices has changed based at least on data received from a threat detection subsystem.

16. The apparatus of claim 14, wherein the processor is configured to determine whether the configuration of the one or more network devices has changed by:

determining whether the change to the configuration of the one or more network devices was authorized.

17. The apparatus of claim 16, wherein the processor is configured to execute one or more mitigation actions by:

send to the one or more users associated with the one or more network devices a notification indicating that the configuration associated with the one or more network devices has changed; and

install a pre-approved configuration file on the one or more network devices.

18. A non-transitory processor readable medium storing instructions that, when executed by a processor of a network controller associated with network devices in a network, cause the processor to:

receive management plane information associated with a configuration of the one or more network devices in the network;

determine whether the configuration of the one or more network devices has changed based on the management plane information;

receive a list of one or more interfaces connecting one or more neighbor devices to the one or more network devices when a configuration change has occurred on the one or more network devices or the one or more network devices has not responded to one or more polling signals; and

in response to determining that the configuration of the one or more network devices has changed, execute one or more mitigation actions in the network, the one or more mitigation actions comprising tearing down the one or more interfaces connecting the one or more neighbor devices to the one or more network devices when a configuration change has occurred or the one or more network devices is determined to not be reachable.

19. The non-transitory processor readable medium of claim 18, wherein the instructions operable for determining whether the configuration of the one or more network devices has changed further comprise instructions operable for determining whether the change to the configuration of the one or more network devices was authorized by one or more users associated with the one or more network devices.

20. The non-transitory processor readable medium of claim 19, wherein the instructions operable for executing one or more mitigation actions further comprise instructions operable for:

sending to one or more users associated with the one or more network a notification indicating that the configuration associated with the one or more network devices has changed; and

installing a pre-approved configuration file on the one or more network devices.