Intrusion detection using a heartbeat

• US 10,673,873 B2
• Filed: 02/23/2018
• Issued: 06/02/2020
• Est. Priority Date: 04/28/2014
• Status: Active Grant

• Current Assignee: Sophos Limited (Sophos Group Ltd.)
• Original Assignee: Sophos Limited (Sophos Group Ltd.)
• Inventors: Ray, Kenneth D.
• Primary Examiner(s): Feild, Lynn D
• Assistant Examiner(s): Lakhia, Viral S
• Application Number:
  US15/903,924
• Publication Number:
  US 20180191752A1
• Time in Patent Office: 830 Days
• Field of Search: 726 2- 22
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A variety of techniques are disclosed for detection of advanced persistent threats and similar malware. In one aspect, the detection of certain network traffic at a gateway is used to trigger a query of an originating endpoint, which can use internal logs to identify a local process that is sourcing the network traffic. In another aspect, an endpoint is configured to periodically generate and transmit a secure heartbeat, so that an interruption of the heartbeat can be used to signal the possible presence of malware. In another aspect, other information such as local and global reputation information is used to provide context for more accurate malware detection.

Claims

1. A method comprising:

receiving, at a gateway interposed between a second network and an endpoint in an enterprise network, a heartbeat from the endpoint in communication with the second network via the gateway, the heartbeat addressed to the gateway, the heartbeat including a signal communicated from the endpoint to the gateway, and the heartbeat containing cryptographically secured information including a security health status of the endpoint, the security health status based on monitoring, by a health monitor on the endpoint, software items executing on the endpoint, and the security health status indicating an uncompromised security health status when the endpoint is uncompromised;

detecting a change in the security health status included in the heartbeat at the gateway;

following detecting the change of the security health status included in the heartbeat at the gateway, receiving, by the gateway, network traffic other than the heartbeat from the endpoint, the network traffic addressed for forwarding by the gateway via the second network to a second destination address outside the gateway from the enterprise network; and

responding to the change of the security health status included in the heartbeat in combination with the network traffic received following the change, the response including blocking, by the gateway, the network traffic other than the heartbeat from the endpoint.

2. The method of claim 1, wherein the gateway is logically interposed between the second network and the endpoint in the enterprise network.

3. The method of claim 1, wherein the heartbeat is cryptographically signed.

4. The method of claim 1, wherein the heartbeat includes at least one item unique to the endpoint.

5. The method of claim 1, wherein the security health status is further based on integrity of cryptographic key stores on the endpoint.

6. The method of claim 1, wherein the security health status is further based on virus definition files of security software executing on the endpoint.

7. The method of claim 1, wherein the heartbeat is a periodic signal.

8. The method of claim 1, wherein issuance of the heartbeat from the endpoint to the gateway is conditioned on an uncompromised security health status of the endpoint.

9. The method of claim 1, wherein responding to the change in security health status included in the heartbeat in combination with the network traffic received following the change further includes quarantining the endpoint.

10. The method of claim 1, wherein the network traffic includes suspicious network traffic.

11. A computer program product comprising a non-transitory computer readable medium having stored thereon computer executable code that, when executing on one or more computing devices, cause the one or more computing devices to perform the steps of:

receiving, at a gateway interposed between a second network and an endpoint in an enterprise network, a heartbeat from the endpoint in communication with the second network via the gateway, the heartbeat addressed to the gateway, the heartbeat including a signal communicated from the endpoint to the gateway, and the heartbeat containing cryptographically secured information including a security health status of the endpoint, the security health status based on monitoring, by a health monitor on the endpoint, software items executing on the endpoint and the security health status indicating an uncompromised security health status when the endpoint is uncompromised;

detecting, at the gateway, a change in the security health status included in the heartbeat;

following detecting the change of the security health status included in the heartbeat at the gateway, receiving, by the gateway, network traffic other than the heartbeat from the endpoint, the network traffic addressed for forwarding by the gateway via the second network to a second destination address outside the gateway from the enterprise network; and

responding to the change of the security health status included in the heartbeat in combination with the network traffic received following the change, the response including blocking, by the gateway, the network traffic other than the heartbeat from the endpoint.

12. The computer program product of claim 11, wherein the security health status is further based on integrity of cryptographic key stores on the endpoint.

13. The computer program product of claim 11, wherein the security health status is further based on virus definition files of security software executing on the endpoint.

14. The computer program product of claim 11, wherein the heartbeat is a periodic signal.

15. The computer program product of claim 11, wherein issuance of the heartbeat from the endpoint to the gateway is conditioned on the uncompromised security health status of the endpoint.

16. The computer program product of claim 11, wherein responding to the change in security health status included in the heartbeat in combination with the network traffic received following the change further includes quarantining the endpoint.

17. A system comprising:

an endpoint in a first network, the endpoint including a first memory, and the endpoint configured to monitor software items executing on the endpoint and to create a heartbeat containing cryptographically secured information including a security health status of the endpoint, the security health status based on the software items executing on the endpoint and the security health status indicating an uncompromised security health status when the endpoint is uncompromised; and

a gateway interposed between the endpoint in the first network and a second network, the gateway in communication with the endpoint over the first network, the endpoint in communication with the second network via the gateway, the gateway including a second memory configured to receive the heartbeat from the endpoint and to receive and forward network traffic, other than the heartbeat, from the endpoint to a destination address in the second network, and to detect a change in the security health status included in the heartbeat, the gateway further configured to initiate remedial action directed to the endpoint based on a combination of the detected change of the security health status included in the heartbeat and detection of network traffic, other than the heartbeat, following detection of the change of the security health status, the remedial action including blocking network traffic from the endpoint.

18. The system of claim 17, wherein issuance of the heartbeat from the endpoint to the gateway is conditioned on the uncompromised security health status of the endpoint.

19. The system of claim 17, wherein the remedial action further includes quarantining the endpoint.