Cyber Defense Systems And Methods

• US 20140245443A1
• Filed: 11/16/2013
• Published: 08/28/2014
• Est. Priority Date: 02/27/2013
• Status: Active Grant

• Current Assignee: Sayan Chakraborty
• Original Assignee: Sayan Chakraborty
• Inventors: Chakraborty, Sayan
• Granted Patent: US 9,185,124 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Cyber defense systems and methods protect an enterprise system formed of a plurality of networked components. Connectivity and relationship information indicative of connectivity and behavior of the components are collected. A relationship graph is created based upon the connectivity data and the relationship data, wherein nodes of the relationship graph represent the components and edges of the graph represent connectivity and relationships. At least part of the relationship graph is stored to form a chronology. The relationship graph and the chronology are analyzed to predict connectivity and relationship changes within the enterprise system, and a first anomaly is identified when the current connectivity and relationships do not match the prediction

Claims

1. A cyber defense method for protecting an enterprise system having a plurality of networked components, comprising:

collecting connectivity and relationship information indicative of connectivity and behavior of the components;

creating a relationship graph based upon the connectivity data and the relationship data, wherein nodes of the relationship graph represent the components and edges of the graph represent connectivity and relationships;

storing at least part of the relationship graph to form a chronology;

analyzing the relationship graph and the chronology to predict connectivity and relationship changes within the enterprise system; and

identifying a first anomaly when the current connectivity and relationships do not match the prediction.

2. The cyber defense method of claim 1, further comprising analyzing the relationship graph to identify peer groups of nodes that have similar connectivity and relationship characteristics, wherein predicted connectivity and relationship changes are further based upon the peer groups.

3. The cyber defense method of claim 1, further comprising sending at least part of the predictions to an associated agent operating to collect the information, wherein the agent identifies the first anomaly.

4. The cyber defense method of claim 1, further comprising:

determining uncertainty of the information; and

generating an alert if the uncertainty is less than a predefined threshold.

5. The cyber defense method of claim 1, further comprising:

processing textual data of the information to identify phrases and words occurring infrequently; and

identifying a second anomaly based upon the infrequent words and phrases.

6. The cyber defense method of claim 5, further comprising generating the alert based upon correlation of the first and second anomaly.

7. A cyber defense method for protecting an enterprise system having a plurality of networked components, comprising:

receiving information from at least one agent configured to collect the information from the enterprise system;

calculating normative baseline values and abnormal statistical thresholds based upon the information;

generate relationship graph T based upon updates and changes within the information;

calculate uncertainty based upon the information and an age of the information;

compare a previously generated predicted relationship graph T and relationship graph T and generate anomaly list;

filter anomaly list based upon uncertainty; and

generating alerts based upon the filtered anomaly list.

8. The cyber defense method of claim 7, further comprising aging the relationship graphs.

9. The cyber defense method of claim 7, further comprising generating the predicted relationship graph based upon the relationship graphs.

10. The cyber defense method of claim 9, further comprising sending predictions within the predicted relationship graph to the at least one agent, wherein the agent identifies current events within the enterprise system not matching the predictions.

11. A software product comprising instructions, stored on non-transitory computer-readable media, wherein the instructions, when executed by a computer, perform steps for protecting an enterprise system having a plurality of networked components, comprising:

instructions for collecting connectivity and relationship information indicative of connectivity and behavior of the components;

instructions for creating a relationship graph based upon the connectivity data and the relationship data, wherein nodes of the relationship graph represent the components and edges of the graph represent connectivity and relationships;

instructions for storing at least part of the relationship graph to form a chronology;

instructions for analyzing the relationship graph and the chronology to predict connectivity and relationship changes within the enterprise system; and

instructions for identifying a first anomaly when the current connectivity and relationships do not match the prediction.

12. The cyber defense method of claim 11, further comprising instructions for analyzing the relationship graph to identify peer groups of nodes that have similar connectivity and relationship characteristics, wherein predicted connectivity and relationship changes are further based upon the peer groups.

13. The cyber defense method of claim 11, further comprising instructions for sending at least part of the predictions to an associated agent operating to collect the information, wherein the agent identifies the first anomaly.

14. The cyber defense method of claim 11, further comprising:

instructions for determining uncertainty of the information; and

instructions for generating an alert if the uncertainty is less than a predefined threshold.

15. The cyber defense method of claim 11, further comprising:

instructions for processing textual data of the information to identify phrases and words occurring infrequently; and

instructions for identifying a second anomaly based upon the infrequent words and phrases.

16. The cyber defense method of claim 15, further comprising instructions for generating the alert based upon correlation of the first and second anomaly.