COMPOSITE ANALYSIS OF EXECUTABLE CONTENT ACROSS ENTERPRISE NETWORK

• US 20150047034A1
• Filed: 08/09/2013
• Published: 02/12/2015
• Est. Priority Date: 08/09/2013
• Status: Active Grant

• Current Assignee: Lockheed Martin Corporation (Martin Marietta Corporation)
• Original Assignee: Lockheed Martin Corporation (Martin Marietta Corporation)
• Inventors: Burnham, James B., Hale, Robert W., Sewell, Timothy A.
• Granted Patent: US 9,300,682 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Identification, characterization and attribution of executable content within and across an enterprise infrastructure (e.g., hosts, subnets, routers, etc.) to provide situational awareness for cyber security for purposes of supporting proactive defense and response. Copies of executable content collected at one or more locations within an infrastructure (e.g., hosts, network edges, etc.) may be passed to a central analysis server whereby various characteristics of the executable content may be extracted or gleaned from the copies such as author marks (e.g., directory names), tool marks (e.g., compiler settings), behaviors (e.g., function extraction), patterns (e.g., byte sequences), text, and/or the like. The characteristics may be analyzed in various manners to build profiles of actors or organizations associated with (e.g., responsible for) executable content within the enterprise infrastructure.

Claims

1. A method for use in analyzing executable content within at least one network of an enterprise, the method comprising:

receiving executable content at a central analysis server over at least one network of an enterprise;

extracting, by a processor of the central analysis server, one or more characteristics from the executable content;

identifying, by the processor, associations among the extracted characteristics; and

storing the extracted characteristics and identified associations in a database accessible by the central analysis server.

2. The method of claim 1, wherein the identifying comprises detecting at least one common extracted characteristic shared by a first portion and a second portion of the received executable content.

3. The method of claim 1, wherein the extracted characteristics are selected from the group consisting of:

an author mark, a tool mark, a behavior, a pattern, and a text sequence.

4. The method of claim 1, further comprising:

building at least one profile based on at least one of the identified associations, wherein the at least one profile identifies at least one entity associated with the executable content linked to the at least one association.

5. The method of claim 4, further comprising:

monitoring executable content associated with the at least one profile within the enterprise by detecting at least one common characteristic between extracted characteristics of a first portion of received executable content and the profile

6. The method of claim 5, further comprising:

attributing the first piece of executable content to the at least one profile.

7. The method of claim 5, further comprising:

obtaining a hash value of the first portion of executable content; and

tracking the hash value as it is detected throughout the enterprise by recording a location of the detected hash value within the enterprise and storing the location of the hash value in the database of the central analysis server

8. The method of claim 1, further comprising before the receiving:

detecting executable content within the at least one network of an enterprise with at least one of a plurality of collection agents disposed within the at least one network of the enterprise;

copying the executable content; and

distributing the executable content copies to the central analysis server.

9. The method of claim 8, further comprising:

tagging, by the collection agent, the executable content copies with location information that identifies a location of the collection agent within the enterprise.

10. The method of claim 8, further comprising:

assigning, by the collection agent, a hash value to the executable content, wherein the hash value uniquely identifies the executable content.

11. The method of claim 8, wherein the collection agent resides at a network host.

12. The method of claim 8, wherein the collection agent resides at a strategic point in the enterprise infrastructure, the strategic point being selected from the group consisting of:

a network edge, a major subnet division, and a router.

13. The method of claim 10, further comprising:

indicating to the central analysis server the occurrence of detection of executable content with a recognized unique hash value, in lieu of distributing another copy of the executable content to the central analysis server.

14. A system for analyzing executable content within at least one network of an enterprise, comprising:

a plurality of collection agents disposed within one or more networks of an enterprise and executable by one or more processors of one or more devices within the one or more networks, wherein each collection agent is configured to detect a presence of executable content within the enterprise; and

a central analysis server interconnected to the plurality of collection agents via the one or more networks, the central analysis server comprising;

a collection engine, executable by a processor of the central analysis engine, that is configured to capture and store executable content received from the plurality of collection agents;

an extraction engine, executable by the processor of the central analysis engine, that is configured to extract one or more characteristics from the executable content;

an analysis engine, executable by the processor of the central analysis engine, that is configured to identify associations among the extracted characteristics; and

a first database, accessible by the processor of the central analysis engine, that is configured to store the executable content and the extracted characteristics.

15. The system of claim 14, wherein at least one of the collection agents resides at a strategic point in the enterprise infrastructure, the strategic point being selected from the group consisting of:

a network edge, a major subnet division, and a router.

16. The system of claim 14, wherein the analysis engine is configured to build at least one profile based on the identified associations, wherein the at least one profile identifies at least one entity associated with the executable content linked to the at least one association.

17. The system of claim 14 further comprising:

a second database, accessible by the processor of the central analysis server, that is configured to store the profiles.

18. The system of claim 14, wherein the extracted characteristics are selected from the group consisting of:

an author mark, a tool mark, a behavior, a pattern, and a text sequence.

19. The system of claim 14, wherein the first database is configured to store unique hash values associated with each piece of executable content.

20. The system of claim 14, wherein the first database is configured to store information specifying a unique location associated with each piece of executable content.