CYBER SECURITY

• US 20170251012A1
• Filed: 02/09/2017
• Published: 08/31/2017
• Est. Priority Date: 02/25/2016
• Status: Active Grant

• Current Assignee: Darktrace Holdings Limited
• Original Assignee: Darktrace Limited
• Inventors: STOCKDALE, Jack, DUNN, Matt
• Granted Patent: US 10,516,693 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06N 20/00 Machine learning
• CPC Class Codes: G06N 7/01 Probabilistic graphical models, e.g. probabilistic networks
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud

Abstract

Disclosed herein is a method for use in detection of abnormal behavior of a group of a plurality of entities of a computer system. The method is arranged to be performed by a processing system and includes: creating a model of normal behavior of the group of entities; and determining, in accordance with the model of normal behavior of the group of entities, a parameter indicative of abnormal behavior of the group of entities. Also disclosed is an equivalent computer readable medium and anomalous behavior detection system.

Claims

1. A method for use in controlling abnormal behavior of at least one entity of a computer system, the method arranged to be performed by a processing system, the method comprising:

creating a model of normal behavior of the at least one entity; and

applying restrictions to the at least one entity based on the model of normal behavior.

3. The method of claim 1, further comprising:

determining, in accordance with the model of normal behavior of the at least one entity, a parameter indicative of abnormal behavior of the entity; and

wherein

the step of applying restrictions to the at least one entity is carried out when the parameter exceeds a threshold value.

4. The method of claim 3, wherein the restrictions comprise at least one of blocking access to an internet address, removing permission to a network resource or removing permission to a local resource.

5. The method of claim 3, wherein the restrictions are applied by a control system.

6. The method of claim 5, wherein the control system is a firewall, next generation firewall, router, switch, intrusion prevention system or Microsoft Active Directory authentication system.

7. The method of claim 3, wherein the parameter is a probability.

8. The method of claim 1, wherein the model of normal behavior of the at least one entity is a Bayesian model.

9. The method of claim 1, wherein each entity of the computer system is one of a device, a user, an activity.

10. The method of claim 1, wherein the at least one entity is a group of entities, and wherein the group is generated by grouping a plurality of entities of the computer system.

11. The method of claim 10, wherein the grouping of the plurality of entities of the computer system to generate the group of entities is based on data associated with the plurality of entities of the computer system.

12. The method of claim 11, wherein the grouping of the plurality of entities of the computer system to generate the group of entities is performed by spectral partitioning.

13. The method of claim 10, wherein the grouping of the plurality of entities of the computer system to generate the group of entities is based on prior knowledge of the plurality of entities of the computer system.

14. A computer readable medium comprising non-transitory computer readable code operable, in use, to instruct a computer to perform the method of claim 1.

15. An anomalous behavior detection system comprising a processor, and a memory comprising non-transitory computer readable code operable, in use, to instruct the processor to perform the method of claim 1.

2. The method of claim 2, wherein the model of normal behavior of the at least one entity is based on metrics representative of data associated with the entity of the computer system.