COMPUTER SECURITY APPARATUS

• US 20170339174A1
• Filed: 05/19/2016
• Published: 11/23/2017
• Est. Priority Date: 05/19/2016
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: MOUNAGURUSWAMY, GURUVISHNUVARDAN
• Granted Patent: US 10,673,878 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

Aspects provide for an automated computer security apparatus. A first sequential action data set of different actions performed sequentially in engaging a computer system to execute a data operation on the computer system is categorized as a normal or abnormal operation. Actions of the first sequential action data set and of another (second) sequential action data set of different actions having the same normal or abnormal category of the first set are randomly selected and combined to generate a random sequential action data set for the common category of the first and second sequential action data sets, to define a sequential order of actions performed sequentially in engaging the computer system to execute a random set data operation on the computer system.

Claims

1. A computer-implemented method for an automated computer security apparatus, comprising executing on a computer processor the steps of:

categorizing a first sequential action data set that comprises a plurality of different actions performed sequentially in engaging a computer system to execute a data operation on the computer system as a normal operation in response to determining that the first sequential action data set plurality of different actions engage the computer system to execute an allowable data operation on the computer system;

categorizing the first sequential action data set as an abnormal operation in response to determining that the first sequential action data set plurality of different actions engage the computer system to execute a forbidden data operation on the computer system;

randomly selecting at least one of the actions of the first sequential action data set and at least one other action of a second sequential action data set that has the category of the first sequential action data set, wherein the second sequential action data set comprises a plurality of different actions that includes the randomly selected at least one other action and that are performed sequentially in engaging the computer system to execute a second data operation on the computer system; and

generating a random sequential action data set for the category of the first sequential action data set and the second sequential data set by combining the actions selected from the first sequential action data set and the second sequential action data set into an order that is performed sequentially in engaging the computer system to execute a random data set operation on the computer system.

2. The method of claim 1, wherein the access granted to the enterprise secure data to the user from the off-site location, pursuant to either of the applied security settings and the revised security settings, is provided as a service in a cloud environment.

3. The method of claim 1, further comprising:

integrating computer-readable program code into a computer system comprising a processor, a computer readable memory and a computer readable storage medium, wherein the computer readable program code is embodied on the computer readable storage medium and comprises instructions that, when executed by the processor via the computer readable memory, cause the processor to perform the steps of categorizing the first sequential action data set as the normal operation or as the abnormal operation, randomly selecting the at least one of the actions of the first sequential action data set and the at least one other action of the second sequential action data set, and generating the random sequential action data set for the category of the first sequential action data set and the second sequential data set.

4. The method of claim 1, further comprising:

in response to determining that the first sequential action data set comprises an initiating action that is originated from within a network of the computer system, labeling the first sequential action data set as within a same space of the computer system; and

in response to determining that the first sequential action data set initiating action is originated from outside of networks of the computer system, labeling the first sequential action data set as within a different space relative to the computer system; and

wherein the step of randomly selecting the at least one other action of the second sequential action data set is responsive to the second sequential action data set having the same space label or the different space label of the first sequential action data set.

5. The method of claim 4, wherein the first initiating action is selected from the group consisting of an email, a chat and a text communication, the method further comprising:

determining whether the first sequential action data set initiating action is originated from within or outside of networks of the computer system by performing a reverse domain name system lookup of an internet protocol address of the first instigating action via searching domain name registry and registrar tables.

6. The method of claim 5, further comprising:

recognizing that a term within the first initiating action is equivalent to password;

categorizing the first initiating action as a request for a password in response to the recognizing that that the term within the first initiating action is equivalent to password; and

in response to determining that the first initiating action is originated from outside of the networks of the computer system, categorizing the first sequential action data set as the abnormal operation and blocking a response to the first initiating action.

7. The method of claim 1, further comprising:

in response to an input to a network of the computer system of a third sequential set of different actions that are performed sequentially in engaging the computer system to execute a third data operation on the computer system, comparing the third sequential set of actions to the generated random sequential action data set;

labeling the third sequential set with the normal category or the abnormal category of the random sequential action data set in response to determining that the third sequence of actions matches a sequence of the sequential actions of the random sequential action data set; and

labeling the third sequential set with a different one of the normal category or the abnormal category of the random sequential action data set in response to determining that the third sequence of actions does not match a sequence of the sequential actions of the random sequential action data set.

8. The method of claim 7, further comprising:

allowing the third sequential sequence of different actions to engage the computer system to execute the third data operation on the computer system in response to determining that the label of the third sequential set is the normal category; and

preventing the third sequential sequence of different actions from engaging the computer system to execute the third data operation on the computer system in response to determining that the label of the third sequential set is the abnormal category.

9. A system, comprising:

a processor;

a computer readable memory in circuit communication with the processor; and

a computer readable storage medium in circuit communication with the processor;

wherein the processor executes program instructions stored on the computer-readable storage medium via the computer readable memory and thereby;

categorizes a first sequential action data set that comprises a plurality of different actions performed sequentially in engaging a computer system to execute a data operation on the computer system as a normal operation in response to determining that the first sequential action data set plurality of different actions engage the computer system to execute an allowable data operation on the computer system;

categorizes the first sequential action data set as an abnormal operation in response to determining that the first sequential action data set plurality of different actions engages the computer system to execute a forbidden data operation on the computer system;

randomly selects at least one of the actions of the first sequential action data set and at least one other action of a second sequential action data set that has the category of the first sequential action data set, wherein the second sequential action data set comprises a plurality of different actions that includes the randomly selected at least one other action and that are performed sequentially in engaging the computer system to execute a second data operation on the computer system; and

generates a random sequential action data set for the category of the first sequential action data set and the second sequential data set by combining the actions selected from the first sequential action data set and the second sequential action data set into an order that is performed sequentially in engaging the computer system to execute a random data set operation on the computer system.

10. The system of claim 9, wherein the processor executes program instructions stored on the computer-readable storage medium via the computer readable memory and thereby further:

in response to determining that the first sequential action data set comprises an initiating action that is originated from within a network of the computer system, labels the first sequential action data set as within a same space of the computer system; and

in response to determining that the first sequential action data set initiating action is originated from outside of networks of the computer system, labels the first sequential action data set as within a different space relative to the computer system; and

wherein the processor randomly selects the at least one other action of the second sequential action data set in response to the second sequential action data set having the same space label or the different space label of the first sequential action data set.

11. The system of claim 10, wherein the first initiating action is selected from the group consisting of an email, a chat and a text communication;

and

wherein the processor executes program instructions stored on the computer-readable storage medium via the computer readable memory and thereby further determines whether the first sequential action data set initiating action is originated from within or outside of networks of the computer system by performing a reverse domain name system lookup of an internet protocol address of the first instigating action via searching domain name registry and registrar tables.

12. The system of claim 11, wherein the processor executes program instructions stored on the computer-readable storage medium via the computer readable memory and thereby further:

recognizes that a term within the first initiating action is equivalent to password;

categorizes the first initiating action as a request for a password in response to the recognizing that that the term within the first initiating action is equivalent to password; and

in response to determining that the first initiating action is originated from outside of the networks of the computer system, categorizes the first sequential action data set as the abnormal operation and blocking a response to the first initiating action.

13. The system of claim 9, wherein the processor executes program instructions stored on the computer-readable storage medium via the computer readable memory and thereby further:

in response to an input to a network of the computer system of a third sequential set of different actions that are performed sequentially in engaging the computer system to execute a third data operation on the computer system, compares the third sequential set of actions to the generated random sequential action data set;

labels the third sequential set with the normal category or the abnormal category of the random sequential action data set in response to determining that the third sequence of actions matches a sequence of the sequential actions of the random sequential action data set; and

labels the third sequential set with a different one of the normal category or the abnormal category of the random sequential action data set in response to determining that the third sequence of actions does not match a sequence of the sequential actions of the random sequential action data set.

14. The system of claim 13, wherein the processor executes program instructions stored on the computer-readable storage medium via the computer readable memory and thereby further:

allows the third sequential sequence of different actions to engage the computer system to execute the third data operation on the computer system in response to determining that the label of the third sequential set is the normal category; and

prevents the third sequential sequence of different actions from engaging the computer system to execute the third data operation on the computer system in response to determining that the label of the third sequential set is the abnormal category.

15. A computer program product for an automated computer security apparatus, the computer program product comprising:

a computer readable storage medium having computer readable program code embodied therewith, wherein the computer readable storage medium is not a transitory signal per se, the computer readable program code comprising instructions for execution by a processor that cause the processor to;

categorize a first sequential action data set that comprises a plurality of different actions performed sequentially in engaging a computer system to execute a data operation on the computer system as a normal operation in response to determining that the first sequential action data set plurality of different actions engage the computer system to execute an allowable data operation on the computer system;

categorize the first sequential action data set as an abnormal operation in response to determining that the first sequential action data set plurality of different actions engage the computer system to execute a forbidden data operation on the computer system;

randomly select at least one of the actions of the first sequential action data set and at least one other action of a second sequential action data set that has the category of the first sequential action data set, wherein the second sequential action data set comprises a plurality of different actions that includes the randomly selected at least one other action and that are performed sequentially in engaging the computer system to execute a second data operation on the computer system; and

generate a random sequential action data set for the category of the first sequential action data set and the second sequential data set by combining the actions selected from the first sequential action data set and the second sequential action data set into an order that is performed sequentially in engaging the computer system to execute a random set data operation on the computer system.

16. The computer program product of claim 15, the computer readable program code comprising instructions for execution by the processor that further cause the processor to:

in response to determining that the first sequential action data set comprises an initiating action that is originated from within a network of the computer system, label the first sequential action data set as within a same space of the computer system; and

in response to determining that the first sequential action data set initiating action is originated from outside of networks of the computer system, label the first sequential action data set as within a different space relative to the computer system; and

wherein the processor randomly selects the at least one other action of the second sequential action data set in response to the second sequential action data set having the same space label or the different space label of the first sequential action data set.

17. The computer program product of claim 16, wherein the first initiating action is selected from the group consisting of an email, a chat and a text communication;

and

the computer readable program code comprising instructions for execution by the processor that further cause the processor to determine whether the first sequential action data set initiating action is originated from within or outside of networks of the computer system by performing a reverse domain name system lookup of an internet protocol address of the first instigating action via searching domain name registry and registrar tables.

18. The computer program product of claim 17, the computer readable program code comprising instructions for execution by the processor that further cause the processor to:

recognize that a term within the first initiating action is equivalent to password;

categorize the first initiating action as a request for a password in response to the recognizing that that the term within the first initiating action is equivalent to password; and

in response to determining that the first initiating action is originated from outside of the networks of the computer system, categorize the first sequential action data set as the abnormal operation and blocking a response to the first initiating action.

19. The computer program product of claim 15, the computer readable program code comprising instructions for execution by the processor that further cause the processor to:

in response to an input to a network of the computer system of a third sequential set of different actions that are performed sequentially in engaging the computer system to execute a third data operation on the computer system, compare the third sequential set of actions to the generated random sequential action data set;

label the third sequential set with the normal category or the abnormal category of the random sequential action data set in response to determining that the third sequence of actions matches a sequence of the sequential actions of the random sequential action data set; and

label the third sequential set with a different one of the normal category or the abnormal category of the random sequential action data set in response to determining that the third sequence of actions does not match a sequence of the sequential actions of the random sequential action data set.

20. The computer program product of claim 19, the computer readable program code comprising instructions for execution by the processor that further cause the processor to:

allow the third sequential sequence of different actions to engage the computer system to execute the third data operation on the computer system in response to determining that the label of the third sequential set is the normal category; and

prevent the third sequential sequence of different actions from engaging the computer system to execute the third data operation on the computer system in response to determining that the label of the third sequential set is the abnormal category.