UNWANTED TUNNELING ALERT SYSTEM

• US 20180159874A1
• Filed: 02/08/2018
• Published: 06/07/2018
• Est. Priority Date: 08/13/2014
• Status: Active Grant

• Current Assignee: Palantir Technologies Incorporated
• Original Assignee: Palantir Technologies Incorporated
• Inventors: Ricafort, Juan, Singh, Harkirat, Martin, Philip
• Granted Patent: US 10,609,046 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/556 involving covert channels, i.e. data leakage between processes inhibiting the analysis of circuitry or operation with measures against power attack G06F21/755
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Various systems and methods are provided that detect malicious network tunneling. For example, VPN logs and data connection logs may be accessed. The VPN logs may list client IP addresses that have established a VPN connection with an enterprise network. The data connection logs may list client IP addresses that have requested connections external to the enterprise network and remote IP addresses to which connections are requested. The VPN logs and the data connection logs may be parsed to identify IP addresses that are present in the VPN logs as a client IP address and in the data connection logs as a remote IP address. If an IP address is so present, user data and traffic data associated with the IP address may be retrieved to generate a risk score. If the risk score exceeds a threshold, an alert to be displayed in a GUI is generated.

Claims

1. A computing system comprising:

a computer processor; and

a non-transitory computer readable storage medium storing program instructions configured for execution by the computer processor in order to cause the computing system to;

access a first log including a listing of one or more client IP addresses corresponding to one or more remote users granted access to a network;

access a second log including a listing of one or more remote IP addresses requested via the network;

identify a first IP address included in the first log and in the second log;

generate a risk score based on data associated with the first IP address, the risk score at least partly indicative of a likelihood that a malicious tunneling connection is present; and

generate user interface data that, when executed, causes a user device to display a user interface depicting one or more alerts generated using the risk score.

2. The computing system of claim 1, wherein the one or more alerts are generated periodically.

3. The computing system of claim 1, wherein a first alert in the one or more alerts comprises at least one of a number of users that are connected to a known virtual private network (VPN) client during a time period associated with the first alert, an indication of whether characteristics of traffic between the network and a second user device matches a tunneled connection profile, an indication of an amount of outbound data transmitted by the second user device to a remote user device, an indication of whether suspicious file transfer protocol (FTP) activity was detected, an indication of whether a country mismatch was detected, or an indication of whether a suspected case of a VPN compromise is present.

4. The computing system of claim 1, wherein the non-transitory computer readable storage medium further stores program instructions that cause the computing system to:

receive an indication that a first alert in the one or more alerts is selected; and

update the user interface data such that the user interface includes a window depicting at least one of information of a user associated with first IP address, an indication of whether the user is a person of interest, an indication of a geographic location of the user, an indication of a geographic location to where the user tunneled, or the risk score.

5. The computing system of claim 1, wherein the non-transitory computer readable storage medium further stores program instructions that cause the computing system to:

receive an indication that a first alert in the one or more alerts is selected; and

receive an indication that the first alert is a false positive; and

adjust determination of future risk scores based on the received indication that the first alert is a false positive.

6. The computing system of claim 5, wherein the non-transitory computer readable storage medium further stores program instructions that cause the computing system to adjust weights of one or more factors used to generate future risk scores based on the received indication that the first alert is a false positive.

7. The computing system of claim 1, wherein, in connection with a determination that the second log indicates that a tunneled connection is established over a first port, the generated risk score is lower than if the tunneled connection is established over a second port.

8. A computer-implemented method comprising:

as implemented by one or more computer systems comprising computer hardware and memory, the one or more computer systems configured with specific executable instructions,

accessing a first log including a listing of one or more source addresses corresponding to one or more remote users granted access to a network;

accessing a second log including a listing of one or more destination addresses requested via the network;

identifying a first address included in both the first log and in the second log;

generating a risk score based on data associated with the first address; and

generating user interface data that, when executed, causes a user device to display a user interface depicting one or more alerts generated using the risk score.

9. The computer-implemented method of claim 8, wherein the one or more alerts are generated periodically.

10. The computer-implemented method of claim 8, wherein a first alert in the one or more alerts comprises at least one of a number of users that are connected to a known virtual private network (VPN) client during a time period associated with the first alert, an indication of whether characteristics of traffic between the network and a second user device matches a tunneled connection profile, an indication of an amount of outbound data transmitted by the second user device to a remote user device, an indication of whether suspicious file transfer protocol (FTP) activity was detected, an indication of whether a country mismatch was detected, or an indication of whether a suspected case of a VPN compromise is present.

11. The computer-implemented method of claim 8, further comprising:

receiving an indication that a first alert in the one or more alerts is selected; and

updating the user interface data such that the user interface includes a window depicting at least one of information of a user associated with first IP address, an indication of whether the user is a person of interest, an indication of a geographic location of the user, an indication of a geographic location to where the user tunneled, or the risk score.

12. The computer-implemented method of claim 8, further comprising:

receiving an indication that a first alert in the one or more alerts is selected; and

receiving an indication that the first alert is a false positive; and

adjusting determination of future risk scores based on the received indication that the first alert is a false positive.

13. The computer-implemented method of claim 12, wherein adjusting determination of future risk scores further comprises adjusting weights of one or more factors used to generate future risk scores based on the received indication that the first alert is a false positive.

14. The computer-implemented method of claim 8, wherein, in connection with a determination that the second log indicates that a tunneled connection is established over a first port, the generated risk score is lower than if the tunneled connection is established over a second port.

15. A non-transitory computer-readable medium comprising one or more program instructions recorded thereon, the instructions configured for execution by a computing system comprising one or more processors in order to cause the computing system to:

access a first log including a listing of one or more source addresses corresponding to a plurality of remote users granted access to a network;

access a second log including a listing of one or more destination addresses requested via the network;

identify a first address included in both the first log and in the second log;

generate a risk score based on data associated with the first address; and

generate user interface data that, when executed, causes a user device to display a user interface depicting one or more alerts generated using the risk score.

16. The medium of claim 15, wherein the one or more alerts are generated periodically.

17. The medium of claim 15, wherein a first alert in the one or more alerts comprises at least one of a number of users that are connected to a known virtual private network (VPN) client during a time period associated with the first alert, an indication of whether characteristics of traffic between the network and a second user device matches a tunneled connection profile, an indication of an amount of outbound data transmitted by the second user device to a remote user device, an indication of whether suspicious file transfer protocol (FTP) activity was detected, an indication of whether a country mismatch was detected, or an indication of whether a suspected case of a VPN compromise is present.

18. The medium of claim 15, wherein the instructions are further configured to cause the computing system to:

receive an indication that a first alert in the one or more alerts is selected; and

update the user interface data such that the user interface includes a window depicting at least one of information of a user associated with first IP address, an indication of whether the user is a person of interest, an indication of a geographic location of the user, an indication of a geographic location to where the user tunneled, or the risk score.

19. The medium of claim 15, wherein the instructions are further configured to cause the computing system to:

receive an indication that a first alert in the one or more alerts is selected; and

receive an indication that the first alert is a false positive; and

adjust determination of future risk scores based on the received indication that the first alert is a false positive.

20. The medium of claim 19, wherein the instructions are further configured to cause the computing system to adjust weights of one or more factors used to generate future risk scores based on the received indication that the first alert is a false positive.