Detection of adversaries through collection and correlation of assessments

• US 8,677,479 B2
• Filed: 08/17/2007
• Issued: 03/18/2014
• Est. Priority Date: 04/16/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Neystadt, John, Hudis, Efim
• Primary Examiner(s): Zee, Edward
• Application Number:
  US11/893,934
• Publication Number:
  US 20080256619A1
• Time in Patent Office: 2,405 Days
• Field of Search: 726 22- 25
• US Class Current: 726/22
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 2463/144 Detection or countermeasures against botnets
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

An automated arrangement for detecting adversaries is provided in which assessments of detected adversaries are reported to a reputation service from security devices, such as unified threat management systems in deployed customer networks. By using actual deployed networks, the number of available sensors can be very large to increase the scope of the adversary detection, while still observing real attacks and threats including those that are targeted to small sets of customers. The reputation service performs a number of correlations and validations on the received assessments to then return a reputation back to the security device in the enterprise network that can be used for blocking adversaries, but only when multiple, distinct sources report the same adversary in their assessments to thus ensure that the reputation is accurate and reliable.

Claims

1. A method of operating a reputation service, the method comprising the steps of:

collecting an assessment of a detected adversary from a security product deployed at a network, the assessment from the security product containing at least a time-to-live value that defines a time interval over which the assessment is valid, wherein once the time interval of the time-to-live value expires, the assessment is no longer valid; and

correlating the collected assessment with other assessments to establish a confidence level that is associated with a reputation for the detected adversary,

wherein the time-to-live value has an initial default value and the time-to-live value, in subsequent assessments from the security product, is increased, by the security product, using an algorithm, when the security product detects the adversary on a recurring basis.

2. The method of claim 1 including a further step of authenticating the assessment using one of ID or security certificate.

3. The method of claim 1 in which the security product is one of firewall product or UTM product.

4. The method of claim 1 including a further step of generating the reputation only when multiple valid assessments are received from distinct networks that identify the detected adversary.

5. The method of claim 1 in which the assessment provides a severity of a security incident associated with the detected adversary.

6. The method of claim 5 in which the severity is used to establish the confidence level.

7. The method of claim 1 in which the time-to-live value is increased using a function selected from one of exponential or geometric.

8. The method of claim 4 in which the confidence level increases as the number valid assessments received increases.

9. The method of claim 1 including a further step of maintaining a list of excluded proxies from which received assessments are ignored.

10. The method of claim 1 including a further step of maintaining a list of excluded shared web hosting sites for which received assessments are ignored.

11. The method of claim 1 in which the assessment identifies a URL or IP address associated with the adversary.

12. The method of claim 11 in which the URL or the IP address is subjected to a hashing algorithm.

13. The method of claim 12 in which the hashing algorithm is one of CRC32, MD-5 or SHA-1.

14. A computer-readable storage medium, not consisting of a propagated signal, containing instructions which, when executed by one or more processors disposed in an electronic device, performs a method for reporting assessments to a reputation service, the method comprising the steps of:

generating an assessment at a security product upon detection of an adversary attacking an enterprise network;

populating the assessment with data including a time-to-live value that defines a time interval over which the assessment is valid, and an ID value that uniquely identifies the adversary; and

sending the assessment, including the data from said populating step, as telemetry to the reputation service,

wherein the time-to-live value has an initial default value and the time-to-live value, in subsequent assessments from the security product, is increased, by the security product, using an algorithm, when the security product detects the adversary on a recurring basis.

15. The computer-readable storage medium of claim 14 in which the method includes a further step of populating the assessment with a severity of an incident associated with the adversary.

16. The computer-readable storage medium of claim 15 in which the ID value is one of URL or IP address.

17. A computer-implemented database, comprising:

a computer;

records arranged for storing reputation assessments relating to an adversary detected by a plurality of sensors distributed among customer networks, each reputation assessment generated by a security product deployed at a network and, as received by the database, including at least a time-to-live value that defines a time interval over which each of the reputation assessments is valid; and

an interface to a reputation service by which multiple valid records are correlated to derive a fidelity for a reputation associated with the adversary,

wherein the time-to-live value has an initial default value and the time-to-live value, in subsequent assessments from the security product, is increased, by the security product, using an algorithm, when the security product detects the adversary on a recurring basis.

18. The computer-implemented database of claim 17 in which the adversary is a compromised host operating on a botnet.

19. The computer-implemented database of claim 17 in which the derived fidelity provides a level of confidence for the reputation.