Anomaly detection system for enterprise network security

• US 9,112,895 B1
• Filed: 06/25/2012
• Issued: 08/18/2015
• Est. Priority Date: 06/25/2012
• Status: Active Grant

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: EMC Corporation (Dell Technologies Inc.)
• Inventors: Lin, Derek
• Primary Examiner(s): Moorthy, Aravind
• Application Number:
  US13/532,355
• Time in Patent Office: 1,149 Days
• Field of Search: 726/22, 726/25
• US Class Current: 1/1
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Anomaly detection is disclosed, including: determining a set of anomalous events associated with an enterprise network; and determining a path of interest based at least in part on at least a subset of the set of anomalous events.

Claims

1. An anomaly detection system, comprising:

a processor configured to;

determine a set of anomalous events associated with an enterprise network, wherein each of the set of anomalous events is stored with a corresponding plurality of attributes; and

determine a path of interest based at least in part on at least a subset of the set of anomalous events, wherein the path of interest includes a series of two or more anomalous events from the set of anomalous events, wherein each anomalous event of the path of interest is determined to be linked to an adjacent anomalous event of the path of interest, wherein determining the path of interest includes;

determining that an attribute of a stored plurality of attributes corresponding to a first anomalous event of the set of anomalous events matches an attribute of a stored plurality of attributes corresponding to a second anomalous event of the set of anomalous events;

storing a link relationship between the first anomalous event and the second anomalous event based at least in part on the determination that the attribute of the stored plurality of attributes corresponding to the first anomalous event matches the attribute of the stored plurality of attributes corresponding to the second anomalous event, wherein the link relationship between the first anomalous event and the second anomalous event is included in the path of interest; and

determining a score corresponding to the stored link relationship between the first anomalous event and the second anomalous event;

determine an overall score corresponding to the path of interest based at least in part on the score corresponding to the stored link relationship between the first anomalous event and the second anomalous event, and

a memory coupled to the processor and configured to store data associated with the set of anomalous events.

2. The system of claim 1, wherein one of the set of anomalous events includes an incident suspected as being associated with a security threat.

3. The system of claim 1, wherein the processor is further configured to collect a plurality of security patterns and determine one or more features for one of the plurality of security patterns.

4. The system of claim 1, wherein the processor is further configured to:

build a plurality of sensors, wherein one of the plurality of sensors comprises a model trained on historical event data; and

use the plurality of sensors to determine at least the set of anomalous events based at least in part on current event data.

5. The system of claim 4, wherein the sensor is configured to determine that an event is anomalous based on a threshold score predefined for the sensor.

6. The system of claim 1, wherein to determine the path of interest includes to use link analysis to determine a link between pairs of anomalous events included in the set of anomalous events.

7. The system of claim 1, wherein the processor is further configured to present the path of interest with at least another path of interest.

8. The system of claim 1, wherein the score corresponding to the stored link relationship between the first anomalous event and the second anomalous event is determined based at least in part on at least some of the stored plurality of attributes corresponding to the first anomalous event and at least some of stored plurality of attributes corresponding to the second anomalous event.

9. A method for anomaly detection, comprising:

determining, by a processor, a set of anomalous events associated with an enterprise network, wherein each of the set of anomalous events is stored with a corresponding plurality of attributes; and

determining a path of interest based at least in part on at least a subset of the set of anomalous events, wherein the path of interest includes a series of two or more anomalous events from the set of anomalous events, wherein each anomalous event of the path of interest is determined to be linked to an adjacent anomalous event of the path of interest, wherein determining the path of interest includes;

determining that an attribute of a stored plurality of attributes corresponding to a first anomalous event of the set of anomalous events matches an attribute of a stored plurality of attributes corresponding to a second anomalous event of the set of anomalous events;

storing a link relationship between the first anomalous event and the second anomalous event based at least in part on the determination that the attribute of the stored plurality of attributes corresponding to the first anomalous event matches the attribute of the stored plurality of attributes corresponding to the second anomalous event, wherein the link relationship between the first anomalous event and the second anomalous event is included in the path of interest; and

determining a score corresponding to the stored link relationship between the first anomalous event and the second anomalous event; and

determining an overall score corresponding to the path of interest based at least in part on the score corresponding to the stored link relationship between the first anomalous event and the second anomalous event.

10. The method of claim 9, further comprising:

building a plurality of sensors, wherein one of the plurality of sensors comprises a model trained on historical event data; and

using the plurality of sensors to determine at least the set of anomalous events based at least in part on current event data.

11. The method of claim 10, wherein the sensor is configured to determine that an event is anomalous based on a threshold score predefined for the sensor.

12. The method of claim 9, wherein determining the path of interest includes using link analysis to determine a link between pairs of anomalous events included in the set of anomalous events.

13. The method of claim 9, further comprising presenting the path of interest with at least another path of interest.

14. A computer program product for anomaly detection, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions for:

determining a set of anomalous events associated with an enterprise network, wherein each of the set of anomalous events is stored with a corresponding plurality of attributes; and

determining a path of interest based at least in part on at least a subset of the set of anomalous events, wherein the path of interest includes a series of two or more anomalous events from the set of anomalous events, wherein each anomalous event of the path of interest is determined to be linked to an adjacent anomalous event of the path of interest, wherein determining the path of interest includes;

determining that an attribute of a stored plurality of attributes corresponding to a first anomalous event of the set of anomalous events matches an attribute of a stored plurality of attributes corresponding to a second anomalous event of the set of anomalous events;

storing a link relationship between the first anomalous event and the second anomalous event based at least in part on the determination that the attribute of the stored plurality of attributes corresponding to the first anomalous event matches the attribute of the stored plurality of attributes corresponding to the second anomalous event, wherein the link relationship between the first anomalous event and the second anomalous event is included in the path of interest; and

determining a score corresponding to the stored link relationship between the first anomalous event and the second anomalous event; and

determining an overall score corresponding to the path of interest based at least in part on the score corresponding to the stored link relationship between the first anomalous event and the second anomalous event.