DE112016002806T5 - Graphene-based intrusion detection using process traces - Google Patents

Abstract

Methods and systems for detecting malicious processes include modeling system data as graphs with vertices representing system entities and edges representing events between respective system entities. Each edge has one or more timestamps corresponding to respective events between two system entities. A set of valid path patterns related to potential attacks is generated. One or more event sequences in the system are determined to be suspect based on the graph and valid path patterns using random motion on the graph.

Description

INFORMATION OF THE RELATED APPLICATION

This application is a continuation-in-part of Application No. 15 / 098,861, filed April 14, 2016, which claims priority to application Ser. No. 62 / 148,232, filed on Apr. 16, 2015. This application further claims priority to the application Ser. No. 62 / 196,404 filed on Jul. 24, 2015, and to the application Ser. No. 62 / 300,572 filed on Jul. 11, 2016, which are incorporated herein by reference in their entirety are.

BACKGROUND

Technical area

The present invention relates to computer and information security, and more particularly to host-level intrusion detection on massive process traces.

Description of the Prior Art

Corporate networks are key systems in companies and they transfer the vast majority of operational information. Due to their importance, these nets are often the targets of attack. To guarantee information security in the network of computers, an intrusion detection system is required to track the current status of the entire network and to identify scenarios associated with potential attacks or malicious behaviors.

At the host level, detection systems collect rich information about process / program events (eg, when a program opens a file) at a particular host or machine. Although this information allows intrusion detection systems to closely monitor intrusion behavior, it fails to detect new detection threats on signature-based detection techniques, while anomaly-based detection techniques either focus on the detection of a single anomalous process or require an offline model of training data to be purely normal Events is built.

More importantly, intrusion detection systems often rely on a coordinated or sequential non-independent action of multiple system events to determine what state a given system is in. The system that monitors data typically consists of low level process events or interactions between different system entities such as For example, processes, files, and jacks (e.g., when a program opens or connects a file to a server) with exact timestamps, while attempted penetrations are higher level activities, usually involving several different process events. For example, a network attack known as Advanced Perilous Danger (APT) is a set of secret and continuous computer hacking processes. APT first tries to gain a foothold in the environment. Using the vulnerable systems as access to the target network, APT then employs additional tools that help meet the target. The gap that exists between the levels of process events and intrusion activities makes it difficult to deduce which process events are related to real malicious activities, especially given that massive, "noisy" process events happen in between. Therefore, conventional attack detection techniques that identify individual suspicious process events are inappropriate to address this scenario.

SUMMARY

One method of detecting malicious processes involves modeling system data as graphs with vertices representing system entities and edges representing events between respective system entities. Each edge has one or more timestamps corresponding to respective events between two system entities. A set of valid path patterns related to potential attacks is generated. One or more event sequences in the system are determined to be suspect based on the graph and valid path patterns using random motion on the graph.

A system for detecting malicious processes includes a modeling module configured to model system data as graphs having vertices representing system entities and edges representing events between respective system entities. Each edge includes one or more timestamps corresponding to respective events between two system entities. A malicious process path detection module includes a processor configured to generate a set of valid path patterns related to potential attacks and one or more event sequences in the system based on the graph and valid path patterns using a Random motion on the graph to be suspect.

These and other features and advantages will become more apparent from the following Description of illustrative embodiments thereof, which should be read in conjunction with the accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

The disclosure provides details in the following description of preferred embodiments with reference to the following figures, in which:

1 is directed to a mesh graph representing communities and roles of nodes in accordance with the present principles.

2 Figure 10 is a block / flow diagram of a method for discovering community and role memberships and detecting anomalies in accordance with the present principles.

3 Figure 3 is a block diagram of a host level analysis module in accordance with the present principles.

4 Figure 12 is a block / flow diagram of a method for detecting suspected host level event sequences in accordance with the present principles.

5 is a segment of a pseudo-code for detecting suspected host-level event sequences in accordance with the present principles.

6 Fig. 10 is a block diagram of a processing system according to the present principles.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS

In accordance with the present principles, the present embodiments provide detection of malicious process paths, detecting abnormal process paths related to penetration activities. This is done using process traces. A set of valid sequence patterns is generated and a random-based process is used to learn system functions and discover suspicious process sequences. In order to eliminate weighting bias from the path length, Box-Cox power transformation is used to normalize the anomaly scores of process sequences.

The present embodiments thereby provide complete evidence of the activity trace of an attacker (i.e., the process path) after an attack has occurred. In addition, the present embodiments more accurately detect malicious process paths, reducing the number of false positives and false negatives in less time and with less computational complexity. A compact graph structure can be used to reduce the memory load, a set of valid sequence patterns can be created and used to reduce the search space, and a random move method can be used to reduce computational costs. Further, the present embodiments may detect new attacks since training data is not required.

Referring now in detail to the figures in which like characters represent the same or similar elements, and initially to 1 an architecture of an automatic security intelligence system (ASI) is shown. The ASI system has three main components: an agent 10 is installed in each machine of a corporate network to collect operational data; Backend server 200 receive data from the agents 10 , preprocess the data and send the preprocessed data to an analysis server 30 ; and an analysis server 30 running the security application program to analyze the data.

Every agent 10 includes an agent manager 11 , an agent updater 12 and agent data 13 which, in turn, may include information regarding active processes, file access, power sockets, the number of instructions per cycle, and host information. The backend server 20 includes an agent updater server 21 and a monitoring data store. The analysis server 30 includes an intrusion detection 31 , a safety policy satisfaction assessment 32 , incident tracking, and system recovery 33 and a centralized hazard search and hazard inquiry 34 ,

Regarding 2 is an additional detail about the intrusion detection 31 shown. Five modules are located in an intrusion detection machine: a data distributor 41 that receives the data from the backend server 20 receives and the corresponding to the network level module 42 and host levels module 43 distributed; a network analysis module 42 processing the network communications (including TCP and UDP) and detecting abnormal communication events; a host level analysis module 43 processing host level events, including user process events, process file events, and user registry events; an anomaly fusion module 44 Integrates network-level anomalies and host-level anomalies and refines the results for trusted intrusion events; and a visualization module 45 that outputs the detection results to end users.

Regarding 3 is an additional detail about the host level analysis module 43 shown. The host level analysis module 43 includes a hardware processor 312 and a memory 314 , It also includes the host level analysis module 43 one or more functional modules that in one embodiment are in memory 314 can be stored and by the hardware processor 312 can be executed. In an alternative embodiment, the functional modules may be implemented as one or more discrete hardware components in the form of e.g. Application-specific integrated chips or user-programmable link fields.

The host level analysis module 43 includes a number of different analysis and detection functions. A process file anomaly detection module 302 takes host-level process file events from the data distributor 41 as input and detects abnormal process file events. These events can, for. For example, reading or writing to a file. A user-process anomaly detection module 304 takes all streaming process events as input from the data distributor 41 and models each user's behavior at the process level, identifying suspicious processes that are operated by each user. A USB event anomaly detection module 306 Also considers the streaming process events and identifies all events related to a USB device to detect abnormal device activity. A process signature abnormality detection module 308 takes process names and signatures as input from the data distributor 41 and detects processes with suspicious signatures. Finally, a module takes 310 to detect malicious process paths current active processes from the data distributor 41 as starting points and tracks all possible process paths by combining the incoming and previous events in a time window. The module 310 to detect malicious process paths detects abnormal process sequences / paths, as described in more detail below.

With reference now to 4 a method for the detection of malicious process paths is shown. A design graph is used as input. The design graph is a heterogeneous graph constructed from a historical record of communications in a network, where the nodes of the design graph represent physical devices in a corporate network and edges reflect the normal communication patterns among the nodes. The block 402 performs graph modeling using a compact graph structure to capture the complex interactions between system features as an acyclic multipartite graph. The block 404 then generates a set of valid sequence patterns based on a maximum sequence length. The maximum sequence length can be set by a user or an optimal value can be determined automatically. Forming the valid sequence patterns drastically reduces the search space size of the graph.

The block 406 then scans the graph to determine candidate event sequences that are consistent with the patterns. A "pattern" refers to an ordered set of system type types, while a "sequence" refers to an ordered set of special system entities. Thus, a sequence is consistent with a pattern if its series of respective types of system properties matches those of the pattern. Sequences are alternatively referred to here as "paths".

The block 408 applies a random move to extract the properties of each entity. Based on the type of entity discovered, the block calculates 408 an anomaly assessment of each candidate process to evaluate how abnormal the process is. Since there may be several different sequence patterns with different lengths, and because the scores of two paths of different lengths are not directly comparable, the anomaly scoring distribution for each sequence pattern will be divided into a single distribution by the block 410 z. B. transformed using a Box-Cox power transformation. The block 410 measures the deviation between the suspicious sequences and the normal sequences, reporting those sequences that have a greater deviation than a threshold.

Attack behavior often involves multiple system entities (such as processes, files, jacks, etc.). Therefore, the present embodiments integrate the interactions between several different system entities.

The amount of information provided by the system monitor can be extremely large, making direct storage and direct access to this information in memory impractical. However, the information has a great deal of redundancy. The redundancy is first found in attributes, because each event record includes not only the entities involved, but also the attributes of those entities. Repeated saving of attributes for each event is redundant. Second, the repetitive storage of events involving the same entities, with only the timestamps changing between them, is redundant. Third, the storage of records that are irrelevant to the detection of intrusion attacks is unnecessary.

The graph model is therefore determined by the block 402 generated to integrate the meaningful information from the monitoring data in a compressed manner. The graph model is represented as a directed graph G = (V, E, T), where T is a set of timestamps, E ⊂ V × V × T is the set of edges and V = F ∪ P ∪ U ∪ S is the set of is vertices, where F is the set of files that are in the computer system, P is the set of processes, U the set of UNIX ^® bushings and S is the set of Internet sockets. For a particular edge (ν _i , ν ₃ ) in E, T (ν _i , ν _j ) denotes the set of timestamps on the edge. For each event e, if the corresponding edge already exists in G, a timestamp t is added to the edge timestamps. If not, build the block 402 such an edge to G with the time stamp set T (ν _i , ν _j ) = {t}. In this structure, the attribute values for a single entity are stored only once. For each event sequence of length / there is a corresponding path through G of / edges.

To extract the most suspicious paths from the graph G, a naive method would be to examine all of the existing paths. However, it is impractical to enumerate all possible paths from a densely connected graph. To create a policy for the candidate search in the block 406 The block generates 404 a set of valid path patterns B. Only those paths that match the valid path patterns are related to potential attacks - others may be discarded.

Each path pattern B of length / includes / entities and / or entity types. Thus, the path pattern B may include both special entities (e.g., special files) and more general entity type identifiers in the same path. B is determined as a valid path pattern only if there exists at least one path p in G that is consistent with B. Given that / can be a small number, all possible paths can be enumerated. Browsing the graph G allows all valid patterns to be extracted.

The valid path patterns B may be generated, for example, by experts using their experience with previous intrusion detection attacks. However, it may be difficult to obtain an accurate and complete set of valid path patterns from such experts. As such, path patterns can be generated automatically. Each entity is designated as a specific system type. For all paths that match an information leak, they must begin with a file-type (F) and end with an Internet-connected-entity (I). Considering a path p ∈ G and a path pattern B of G, p [i] and B [i] represent the ith node in p and B, respectively. The path p is therefore consistent with B, which is p <B is denoted if p and B have the same length and if for each / p [i] ∈ B [i] holds (ie the special entity p [i] belongs to the entity type B [i]). Then B is a valid path pattern if at least one path p exists in G such that p <B. In one example according to the above constraints, there are four potential path patterns of length three using the four entity types described above: {F, F , I}, {F, P, I}, {F, U, I} and {F, I, I}. Because only one process node can connect a file node to an Internet book node. In this way, all valid patterns in G can be detected.

Based on the generated valid path pattern B, the block looks for 406 for paths in multipartite graphs that fulfill the patterns. Considering an event sequence seq = {e ₁ , e ₂ , ..., e _r ), an equivalent path p = {ν ₁ , ν ₂ , ..., ν _{r + 1} } must be present in the graph G. Since the events follow the time order, a time order constraint is applied to the candidate path search. By applying the path patterns and time series constraint to a breadth-first search, the candidate paths can be discovered with a one-time sample of G. The candidate paths C are defined as: C = {p | p ∈ G, ∃b ∈ B st p <b}

Even with a filter policy based on path patterns and time series constraint, there may still be a large number of candidate paths that remain in graph G, most of which are related to normal behavior. As such, the present embodiments extract suspicious paths from the larger set of candidate paths.

wobei N die Gesamtzahl von Entitäten ist und T(v_i, v_j) der Satz von Zeitstempeln ist, an dem das Ereignis zwischen v_i und v_j jemals passiert ist. Folglich bezeichnet A[i][j] die Wahrscheinlichkeit, dass die Informationen von v_i zu v_j in G fließen.A candidate path is through the block 408 determined as suspicious if in the path the participating entities behave differently from their normal roles. In a computer system, the information sender and information recipients are identified as entity roles. The sender and receiver rating should be learned exactly by the computer system as they are used to set the profile of normal behavior. To achieve this, a random motion is applied to the graph G. From G, a square N × N transition matrix A is calculated as:

where N is the total number of entities and T (v _i , v _j ) is the set of timestamps at which the event ever passed between v _i and v _j . Thus, A [i] [j] denotes the probability that the information flows from v _i to v _j in G.

wobei null eine Null-Untermatrix darstellt, und wobei der Pfeiloperator eine Richtung des Informationsflusses angibt. P → F gibt beispielsweise einen Fluss von Informationen vom Prozess zur Datei an. Es sollte beachtet werden, dass die von null verschiedenen Untermatrizen von A nur zwischen Prozessen und Dateien und zwischen Prozessen und Buchsen auftreten, aber nicht zwischen jeweiligen Prozessen, da Prozess-Prozess-Wechselwirkungen nicht mit dem Wechselwirkungsfluss vorkommen. Diese sind durch UNIX-^®-Systeme festgelegte Einschränkungen. Since A is the matrix representation of the multipart graph G, A can also be referred to as:

where zero represents a zero sub-matrix and where the arrow operator indicates a direction of information flow. For example, P → F indicates a flow of information from the process to the file. It should be noted that the non-zero sub-matrices of A occur only between processes and files and between processes and jacks, but not between processes because process-process interactions do not occur with the interaction flow. These are restrictions imposed by UNIX ^® systems.

wobei die anfänglichen Vektoren X₀ und Y₀ zufällig erzeugt werden und wobei sich m auf die Nummer der aktuellen Iteration bezieht. Allgemein ausgedrückt, eine Entität, die Informationen zu einer großen Anzahl von Entitäten mit hohen Empfängerbewertungen sendet, ist selbst ein wichtiger Informationssender und ebenso ist eine Entität, die Informationen von einer großen Anzahl von Entitäten mit hohen Senderbewertungen empfängt, ein wichtiger Informationsempfänger. Die Sender- und Empfängerbewertungen für eine Entität werden daher iterativ berechnet durch Akkumulieren der Empfänger- und Senderbewertungen in Bezug auf die Entität. Datei/etc./Passwort in einem UNIX^®-System weist beispielsweise eine hohe Senderbewertung und eine niedrige Empfängerbewertung auf, da es zu vielen Prozessen zum Prüfen von Zugangserlaubnissen gesendet wird, aber selten modifiziert wird.If X is to be a transmitter weight vector, said X [i] denotes the channel evaluation of ν _i, and Y is the recipient vector is to be reviewed, the transmitter and receiver reviews each entity can be generated iteratively as:

wherein the initial vectors X ₀ and Y ₀ are generated randomly and wherein m refers to the number of the current iteration. Generally speaking, an entity that sends information to a large number of entities with high recipient ratings is itself an important information sender and also an entity that receives information from a large number of entities with high sender ratings is an important receiver of information. The sender and receiver scores for an entity are therefore calculated iteratively by accumulating the receiver and sender scores in relation to the entity. For example, file / etc / password in a ^UNIX® system has high station rating and low receiver rating because it is sent to many access permission checking processes but is rarely modified.

One result of this iterative refinement is that the learned score values depend on the initial scores. However, the effect of the initial scores can be eliminated using the stationary property of the matrix. Considering a general square matrix M and a general vector π, the general vector π can be repeatedly updated as: π T / m + 1 = M × π T / m

A convergence state is possible such that π _{m + 1} ≈ π _m for sufficiently large values of m. In this case, there is only one value that can reach the state of convergence: π T / n = M × π T / n

The convergence state has the property that the converged vector depends only on the matrix M, but is independent of the initial vector value π ₀ .

In order to achieve the state of convergence, the matrix M must fulfill two conditions: irreducibility and aperiodicity. A graph G is irreducible if and only if any two nodes have at least one path between them. The period of a node is the minimum path length from the node back to itself and the period of a graph is the largest common divisor of all the period values of the nodes. A graph G is aperiodic if and only if it is irreducible and the period of G 1.

Since the system graph G is not always strongly connected, the iteration described above does not always achieve convergence. To ensure convergence, a restart matrix R is added, which is an N × N square matrix, with each cell value 1 / N is. A new transition matrix A is defined as: A = (1-c) × A + c × R where c is a value between 0 and 1 and is called a restart ratio. It is guaranteed that A is irreducible and aperiodic, providing converged sender evaluation and receiver evaluation vectors. The convergence rate can be controlled by controlling the restart rate value. An exemplary value for a number of iterations to use to ensure convergence is about 10.

Based on the sender and receiver rating and considering a path p, the anomaly score for the path is calculated as: Rating (p) = 1 - NS (p)

As noted above, the anomaly scores for paths of different lengths have different distributions. To the suspicion of paths of different lengths too Therefore, a transformation is performed to place paths of different lengths on the same foundation. The path anomaly score can have any distribution and is generally not a normal distribution. The suspicion of a path of length r can be defined as: susp (p | r) = Prob (T (Score (p ')) ≤ T (Score (p)) || p' | = r) where T is the normalization function.

wobei λ ein Normierungsparameter ist. Verschiedene Werte für λ ergeben verschiedene transformierte Verteilungen. Das Ziel besteht darin, einen Wert von λ auszuwählen, der eine normierte Verteilung so nahe wie möglich an der Normalverteilung ergibt (d. h. T(B, λ) ~ N(μ, σ²)).The top k suspects paths are those with the highest suspiciousness rating. Mathematically, it is feasible to obtain the transformation to convert a normal distribution to any other distribution, but it is difficult to obtain the inverse function. To solve this problem, a Box-Cox power transformation is used as a normalization function. In particular, if Q (r) is to denote the set of anomaly scores that are computed from paths of length r, then q ∈ Q (r) holds for each score.

where λ is a normalization parameter. Different values for λ give different transformed distributions. The goal is to select a value of λ that gives a normalized distribution as close as possible to the normal distribution (ie T (B, λ) ~ N (μ, σ ² )).

The upper k suspect paths are not considered in terms of intrusion attacks if they are not sufficiently different from the normal paths. To measure the deviation of suspicious paths from normal paths, the t-value between the two groups of paths is calculated. Because of the large number of normal paths, an efficient Monte Carlo simulation approach is used to calculate the expectancy and variance of a sample of relatively small size without computing the summation.

Once a suspicious path has been detected, the host level analysis module delivers 43 Information regarding the anomaly, wherein a report is generated that may include one or more alarms. The anomaly fusion module 44 Integrates these host-level alarms with other host and network-level anomalies and automatically filters out false positives. The resulting list of anomalies is via the visualization module 45 delivered to a user. In an alternative embodiment, certain anomalies or classes of anomalies may be automatically addressed, for example by employing security countermeasures or mitigations. In a specific example, an automatic response to a detected anomaly may be to turn off a device that displays the abnormal behavior until it can be verified by an administrator.

With reference now to 5 a pseudocode to discover the upper k suspicious paths "SP". Transmitter and receiver evaluation vectors X and Y are generated using the random motion process. A queue of files F _X is sorted according to descending X and a second queue of files F _Y is sorted in descending Y. The queue of processes P _X and P _Y, queues of UNIX ^® bushings U U _X and _Y, and queues of Internet sockets S _X and S _Y are generated in the same manner. The paths are then processed to find a path set that matches the event sequence pattern and the time constraint.

Embodiments described herein may be entirely hardware, fully software, or include both hardware and software elements. In a preferred embodiment, the present invention is implemented in software that includes, but is not limited to, firmware, resident software, microcode, etc.

Embodiments may include a computer program product accessible from a computer usable or computer readable medium providing program code for use by or in connection with a computer or any instruction execution system. A computer usable or computer readable medium may include any device that stores, transmits, propagates, or transports the program for use by or in connection with the instruction execution system, the instruction execution device, or the instruction execution device. The medium may be a magnetic, optical, electronic, electromagnetic, infrared or semiconductor system (or device or device) or a propagation medium. The medium can be a computer-readable storage medium such. For example, a semiconductor or solid state memory, a magnetic tape, a removable computer diskette, a random access random access memory (RAM), a read only memory (ROM), a rigid magnetic disk and an optical disk and so on.

Specifically, each computer program may be stored in machine-readable storage media or a storage device (eg, program memory or magnetic disk) readable by a general purpose or special purpose computer for configuring and controlling the computer program Operating a computer when the storage media or storage device is read by the computer to perform the procedures described herein. The inventive system may also be considered embodied in a computer readable storage medium configured with a computer program, the storage medium thus configured causing a computer to operate in a specific and predefined manner to perform the functions described herein.

A data processing system suitable for storing and / or executing program code may include at least one processor directly or indirectly coupled to memory elements through a system bus. The memory elements may include a local memory used during the actual execution of the program code, a mass memory and a cache memory that provide temporary storage of at least some program code to reduce the number of times that the code from the mass memory during the Execution is retrieved include. Input / output or I / O devices (including, but not limited to, keyboards, displays, pointing devices, etc.) may be coupled to the system either directly or through intervening I / O control units.

Network adapters may also be coupled to the system to enable the data processing system to be coupled to other data processing systems or remote printers or storage devices through intervening private or public networks. Modems, a cable modem, and Ethernet cards are just a few of the currently available types of network adapters.

With reference now to 6 is an exemplary processing system 600 shown that the analysis server 30 , the intrusion detection system 31 and / or the host level analysis module 43 can represent. The processing system 600 includes at least one processor (CPU) 604 that works with other components over a system bus 602 is coupled. A cache 606 , a read-only memory (ROM) 608 , a random access random access memory (RAM) 610 , an input / output adapter (I / O adapter) 620 , a sound adapter 630 , a network adapter 640 , a user interface adapter 650 and a display adapter 660 are with the system bus 602 effectively coupled.

A first storage device 622 and a second storage device 624 are effective with the system bus 602 through the I / O adapter 620 coupled. The storage devices 622 and 624 may be any of a disk storage device (e.g., a magnetic or optical disk storage device), a magnetic semiconductor device, and so on. The storage devices 622 and 624 may be the same type of storage device or different types of storage devices.

A loudspeaker 632 is effective with the system bus 602 through the sound adapter 630 coupled. A transmitter / receiver 642 is with the system bus 602 through the power adapter 640 effectively coupled. A display device 662 is with the system bus 602 through the display adapter 660 effectively coupled.

A first user input device 652 , a second user input device 654 and a third user input device 656 are with the system bus 602 through the user interface adapter 650 effectively coupled. The user input devices 652 . 654 and 656 may be any of a keyboard, a mouse, a keypad, an image capture device, a motion capture device, a microphone, a device having the functionality of at least two of the foregoing devices, and so on. Of course, other types of input devices may also be used while maintaining the spirit of the present principles. The user input devices 652 . 654 . 656 may be the same type of user input device or different types of user input devices. The user input devices 652 . 654 and 656 are used to get information in and out of the system 600 to enter and output.

The processing system 600 may of course comprise other elements (not shown), as readily recognized by one skilled in the art, as well as omitting certain elements. Various other input devices and / or output devices may be used in the processing system, for example 600 depending on the particular implementation thereof, as will be readily understood by one skilled in the art. Various types of wireless and / or wired input and / or output devices may be used, for example. Moreover, additional processors, controllers, memory and so forth may also be used in various configurations, as readily recognized by one of ordinary skill in the art. These and other variations of the processing system 600 are readily contemplated by one skilled in the art in light of the teachings of the present principles provided herein,

The foregoing is to be understood as illustrative and exemplary in all respects, but not limiting, and the scope of the invention disclosed herein is not to be determined by the detailed description, but rather by the claims, as interpreted in accordance with the full breadth of the patent is allowed. Of course, the embodiments shown and described herein are merely illustrative of the principles of the present invention, and those skilled in the art can implement various modifications without departing from the scope and spirit of the invention. One skilled in the art could implement various other feature combinations without departing from the scope and spirit of the invention. Having thus described aspects of the invention with the details and particularity required by the patent laws, what is claimed and desired to be protected by the patent is set forth in the appended claims.

Claims (20)

A method of detecting malicious processes comprising: Modeling system data as graphs with vertices representing system entities and edges representing events between respective system entities, each edge comprising one or more timestamps corresponding to respective events between two system entities; Generating a set of valid path patterns related to potential events; and Determining one or more event sequences in the system as suspicious on the basis of the graph and the valid path patterns using random motion on the graph. The method of claim 1, wherein the system entities include files in the system, processes in the system, ^UNIX® sockets in the system, and Internet sockets in the system. The method of claim 1, wherein the valid patterns are determined based on properties of the system type types. The method of claim 3, wherein the valid path patterns are determined based on definitions provided by security experts in accordance with their experience based on intrusion attacks. The method of claim 1, wherein determining the one or more event sequences as suspicious comprises performing a breadth-first search of candidate paths within the graph. The method of claim 5, wherein the breadth-first search comprises a time-order constraint based on the edge timestamps. The method of claim 1, wherein determining the one or more event sequences as suspicious comprises determining that the entities at an edge deviate from the normal roles for those entities. The method of claim 7, wherein determining that entities differ from the normal role for these entities comprises determining a sender entity rating for a sender entity and a recipient rating for a recipient entity. The method of claim 8, wherein determining one or more event sequences as suspicious comprises calculating an anomaly score based on the transmitter score and the receiver score for each entity in each event sequence. The method of claim 9, wherein determining one or more event sequences as suspicious comprises normalizing anomaly scores using Box-Cox power transformation. A system for detecting malicious processes comprising: a modeling module configured to model system data as graphs representing vertices representing system entities and edges representing events between respective system entities, each edge comprising one or more timestamps corresponding to respective events between two system entities; and a module for detecting malicious process paths with a processor configured to generate a set of valid path patterns related to potential attacks and one or more event sequences in the system based on the graph and the valid path patterns using a Random motion on the graph to be suspect. The system of claim 11, wherein the system entities include files in the system, processes in the system, ^UNIX® sockets in the system, and Internet sockets in the system. The system of claim 11, wherein the malicious process path detection module is further configured to determine valid patterns based on properties of the system type types. The system of claim 13, wherein the malicious process path detection module is further configured to determine valid path patterns based on definitions provided by security experts based on their experience based on previous intrusion attacks. The system of claim 11, wherein the malicious process path detection module is further configured to perform a breadth search of candidate paths within the graph. The system of claim 15, wherein the breadth first search comprises a time order restriction based on the edge timestamps. The system of claim 11, wherein the malicious process path detection module is further configured to determine whether the entities at one edge differ from the normal roles for those entities. The system of claim 17, wherein the malicious process path detection module is further configured to determine a sender entity sender rating and a recipient entity recipient rating. The system of claim 18, wherein the malicious process path detection module is further configured to calculate an anomaly score based on the sender rating and recipient rating for each entity in each event sequence. The system of claim 19, wherein the malicious process path detection module is further configured to normalize anomaly scores using box-to-box performance transformation.

Images