EP4352674A1 - Notation de confiance dans la conformité d'un utilisateur à l'aide de politiques de sécurité d'une organisation - Google Patents
Notation de confiance dans la conformité d'un utilisateur à l'aide de politiques de sécurité d'une organisationInfo
- Publication number
- EP4352674A1 EP4352674A1 EP22805527.3A EP22805527A EP4352674A1 EP 4352674 A1 EP4352674 A1 EP 4352674A1 EP 22805527 A EP22805527 A EP 22805527A EP 4352674 A1 EP4352674 A1 EP 4352674A1
- Authority
- EP
- European Patent Office
- Prior art keywords
- user
- alert
- users
- alerts
- weights
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 230000008520 organization Effects 0.000 title claims abstract description 93
- 238000000034 method Methods 0.000 claims abstract description 76
- 230000000694 effects Effects 0.000 claims abstract description 71
- 230000006399 behavior Effects 0.000 claims description 107
- 230000009471 action Effects 0.000 claims description 50
- 230000002547 anomalous effect Effects 0.000 claims description 38
- 230000015654 memory Effects 0.000 claims description 20
- 230000006870 function Effects 0.000 claims description 18
- 230000008569 process Effects 0.000 claims description 12
- 230000000903 blocking effect Effects 0.000 claims description 10
- 238000005516 engineering process Methods 0.000 abstract description 27
- 238000007726 management method Methods 0.000 description 19
- 238000001514 detection method Methods 0.000 description 17
- 238000011156 evaluation Methods 0.000 description 16
- 238000010801 machine learning Methods 0.000 description 11
- 238000012549 training Methods 0.000 description 10
- 238000004891 communication Methods 0.000 description 9
- 238000012545 processing Methods 0.000 description 9
- 102100035606 Beta-casein Human genes 0.000 description 8
- 101000947120 Homo sapiens Beta-casein Proteins 0.000 description 8
- 230000005856 abnormality Effects 0.000 description 7
- 238000010586 diagram Methods 0.000 description 7
- 238000007689 inspection Methods 0.000 description 7
- 238000004422 calculation algorithm Methods 0.000 description 6
- 238000003491 array Methods 0.000 description 5
- 238000004364 calculation method Methods 0.000 description 5
- 238000012217 deletion Methods 0.000 description 5
- 230000037430 deletion Effects 0.000 description 5
- 230000035945 sensitivity Effects 0.000 description 5
- 238000012546 transfer Methods 0.000 description 4
- 241001481828 Glyptocephalus cynoglossus Species 0.000 description 3
- 238000004458 analytical method Methods 0.000 description 3
- 230000008859 change Effects 0.000 description 3
- 238000000605 extraction Methods 0.000 description 3
- 230000002265 prevention Effects 0.000 description 3
- 238000012552 review Methods 0.000 description 3
- 230000002159 abnormal effect Effects 0.000 description 2
- 238000013459 approach Methods 0.000 description 2
- 150000001768 cations Chemical class 0.000 description 2
- 230000001010 compromised effect Effects 0.000 description 2
- 238000004590 computer program Methods 0.000 description 2
- 230000000977 initiatory effect Effects 0.000 description 2
- 230000010354 integration Effects 0.000 description 2
- 238000013507 mapping Methods 0.000 description 2
- 230000007246 mechanism Effects 0.000 description 2
- 238000012544 monitoring process Methods 0.000 description 2
- 230000003287 optical effect Effects 0.000 description 2
- 230000002093 peripheral effect Effects 0.000 description 2
- 230000002085 persistent effect Effects 0.000 description 2
- 238000007619 statistical method Methods 0.000 description 2
- 230000001960 triggered effect Effects 0.000 description 2
- 230000000007 visual effect Effects 0.000 description 2
- 125000002842 L-seryl group Chemical group O=C([*])[C@](N([H])[H])([H])C([H])([H])O[H] 0.000 description 1
- 230000003044 adaptive effect Effects 0.000 description 1
- 238000012550 audit Methods 0.000 description 1
- 238000013475 authorization Methods 0.000 description 1
- 230000008901 benefit Effects 0.000 description 1
- 238000013497 data interchange Methods 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 238000005538 encapsulation Methods 0.000 description 1
- 230000003203 everyday effect Effects 0.000 description 1
- 239000000284 extract Substances 0.000 description 1
- 238000009499 grossing Methods 0.000 description 1
- 230000036541 health Effects 0.000 description 1
- 102000051759 human factor J Human genes 0.000 description 1
- 108700008420 human factor J Proteins 0.000 description 1
- 230000003993 interaction Effects 0.000 description 1
- 239000004973 liquid crystal related substance Substances 0.000 description 1
- 239000000463 material Substances 0.000 description 1
- 238000005065 mining Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000006855 networking Effects 0.000 description 1
- 238000012502 risk assessment Methods 0.000 description 1
- 238000013349 risk mitigation Methods 0.000 description 1
- 230000004884 risky behavior Effects 0.000 description 1
- 239000000344 soap Substances 0.000 description 1
- 238000013179 statistical model Methods 0.000 description 1
- 230000000153 supplemental effect Effects 0.000 description 1
- 230000001360 synchronised effect Effects 0.000 description 1
- 230000008685 targeting Effects 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q10/00—Administration; Management
- G06Q10/06—Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- G06F21/577—Assessing vulnerabilities and evaluating computer system security
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1433—Vulnerability analysis
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
Definitions
- the technology disclosed generally relates to behavior analytics for quantifying overall riskiness of a user so that security administrators can readily identify the top risky users and take appropriate actions. More specifically, the disclosed technology relates to determining a user confidence score that reflects user behavior anomalies that indicate potential threats, through machine learning and statistical analysis.
- Cybercriminals see the cloud as an effective method for subverting detection. Patterns of cyberthreats and malicious insiders change constantly. Meanwhile, sensitive data is increasingly distributed and moving to applications that are not necessarily sanctioned or properly secured.
- FIG. 1 illustrates an architectural level schematic of a system for evaluating user compliance with an organization’s security policies, calibrating a user confidence or risk score that expresses evaluation of user behavior that was not compliant with an organization’s security policies, and for reducing false detection of anomalous user behavior on a computer network, in accordance with an implementation of the technology disclosed.
- FIG. 2A illustrates a high-level block diagram of Netskope cloud access security broker with user utilizing cloud based services via a network, for evaluating user compliance with an organization’s security policies.
- FIG. 2B shows an example list of app events for a group of users, for use by batch alert detectors, with the count of events by each user for each of a list of apps.
- FIG. 2C illustrates an example UI for reporting results for a disclosed user behavior analytics machine learning batch detector.
- FIG. 3A through FIG. 3E list a set of alerts for a single user.
- FIG. 3A shows user data for an alert with informational severity.
- FIG. 3B describes another alert for the same user, also with informational severity.
- FIG. 3C shows a critical severity alert for the user.
- FIG. 3D lists an informational severity alert.
- FIG. 3E shows a medium severity alert for the same user.
- FIG. 4 shows a snippet of the alert summary for a set of six users, including the time the alert occurred and the severity, for alert types of both sequence and batch.
- FIG. 5 shows confidence scores calculated for each of sixteen days for each of six users.
- FIG. 6 shows an example decay factor graph of decay factor as a function of the number of days from the current day.
- FIG. 7 shows a graph of the User Risk Score for a user over 200 days, where the
- User Risk Score is the sum of the alerts generated by the user, weighted by the severity and abnormality of the alerts, as well as the time decay factor.
- FIG. 8A shows an example plot that demonstrates user confidence scoring for a set of six users
- FIG. 8B shows an example plot that demonstrates user confidence scoring for a set of many users in an organization.
- FIG. 9 illustrates a representative user interface for user confidence scores for use by admins.
- FIG. 10 is a simplified block diagram of a computer system that can be used for evaluating user compliance with an organization’s security policies, calibrating a user confidence or risk score that expresses evaluation of user behavior that was not compliant with an organization’s security policies, and for reducing false detection of anomalous user behavior on a computer network, win accordance with an implementation of the disclosed technology.
- the disclosed technology utilizes behavior analytics to uncover anomalous user behavior and assess how risky or trustworthy a user is, for detecting and blocking malicious insiders, compromised accounts, data exfiltration and other threats.
- the disclosed technology also enables calibration of a user confidence or risk score that expresses evaluation of user behavior that was not compliant with an organization’s security policies.
- enterprise and organization are used interchangeably.
- UEBA User and Entity Behavior Analytics
- a security alert is generated if a user or an entity behaves differently.
- Such “different behavior” is detected by comparing the user/entity with its own history, and/or the history of its peers. Therefore, the determination of “peers” becomes an important step in UEBA.
- the disclosed technology uses grouping of peer users into groups based on apps used and based on location enables user and entity behavior analytics (UEBA) that are resilient and reduces the incidence of false positives, by comparing user behavior to both user and peer group profiles.
- UEBA user and entity behavior analytics
- the technology disclosed solves the technical problem of quantifying the incidence and severity of anomalous user behavior that indicates potential security threats, through machine learning and statistical analysis. User confidence scores are designed to fulfill this important need.
- FIG. 1 shows an architectural level schematic of a system 100 for evaluating user compliance with an organization’s security policies, and for calibrating a user confidence or risk score that expresses evaluation of user behavior that was not compliant with an organization’s security policies. These functionalities enable an administrator to review a user group and take appropriate actions for individual users, based on the security risks they pose.
- System 100 also includes functionality for reducing false detection of anomalous user behavior on a computer network. Because FIG. 1 is an architectural diagram, certain details are intentionally omitted to improve clarity of the description. The discussion of FIG. 1 will be organized as follows. First, the elements of the figure will be described, followed by their interconnections. Then, the use of the elements in the system will be described in greater detail.
- System 100 includes organization network 102, data center 152 with unified cloud- based security system 153, with security stack 15 and Netskope cloud access security broker (N- CASB) 155 and cloud-based services 108.
- System 100 includes multiple organization networks 104 for multiple subscribers, also referred to as multi-tenant networks, of a security services provider and multiple data centers 156.
- Organization network 102 includes computers 112a-n, tablets 122a-n and mobile devices 132a-n. In another organization network, organization users may utilize additional devices.
- Cloud services 108 includes cloud-based hosting services 118, web email services 128, video, messaging, and voice call services 138, streaming services 148, file transfer services 158, and cloud-based storage service 168.
- Data center 152 connects to organization network 102 and cloud-based services 108 via public network 145.
- Netskope cloud access security broker (N-CASB) 155 operating between cloud service consumers and cloud service providers, combines and interjects enterprise security policies as cloud-based resources are accessed.
- N-CASB Netskope cloud access security broker
- each security layer of security stack 154 can detect issues.
- Enhanced Netskope cloud access security broker (N-CASB) 155 securely processes P2P traffic over BT, FTP and UDP -based streaming protocols as well as Skype, voice, video and messaging multimedia communication sessions over SIP, and web traffic over other protocols, in addition to governing access and activities in sanctioned and unsanctioned cloud apps, securing sensitive data and preventing its loss, and protecting against internal and external threats.
- N-CASB Enhanced Netskope cloud access security broker
- N-CASB 155 includes active analyzer 165 and introspective analyzer 175 that identify the users of the system and set policies for apps.
- Introspective analyzer 175 interacts directly with cloud-based services 108 for inspecting data at rest.
- introspective analyzer 175 calls the cloud-based services using API connectors to crawl data resident in the cloud-based services and check for changes.
- BoxTM storage application provides an admin API called the Box Content APITM that provides visibility into an organization’s accounts for all users, including audit logs of Box folders, that can be inspected to determine whether any sensitive files were downloaded after a particular date, at which the credentials were compromised.
- Introspective analyzer 175 polls this API to discover any changes made to any of the accounts. If changes are discovered, the Box Events APITM is polled to discover the detailed data changes.
- introspective analyzer 175 registers with the cloud-based services via API connectors to be informed of any significant events.
- introspective analyzer 175 can use Microsoft Office365 Webhooks APITM to learn when a file has been shared externally.
- Introspective analyzer 175 also has deep API inspection (DAPII), deep packet inspection (DPI), and log inspection capabilities and includes a DLP engine that applies the different content inspection techniques on files at rest in the cloud-based services, to determine which documents and files are sensitive, based on policies and rules stored in storage 186.
- DPII deep API inspection
- DPI deep packet inspection
- log inspection capabilities includes a DLP engine that applies the different content inspection techniques on files at rest in the cloud-based services, to determine which documents and files are sensitive, based on policies and rules stored in storage 186.
- the result of the inspection by introspective analyzer 175 is generation of user-by-user data and file-by-file data.
- N-CASB 155 further includes monitor 184 that includes extraction engine 171, classification engine 172, security engine 173, management plane 174 and data plane 180. Also included in N-CASB 155, storage 186 includes content policies 187, content profiles 188, content inspection rules 189, enterprise data 197, information for clients 198 and user identities 199. Enterprise data 197 can include organizational data, including but not limited to, intellectual property, non-public financials, strategic plans, customer lists, personally identifiable information (PII) belonging to customers or employees, patient health data, source code, trade secrets, booking information, partner contracts, corporate plans, merger and acquisition documents and other confidential data.
- PII personally identifiable information
- the term “enterprise data” refers to a document, a file, a folder, a webpage, a collection of webpages, an image, or any other text-based document.
- User identity refers to an indicator that is provided by the network security system to the client device, in the form of a token, a unique identifier such as a UUID, a public-key certificate, or the like.
- the user identity can be linked to a specific user and a specific device; thus, the same individual can have a different user identity on their mobile phone vs. their computer.
- the user identity can be linked to an entry or corporate identity directory but is distinct from it.
- a cryptographic certificate signed by the network security is used as the user identity.
- the user identity can be solely unique to the user and be identical across devices.
- Embodiments can also interoperate with single sign-on (SSO) solutions and/or corporate identity directories, e.g., Microsoft’s Active Directory (AD). Such embodiments may allow policies to be defined in the directory, e.g., either at the group or user level, using custom attributes.
- Hosted services configured with the system are also configured to require traffic via the system. This can be done through setting IP range restrictions in the hosted service to the IP range of the system and/or integration between the system and SSO systems.
- integration with a SSO solution can enforce client presence requirements before authorizing the sign-on.
- Other embodiments may use “proxy accounts” with the SaaS vendor — e.g. a dedicated account held by the system that holds the only credentials to sign in to the service.
- the client may encrypt the sign on credentials before passing the login to the hosted service, meaning that the networking security system “owns” the password.
- Storage 186 can store information from one or more tenants into tables of a common database image to form an on-demand database service (ODDS), which can be implemented in many ways, such as a multi-tenant database system (MTDS).
- ODDS on-demand database service
- a database image can include one or more database objects.
- the databases can be relational database management systems (RDBMSs), object-oriented database management systems (OODBMSs), distributed file systems (DFS), no-schema database, or any other data storing systems or computing devices.
- the gathered metadata is processed and/or normalized.
- metadata includes structured data and functionality targets specific data constructs provided by cloud services 108.
- Non- structured data such as free text, can also be provided by, and targeted back to cloud services 108. Both structured and non- structured data are capable of being aggregated by introspective analyzer 175.
- the assembled metadata is stored in a semi-structured data format like a JSON (JavaScript Object Notation), BSON (Binary JSON), XML, Protobuf, Avro or Thrift object, which consists of string fields (or columns) and corresponding values of potentially different types like numbers, strings, arrays, objects, etc.
- JSON objects can be nested and the fields can be multi-valued, e.g., arrays, nested arrays, etc., in other implementations.
- These JSON objects are stored in a schema-less or NoSQL key-value metadata store 178 like Apache CassandraTM, Google’s BigtableTM, HBaseTM, VoldemorfTM, CouchDBTM, MongoDBTM,
- RedisTM, RiakTM, Neo4jTM, etc. which stores the parsed JSON objects using key spaces that are equivalent to a database in SQL.
- Each key space is divided into column families that are similar to tables and comprise of rows and sets of columns.
- introspective analyzer 175 includes a metadata parser (omitted to improve clarity) that analyzes incoming metadata and identifies keywords, events, user IDs, locations, demographics, file type, timestamps, and so forth within the data received. Parsing is the process of breaking up and analyzing a stream of text into keywords, or other meaningful elements called “targetable parameters”. [0070] In one implementation, a list of targeting parameters becomes input for further processing such as parsing or text mining, for instance, by a matching engine (not shown). Parsing extracts meaning from available metadata.
- tokenization operates as a first step of parsing to identify granular elements (e.g., tokens) within a stream of metadata, but parsing then goes on to use the context that the token is found in to determine the meaning and/or the kind of information being referenced.
- metadata analyzed by introspective analyzer 175 are not homogenous (e.g., there are many different sources in many different formats), certain implementations employ at least one metadata parser per cloud service, and in some cases more than one. In other implementations, introspective analyzer 175 uses monitor 184 to inspect the cloud services and assemble content metadata.
- system 100 can include any number of cloud-based services 108: point to point streaming services, hosted services, cloud applications, cloud stores, cloud collaboration and messaging platforms, and cloud customer relationship management (CRM) platforms.
- cloud-based services 108 point to point streaming services, hosted services, cloud applications, cloud stores, cloud collaboration and messaging platforms, and cloud customer relationship management (CRM) platforms.
- CRM cloud customer relationship management
- the services can include peer-to-peer file sharing (P2P) via protocols for portal traffic such as BitTorrent (BT), user data protocol (UDP) streaming and file transfer protocol (FTP); voice, video and messaging multimedia communication sessions such as instant message over Internet Protocol (IP) and mobile phone calling over LTE (VoLTE) via the Session Initiation Protocol (SIP) and Skype.
- P2P peer-to-peer file sharing
- BT BitTorrent
- UDP user data protocol
- FTP file transfer protocol
- IP instant message over Internet Protocol
- VoIP mobile phone calling over LTE
- VoIP Session Initiation Protocol
- the services can handle Internet traffic, cloud application data, and generic routing encapsulation (GRE) data.
- a network service or application or can be web-based (e.g., accessed via a uniform resource locator (URL)) or native, such as sync clients.
- URL uniform resource locator
- Examples include software-as-a-service (SaaS) offerings, platform-as-a-service (PaaS) offerings, and infrastructure-as-a-service (IaaS) offerings, as well as internal enterprise applications that are exposed via URLs.
- SaaS software-as-a-service
- PaaS platform-as-a-service
- IaaS infrastructure-as-a-service
- Examples of common cloud-based services today include Salesforce.comTM, BoxTM, DropboxTM, Google AppsTM, Amazon AWSTM, Microsoft Office 365TM, WorkdayTM, Oracle on DemandTM, TaleoTM, YammerTM, JiveTM, and ConcurTM.
- network 145 couples computers 112a-n, tablets 122a-n and mobile devices 132a-n, cloud-based hosting service 118, web email services 128, video, messaging and voice call services 138, streaming services 148, file transfer services 158, cloud-based storage service 168 and N-CASB 155 in communication.
- the communication path can be point-to-point over public and/or private networks.
- Communication can occur over a variety of networks, e.g. private networks, VPN, MPLS circuit, or Internet, and can use appropriate application program interfaces (APIs) and data interchange formats, e.g. REST, JSON, XML, SOAP and/or JMS. All of the communications can be encrypted.
- APIs application program interfaces
- data interchange formats e.g. REST, JSON, XML, SOAP and/or JMS. All of the communications can be encrypted.
- This communication is generally over a network such as the LAN (local area network), WAN (wide area network), telephone network (Public Switched Telephone Network (PSTN), Session Initiation Protocol (SIP), wireless network, point-to-point network, star network, token ring network, hub network, Internet, inclusive of the mobile Internet, via protocols such as EDGE, 3G, 4G LTE, Wi-Fi, and WiMAX. Additionally, a variety of authorization and authentication techniques, such as usemame/password, OAuth, Kerberos, SecurelD, digital certificates, and more, can be used to secure the communications.
- a variety of authorization and authentication techniques such as usemame/password, OAuth, Kerberos, SecurelD, digital certificates, and more, can be used to secure the communications.
- N-CASB 155 includes monitor 184 and storage 186 which can include one or more computers and computer systems coupled in communication with one another. They can also be one or more virtual computing and/or storage resources.
- monitor 184 can be one or more Amazon EC2 instances and storage 186 can be Amazon S3TM storage.
- Other computing-as- service platforms such as Rackspace, Heroku or Force.com from Salesforce could be used rather than implementing N-CASB 155 on direct physical computers or traditional virtual machines.
- one or more engines can be used and one or more points of presence (POPs) can be established to implement the security functions.
- the engines or system components of FIG. 1 are implemented by software running on varying types of computing devices. Example devices are a workstation, a server, a computing cluster, a blade server, and a server farm, or any other data processing system or computing device.
- the engine can be communicably coupled to the databases via a different network connection.
- extraction engine 171 can be coupled via network(s) 145 (e.g., the Internet), classification engine 172 can be coupled via a direct network link and security engine 173 can be coupled by yet a different network connection.
- network(s) 145 e.g., the Internet
- classification engine 172 can be coupled via a direct network link
- security engine 173 can be coupled by yet a different network connection.
- the data plane 180 POPs are hosted on the client’s premises or located in a virtual private network controlled by the client.
- N-CASB 155 provides a variety of functions via a management plane 174 and a data plane 180.
- Data plane 180 includes an extraction engine 171, a classification engine 172, and a security engine 173, according to one implementation.
- Other functionalities, such as a control plane, can also be provided. These functions collectively provide a secure interface between cloud services 108 and organization network 102.
- network security system we use the term “network security system” to describe N-CASB 155, more generally the system provides application visibility and control functions as well as security. In one example, thirty-five thousand cloud applications are resident in libraries that intersect with servers in use by computers 112a-n, tablets 122a-n and mobile devices 132a-n in organization network 102.
- Computers 112a-n, tablets 122a-n and mobile devices 132a-n in organization network 102 include management clients with a web browser with a secure web-delivered interface provided by N-CASB 155 to define and administer content policies 187, according to one implementation.
- N-CASB 155 is a multi-tenant system, so a user of a management client can only change content policies 187 associated with their organization, according to some implementations.
- APIs can be provided for programmatically defining and or updating policies.
- management clients can include one or more servers, e.g. a corporate identities directory such as a Microsoft Active Directory (AD) or an implementation of the open Lightweight Directory Access Protocol (LDAP) pushing updates, and/or responding to pull requests for updates to the content policies 187. Both systems can coexist; for example, some companies may use a corporate identities directory to automate identification of users within the organization while using a web interface for tailoring policies to their needs.
- Management clients are assigned roles and access to the N-CASB 155 data is controlled based on roles, e.g. read-only vs. read-write.
- an active analyzer and introspective analyzer (not shown) also enforce security policies on the cloud traffic.
- active analyzer and introspective analyzer For further information regarding the functionality of active analyzer and introspective analyzer, reference can be made to, for example, commonly owned U.S. Patent Nos. 9,398,102 (NSKO 1000-2); 9,270,765 (NSKO 1000-3); 9,928,377 (NSKO 1001-2); and U.S. Patent Application No. 15/368,246 (NSKO 1003- 3); Cheng, Ithal, Narayanaswamy and Malmskog Cloud Security For Dummies, Netskope Special Edition , John Wiley & Sons, Inc.
- a control plane may be used along with or instead of management plane 174 and data plane 180.
- the specific division of functionality between these groups is an implementation choice.
- the functionality can be highly distributed across a number of points of presence (POPs) to improve locality, performance and/or security.
- the data plane is on premises or on a virtual private network and the management plane of the network security system is located in cloud services or with corporate networks, as described herein.
- the POPs can be distributed differently.
- system 100 is described herein with reference to particular blocks, it is to be understood that the blocks are defined for convenience of description and are not intended to require a particular physical arrangement of component parts. Further, the blocks need not correspond to physically distinct components. To the extent that physically distinct components are used, connections between components can be wired and/or wireless as desired. The different elements or components can be combined into single software modules and multiple software modules can run on the same one or more processors.
- system components can be implemented in a variety of ways to achieve a same or similar result as described herein.
- system components can each be implemented as a combination of computer software and/or computer hardware, which is also referred to herein as a software/hardware component.
- Performance of system functionality can be apportioned in accordance with a variety of schemes, and implemented within a variety of separate software/hardware components to achieve a same or similar result as described herein.
- Each portion of functionality can be assigned to and performed by a separate software/hardware component, or instead combined (consolidated) into one or more hardware/software components.
- this technology can be implemented using two or more separate and distinct computer-implemented systems that cooperate and communicate with one another.
- This technology can be implemented in numerous ways, including as a process, a method, an apparatus, a system, a device, a computer readable medium such as a computer readable storage medium that stores computer readable instructions or computer program code, or as a computer program product comprising a computer usable medium having a computer readable program code embodied therein.
- the technology disclosed can be implemented in the context of any computer- implemented system including a database system or a relational database implementation like an OracleTM compatible database implementation, an IBM DB2 Enterprise ServerTM compatible relational database implementation, a MySQLTM or PostgreSQLTM compatible relational database implementation or a Microsoft SQL ServerTM compatible relational database implementation or aNoSQL non-relational database implementation such as a VampireTM compatible non-relational database implementation, an Apache CassandraTM compatible non relational database implementation, a BigTableTM compatible non-relational database implementation or an HBaseTM or DynamoDBTM compatible non-relational database implementation.
- a database system or a relational database implementation like an OracleTM compatible database implementation, an IBM DB2 Enterprise ServerTM compatible relational database implementation, a MySQLTM or PostgreSQLTM compatible relational database implementation or a Microsoft SQL ServerTM compatible relational database implementation or aNoSQL non-relational database implementation such as a VampireTM compatible non-relational database implementation, an Apache Ca
- the technology disclosed can be implemented using different programming models like MapReduceTM, bulk synchronous programming, MPI primitives, etc. or different scalable batch and stream management systems like Amazon Web Services (AWS)TM, including Amazon Elasticsearch ServiceTM and Amazon KinesisTM, Apache StormTM, Apache SparkTM, Apache KafkaTM, Apache FlinkTM, TruvisoTM, IBM Info- SphereTM, BorealisTM and Yahoo! S4TM.
- AWS Amazon Web Services
- Apache StormTM Apache SparkTM
- Apache KafkaTM Apache FlinkTM
- TruvisoTM IBM Info- SphereTM
- BorealisTM Yahoo! S4TM.
- FIG. 2A illustrates a high level block diagram 200 of Netskope cloud access security broker (N-CASB) 155 with user 202 utilizing cloud based services 108 via network 145.
- User 202 can operate any of a variety of devices in organization network 102, such as computers 112a-n, tablets 122a-n and mobile devices 132a-n.
- N-CASB 155 can control web applications and operations like login, file transfer and sharing, and detect anomalies in the data and accesses.
- Security functions include access control, risk assessment, malware detection and user and entity behavior analytics (UEB A) for identifying anomalous behavior.
- UEB A entity behavior analytics
- N-CASB 155 includes alert scoring engine 235 and score mapping engine 255.
- Alert scoring engine 235 formulates a user confidence or risk score, scoring for each user a sum of alert weights, categorized by severity, and generated over time. Each contribution to an alert weight is generated due to an activity by the user that the organization’s security policies treat as risky.
- the alert weights over time are subject to a decay factor that attenuates the alert weights as time passes.
- Score mapping engine 255 associates scores with users and enterprise entities.
- User risk score is used to reflect the “risk level” of each user, and therefore the alerts which are not associated with the user are not considered in the risk score calculation.
- User confidence index (UCI) is 1000 minus the risk score, in one implementation.
- Risk Score is calculated based on alerts associated with users. It reflects the severity of alerts, and decays over a period of time. The higher the risk score, the more suspicious the user is. Risk score is calculated as shown below. c ⁇ f
- Time decay factor J > is used to linearly decay the risk score in one example implementation, in the window of 7 days.
- * can be 1/7, 2/7, 3/7, 4/7, 5/7, 6/7, and 1 depends on the time of the alerts.
- Final Risk Score is capped at 1000, in one implementation described herein. The final risk score could be capped differently in another implementation.
- alert severity weight is assigned to each alert based on its severity level.
- Category caps for alert severity categories are listed in the table below. An example of the use of the severity categories is shown in the UI of s below.
- block diagram 200 also includes reporting UI 275 for displaying reporting of user confidence scores.
- Reporting includes a time series of the user confidence or risk scores over a predetermined time, and/or a current user confidence or risk score, and/or at least some details of the activity by the user that contributed to the alert weights over time.
- An example user confidence index report is described and shown relative to FIG. 9 below.
- Block diagram 200 also has different Netskope detectors for different kinds of user and entity behavior alerts, including human crafted and machine learning generated alerts.
- human crafted alerts we refer to the human crafted alerts as sequence alerts and to the ML-based alerts as batch alerts.
- Sequence alert detectors 234 generate sequence alerts upon detection of known behavior patterns for incoming events. Rules are used to describe these patterns as a sequence of events predefined by Netskope or configured by Netskope's customers via the product UI.
- One example predefined pattern is attempted corporate cloud storage access by users, from known malicious IPs.
- a user downloads a file from a particular app Box, and deletes the same file immediately, then repeats this sequence 10 times within 10 minutes.
- This example sequence of events can be configured to trigger a “Critical” alert.
- Groups are used to cluster users/entities to their similar peers.
- the smallest groups can be the user himself or the entity itself, in which a single peer is shown in the group.
- the largest group can be the whole tenant, in which every user and every entity is in the same group.
- IAM identity and access management
- AD Active Director
- these pre-defmed and statically determined groups have their limitations: A user can belong to multiple groups and there is no definition to correlate groups.
- the AD information, and/or the customer pre-defmed groups can be incorrect, outdated, or simply not aligned with the user behavior. Such groups can be statistically too large or too small in some applications.
- Dynamic grouping can assign user/entity to a group that can best model its behavior based on pre-defmed groups. Dynamic grouping can also assign user/entity to a group that can best model its behavior only based on its behaviors (without considering AD, location, and other information). Therefore, dynamic grouping can allow multiple peer groups, which can change over time, based on distance metrics and clustering algorithms.
- Batch alert detectors 254 collect user data and use clustering to determine the likelihood that a user belongs to a specific group. Peer groups are generated dynamically based on their behavior patterns, using a machine learning algorithm. Values of user behavior are compared to the behavior values of the per group. Batch alert detectors 254 utilize statistical- based algorithms based on heuristic performance to detect outliers in user behavior, such as a large number of file downloads or uploads that deviate from a user's normal usage behavior, including brute force and malicious insider actions.
- the disclosed batch alert detectors 254 utilize non-parametric modeling, with kernel density estimation (KDE) applied as a smoothing technique for the finite data samples. For the non-parametric modeling, the hyper parameters for the model are determined, as described in “KDE Hyper Parameter Determination,” Yi Zhang et al., Netskope, Inc.” which is incorporated in full herein.
- PII personally identifiable information
- Alert examples include the following fields, among others: (1) “sv” severity of the alert, this string is used to map the alert with severity categories; (2) “ts” timestamp when the event/alert happened, with event timestamp in Unix epoch format, usable in decay factor calculation; (3) “ur”: user email string usable to map alerts to a user; (4); “sic”: source location; and (5) “p value”: an indicator of how abnormal this alert is.
- KDE hyper parameter p value is calculated to obtain a value between three to five times the maximum value in the training data. Values that are less than 3 times the maximum training data value are treated as normal directly (without p value calculation). Values that are larger than five times the maximum training data are treated as abnormal directly (without p value calculation) p value suggested threshold: e-5. Set the bandwidth for file size as 0.05, and for count as 1.5. Bandwidth can be dynamic adjusted with the number of training samples. A smaller number of training samples requires larger bandwidth. Set leaf size to 40.
- Batch alert detectors 254 utilize peer grouping to make UEBA more resilient and reduce false positives.
- Batch alert detectors 254 form groups of users, based on identity and access management (IAM) properties, assigning the users into initially assigned groups based on their respective IAM properties and recording individual user behavior, including application usage frequency.
- IAM identity and access management
- Another example property for assigning groups is affiliation with a common customer.
- Batch alert detectors 254 dynamically assign an individual user with a realigned group, different from the initial assigned group, based on comparing the recorded individual user behavior, with user behavior in statistical profiles of the users in the groups. Evaluation and reporting of anomalous events among ongoing behavior of the individual user is based on deviations from a statistical profile of the realigned group, and optionally based on deviations from the individual’s statistical profile. Users from the same location tend to use similar apps.
- an engineering group will likely use the same integrated development environment (IDE) tools, and administrative staff members often utilize the same office management tools.
- Batch alert detectors 254 group users based on app usage, in one implementation with apps determined via the IAM properties. Apps being utilized by a user are gleaned from the data provided by active directory (AD) in one scenario, and the IAM can be the open lightweight directory access protocol (LDAP) in a different implementation.
- AD active directory
- LDAP open lightweight directory access protocol
- FIG. 2B shows an example list of app events for a group of users, for use by batch alert detectors 254, with the count of events by each user 282 for each of a list of apps 204.
- the batch alert detector calculates the size of each app group.
- original assigned groups are utilized for each user. For the example listed above, user_166149 is counted in the group bcf.pvt/GESTION/GRUPOS/Intemet/PX Ag Medio and in the group bcf.pvt/GESTION/GRUPOS/APPs/CASB, while user_166148 is only included in group bcf. pvt/ GE S TION/ GRUPO S/Intemet/PX_Staff_Rib .
- the groups are filtered based on their size, to filter out invalid groups that are either too small or too large.
- a group which is too small (usually less than 100 people or 10% of the organization population), or too large (usually more than 500 people or 80% of the whole organization population) will not be considered.
- the groups under consideration are called valid groups.
- the next step includes training a one-vs-the-rest classifier for each valid app group, based on the previous week’s app usage data.
- Light Gradient Boosting Machine (LightGBM) is used to train the one-vs-the-rest classifiers for each group.
- a different one-versus-rest clustering machine can be used in a different implementation.
- each group the users that are counted to the app group are considered as positive instances, while the other users are negative instances.
- the next step is to filter location groups based on their sizes.
- a location group which is too small (typically less than 100 people or 10% of the organization population), or too large (typically more than 500 people or 80% of the organization population) will not be considered.
- the location groups under consideration are called valid location groups.
- the next step includes training a one-vs-the-rest classifier for each valid location group.
- a different one-versus-rest clustering machine can be used in a different implementation.
- each location group the users that are counted to the group are considered as positive instances, while the other users are negative instances. Then we apply all the classifiers to each user, assign the tag to a user if a user is classified as positive in a location group with >90% confidence, and sort the location tags for each user based on confidence level and other metrics such as group size, group pureness, etc.
- Group pureness refers to how reliably the trained model can describe or represent the group, and in this case is measured by the accuracy of the trained LightGBM model on the training data.
- Example location group tags are listed below. Two outputs are a one-vs-the-rest classifier for each group, and each user is assigned to groups to which they are similar, as a result of the process described above. Example grouping output is listed below, for two users, userl and user2.
- switchnet . nv/S witch/_Gl ob al/ Appli cati ons/C oncur/Group s/C oncur-Elsers " , "switchnet.nv/Switch/_Global/Applications/RSA/Groups/RSA-VPN-LAS”, "switchnet.nv/Email Distribution Groups/(DL) Staff]
- switchnet switchnet . nv/ S witch/_Gl ob al/S ecurity Group s/ S oftware Deployments/U ser/ SD AutoHotKey " ,
- switchnet . nv/S witch/_Gl ob al/ Appli cati ons/C oncur/Group s/C oncur-Elsers " , "switchnet.nv/Switch/_Global/Applications/RSA/Groups/RSA-VPN-LAS", "switchnet.nv/Email Distribution Groups/(DL) Staff,
- switchnet nv/Email Di stribution Groups/ CIOP S -Di stros/ CiopsTeam " , "switchnet.nv/Switch/_Global/W eb Filters/Reporting Group s/WF -Thom as_Morton”]
- Batch alert detectors 254 utilize the disclosed dynamic grouping when analyzing a user’s current behavior, to determine when an alert needs to be generated, comparing user behavior to both user and group statistical profiles.
- FIG. 2C illustrates an example UI for reporting results for user behavior analytics (UBA) machine learning batch detector 254.
- the report shows a user’s latest behavior compared with the baseline statistical models of the same user and their peer group in order to identify anomalies, based on the P values.
- an anomalous large size of uploaded data is reported.
- the chances of the particular user 245 performing an hourly upload of 3 Gb of files has likelihood of 1/5000 based on group activity baseline 246 and 1/10000 based on individual activity baseline 245.
- the user's hourly upload data size was 3GB, which was highly unlikely compared to the group and user baselines.
- Batch alert detectors 254 review an anomalous large size of updated data by the user and report that the chances of the user performing an hourly upload of a 3 GB file is 1/5000 based on the individual activity baseline 245, and 1/10000 based on group activity baseline 246. This results in a higher risk score for the user, also referred to as a lower confidence score.
- FIG. 3A through FIG. 3E list the set of alerts for a single user, userl@test (pseudonym).
- FIG. 3A shows user data for an alert with informational 376 severity, and
- FIG. 3B describes another alert for the same user, also with informational 386 severity.
- FIG. 3C shows a critical severity alert 366 for the user.
- FIG. 3D lists an informational 365 severity alert and
- FIG. 3E shows a medium severity alert 355 for the same user.
- FIG. 4 shows a snippet of the alert summary for a set of six users, including the time the alert occurred and the severity, for alert types of both sequence and batch.
- FIG. 5 shows confidence scores calculated for each of sixteen days for each of six users.
- the “risky” user has a lower confidence index.
- 280 users have scores less than perfect, which is a value of just over one in a thousand. That illustrates that the actions of great majority of users do not take action that are behavior anomalies, so they do not cause the generation of alerts.
- Admins do need to be able to perform risk mitigation actions for the users who are threats to the enterprise.
- risk score is calculated as described below.
- the score is between 0 and a predefined cap. 1000 is used as cap in one implementation.
- Machine learning (ML) based batch detectors generate the p value in one implementation described above, and the alert abnormality weights are applied to the alerts generated by such detectors.
- the exponential function can be used to calculate the abnormality weight. Such a weight increases slowly with the increase of p value at the beginning and has a sharp lift on the tail.
- FIG. 6 shows an example decay factor graph of decay factor as a function of the number of days from the current day.
- a customized sigmoid function is used to generate the decay factor based on the decay window, in one implementation.
- a logistic function could be used in another implementation.
- the decay curve is based on a decay window of 90 days and utilizes the scale listed below.
- the tenant admin can reset the Risk Score for a particular user in the UI. After reset, the score is set to zero for a configurable time period, such as 7 or 30 days.
- FIG. 7 shows a graph of the User Risk Score for a user over 200 days, where the User Risk Score is the sum of the alerts generated by the user, weighted by the severity and abnormality of the alerts, as well as the time decay factor. Risk score is used for sorting users and assets based on their behavior abnormalities.
- FIG. 8A shows an example plot that demonstrates user confidence scoring for a set of six users. Each line is an individual user’s user confidence score graphed as a function of time in days. Dots on the graph are triggered by alerts and the score climbs as days pass without alerts for the user, due to the decay weighting over time described above. User confidence scores drop when alerts occur
- FIG. 8B shows an example plot that demonstrates user confidence scoring for a set of many users in an enterprise.
- Each line is an individual user’s user confidence score graphed as a function of time in days. Dots on the graph are triggered by alerts and the score climbs as days pass, due to the decay weighting over time described above. User confidence scores drop when alerts occur.
- the scores in the plot include a time when a customer was the victim of an intrusion attack. During several days, many accounts in the company had massive login failures because the attacker was trying random accounts. Therefore, the graph shows a drop for many users during those days.
- FIG. 9 illustrates a representative user interface for displaying user confidence scores to admins.
- the UI for admins shows the user confidence scores of users, with the order ranked by the users’ confidence scores, such as those shown in FIG. 5. Details of the activity by the user that contributed to the alert weights over time are listed.
- the circled C 968 signals Critical
- a circled H (not shown in this example) signals High alert severity
- the circled M 966 signals Medium severity.
- the number eleven 944 is a count of the number of incidents/alerts for this user.
- the UI lists four of the 11 incidents.
- Customer admins viewing the disclosed user confidence score UI can readily notice the users who have exhibited more risky behaviors. In a different UI display using risk scores, the users with lower scores can be listed on the top.
- Security admin utilize the UI to log in and can view rank order of users within a tenant (enterprise). Low user confidence scores are highlighted, and the administrator can focus on those users.
- the UI also provides additional evidence and reasons when flagging such behavior, as the admin needs to understand the basis for a decision in order to communicate effectively to the end user or security analysts. For example, a manager may ask why a certain user’s behavior has been deemed anomalous.
- Adaptive access control with the disclosed user confidence scoring allows security admins to sort users in a company to identify which users are riskier, based on the analysis of their risk scores. For a specific score, actions can be configured by the admin, or actions can be set to automatically occur based on scoring thresholds, such as requiring a user to reset their password, removing access to sensitive files, and blocking access by a user to specific apps, including but not limited to Google drive and Box.
- FIG. 10 is a simplified block diagram of a computer system 1000 that can be used for evaluating user compliance with an organization’s security policies, calibrating a user confidence or risk score that expresses evaluation of user behavior that was not compliant with an organization’s security policies, and for reducing false detection of anomalous user behavior on a computer network.
- Computer system 1000 includes at least one central processing unit (CPU) 1072, also referred to herein as at least one processor and/or as one or more processors, that communicates with a number of peripheral devices via bus subsystem 1055, and cloud-based security system 153 for providing network security services described herein.
- CPU central processing unit
- peripheral devices can include a storage subsystem 1010 including, for example, memory devices and a file storage subsystem 1036, user interface input devices 1038, user interface output devices 1076, and a network interface subsystem 1074.
- the input and output devices allow user interaction with computer system 1000.
- Network interface subsystem 1074 provides an interface to outside networks, including an interface to corresponding interface devices in other computer systems.
- cloud-based security system 153 of FIG. 1 is communicably linked to the storage subsystem 1010 and the user interface input devices 1038.
- User interface input devices 1038 can include a keyboard; pointing devices such as a mouse, trackball, touchpad, or graphics tablet; a scanner; a touch screen incorporated into the display; audio input devices such as voice recognition systems and microphones; and other types of input devices.
- pointing devices such as a mouse, trackball, touchpad, or graphics tablet
- audio input devices such as voice recognition systems and microphones
- use of the term “input device” is intended to include all possible types of devices and ways to input information into computer system 1000.
- User interface output devices 1076 can include a display subsystem, a printer, a fax machine, or non-visual displays such as audio output devices.
- the display subsystem can include an LED display, a cathode ray tube (CRT), a flat-panel device such as a liquid crystal display (LCD), a projection device, or some other mechanism for creating a visible image.
- the display subsystem can also provide a non-visual display such as audio output devices.
- output device is intended to include all possible types of devices and ways to output information from computer system 1000 to the user or to another machine or computer system.
- Storage subsystem 1010 stores programming and data constructs that provide the functionality of some or all of the modules and methods described herein.
- Subsystem 1078 can be graphics processing units (GPUs) or field-programmable gate arrays (FPGAs).
- Memory subsystem 1022 used in the storage subsystem 1010 can include a number of memories including a main random access memory (RAM) 1032 for storage of instructions and data during program execution and a read only memory (ROM) 1034 in which fixed instructions are stored.
- a file storage subsystem 1036 can provide persistent storage for program and data files, and can include a hard disk drive, a floppy disk drive along with associated removable media, a CD-ROM drive, an optical drive, or removable media cartridges.
- the modules implementing the functionality of certain implementations can be stored by file storage subsystem 1036 in the storage subsystem 1010, or in other machines accessible by the processor.
- Bus subsystem 1055 provides a mechanism for letting the various components and subsystems of computer system 1000 communicate with each other as intended. Although bus subsystem 1055 is shown schematically as a single bus, alternative implementations of the bus subsystem can use multiple busses.
- Computer system 1000 itself can be of varying types including a personal computer, a portable computer, a workstation, a computer terminal, a network computer, a television, a mainframe, a server farm, a widely -distributed set of loosely networked computers, or any other data processing system or user device. Due to the ever-changing nature of computers and networks, the description of computer system 1000 depicted in FIG. 10 is intended only as a specific example for purposes of illustrating the preferred embodiments of the present invention. Many other configurations of computer system 1000 are possible having more or less components than the computer system depicted in FIG. 10.
- a method of evaluating user compliance with an organization’s security policies includes formulating a user confidence or risk score, comprising scoring for each user a sum of alert weights, categorized by severity, and generated over time. Each contribution to an alert weight is generated due to an activity by the user that the organization’s security policies treat as risky, and the alert weights over time are subject to a decay factor that attenuates the alert weights as time passes.
- the disclosed method also includes reporting the user confidence score, comprising causing display of a time series of the user confidence or risk scores over a predetermined time and/or a current user confidence or risk score and/or at least some details of the activity by the user that contributed to the alert weights over time.
- the disclosed method of evaluating user compliance with an organization’s security policies includes applying the formulating and reporting to at least 10 users and reporting an ordered list of the current user confidence score for each user, from low to high, or risk score from high to low risk.
- Some implementations of the disclosed method further include applying the formulating and reporting to at least 10 users and reporting a graph of the time series for the at least 10 users. In some cases, the disclosed method also includes applying the formulating and reporting to at least 10 users, and selecting the user confidence scores of users whose activity the organization’s security policies treat as risky based on one of a predetermined threshold or a configurable percentage of a total possible user confidence score for the user.
- an alert weight is applied to one of a sequence alert and a batch alert wherein a sequence alert is generated for a user upon observation of an activity, by a user, in a set of preconfigured behavior patterns, and a batch alert is generated when an unexpected behavior is detected, compared to historical user behavior patterns of a peer group of users.
- the decay factor that attenuates the alert weights is a function of a number of days since the alert occurred.
- Some implementations of the disclosed method further include reporting recommended actions based on scoring thresholds, with the actions including requiring a user to reset their password, removing user access to sensitive files, and/or blocking access by a user to specific apps, including but not limited to Google drive and Box.
- a method of calibrating a user confidence or risk score that expresses evaluation of user behavior that was not compliant with an organization’s security policies includes configuring components of the user confidence or risk score, comprising configuring categorical alert weights, categorized by severity, responsive to administrator controls, for alerts to be generated due to an activity by the user that the organization’s security policies treat as risky.
- the method also includes configuring a decay factor that attenuates the alert weights as time passes, responsive to an administrator sensitivity control, and causing display of resulting user behavior evaluation examples, based on activity examples for user examples, comprising causing display of a time series of the user confidence or risk scores for the activity examples for the user examples and a resulting user confidence or risk score for the user examples.
- Some disclosed implementations further include causing display of controls for drill down into one or more activities of an individual example user in the time series, receiving a request to drill down, and causing display of details of activities requested by the drill down, including the example activities requested that appear in the time series.
- the categorical alert weights include informational, low, medium, high and critical.
- the activity examples include failed login attempt, deleting a configurable number files in a predetermined time period, and uploading a configurable number of files in a predetermined time period.
- One implementation of the disclosed method also includes displaying the user confidence or risk score as a graph of activity example counts weighted by the categorical alert weights.
- the request to drill down is activated by selecting one of a drop down selector and a name field for the individual example user.
- a method of reducing false detection of anomalous user behavior on a computer network includes forming groups from identity and access management (IAM) properties and assigning the users into initially assigned groups based on respective IAM properties and recording individual user behavior in a statistical profile, including application usage frequency.
- the method also includes dynamically assigning an individual user with a realigned group, different from the initial assigned group, based on comparing the recorded individual user behavior, with user behavior in statistical profiles of the users in the groups.
- the disclosed method further includes evaluating and reporting anomalous events among ongoing behavior of the individual user based on deviations from a statistical profile of the realigned group.
- properties from the IAM used for forming the groups include common app usage, common location and common organization.
- the statistical profiles of groups are not used when fewer than 100 users or ten percent of organization population are included in the group, or more than 500 users or eighty percent of the organization population are included in the group.
- three-quarters of the groups formed have 30 to 500 users per group.
- evaluating anomalous events further includes evaluating deviations of the events among ongoing behavior of the individual user based from their statistical profile.
- the IAM is active directory (AD). In other implementations, the IAM is the open lightweight directory access protocol (LDAP).
- implementations of the methods described in this section can include a tangible non-transitory computer readable storage medium storing program instructions loaded into memory that, when executed on processors cause the processors to perform any of the methods described above.
- implementations of the methods described in this section can include a device including memory and one or more processors operable to execute computer instructions, stored in the memory, to perform any of the methods described above.
- a computer readable storage medium which may be any device or medium that can store code and/or data for use by a computer system.
- ASICs application-specific integrated circuits
- FPGAs field-programmable gate arrays
- magnetic and optical storage devices such as disk drives, magnetic tape, CDs (compact discs), DVDs (digital versatile discs or digital video discs), or other media capable of storing computer-readable media now known or later developed.
- a method of evaluating user compliance with an organization's security policies including actions of: generating sequence alerts using a proxy to detect activity by users that the organization's security policies deem risky, the sequence alerts categorized by severity; generating batch alerts when anomalous user behaviors are detected based on deviations from historical user behavior patterns of a peer group of users, the batch alerts categorized by severity; scoring user confidence or user risk scores, collectively referred to as the user confidence score, by repeatedly summing alert weights, applied by category of severity, and generated over time from the sequence alerts and the batch alerts, wherein the alert weights over time are subject to a decay factor that attenuates the alert weights as time passes; and reporting the user confidence score, comprising causing display of a time series of the user confidence scores over a predetermined time and/or a current user confidence score and/or at least some details of the activity by the user that contributed to the alert weights over time.
- a tangible non-transitory computer readable storage medium including program instructions loaded into memory that, when executed on one or more processors, cause the processors to carry out actions directed to evaluating user compliance with an organization's security policies, the action including: generating sequence alerts using a proxy to detect activity by users that the organization's security policies deem risky, the sequence alerts categorized by severity; generating batch alerts when anomalous user behaviors are detected based on deviations from historical user behavior patterns of a peer group of users, the batch alerts categorized by severity; scoring user confidence or user risk scores, collectively referred to as the user confidence score, by repeatedly summing alert weights, applied by category of severity, and generated over time from the sequence alerts and the batch alerts, wherein the alert weights over time are subject to a decay factor that attenuates the alert weights as time passes; and reporting the user confidence score, comprising causing display of a time series of the user confidence scores over a predetermined time and/or a current user confidence score and/or at least some details of the activity
- tangible non-transitory computer readable storage medium of clause 7 further including: applying the scoring and reporting to at least 10 users, and reporting an ordered list of the current user confidence score for each user, from low to high, or risk score from high to low risk.
- a device for evaluating user compliance with an organization's security policies including at least one processor, memory coupled to the processor, and computer instructions loaded into the memory that, when executed, cause the processor to carry out actions directed to evaluating user compliance with an organization's security policies, the action including: generating sequence alerts using a proxy to detect activity by users that the organization's security policies deem risky, the sequence alerts categorized by severity; generating batch alerts when anomalous user behaviors are detected based on deviations from historical user behavior patterns of a peer group of users, the batch alerts categorized by severity; scoring user confidence or user risk scores, collectively referred to as the user confidence score, by repeatedly summing alert weights, applied by category of severity, and generated over time from the sequence alerts and the batch alerts, wherein the alert weights over time are subject to a decay factor that attenuates the alert weights as time passes; and reporting the user confidence score, comprising causing display of a time series of the user confidence scores over a predetermined time and/or a current user confidence score
- a method of calibrating an evaluation of user behavior not compliant with an organization’s security policies including the actions of: configuring components for determination of a user confidence or a risk score of a user, said user being assigned to a group within an organization, said configuring components being enabled via a cloud-based security system, said cloud-based security system being configured to assess a threat of anomalous computer network related behavior of said user towards said organization, said cloud-based security system being implemented as computer readable instructions being stored within a non-transitory computer readable storage medium, said computer readable instructions being executed via at least one central processing unit (CPU), said threat being detected via occurrences of one or more alerts, said alert being defined as a sequence of events, said sequence of events including at least one of an occurrence of a deletion of a file, an occurrence of an uploading of a file and an occurrence of a downloading of a file; said action of configuring components further comprising actions of: configuring categorical alert weights, categorized by severity, responsive to administrator controls, for alerts to be
- a tangible non-transitory computer readable storage medium including program instructions loaded into memory that, when executed on one or more processors, cause the processors to implement a method of calibrating an evaluation of user behavior not compliant with an organization’s security policies, said method of calibrating including actions of: configuring components of a user confidence or a risk score of a user, said user being assigned to a group within an organization, said configuring components being enabled via a cloud-based security system, said cloud-based security system being configured to assess a threat of anomalous computer network related behavior of said user towards said organization, said cloud-based security system being implemented as computer readable instructions being stored within a non-transitory computer readable storage medium, said computer readable instructions being executed via at least one central processing unit (CPU), said threat being detected via occurrences of one or more alerts, each of said alerts being sequences of events including at least one of an occurrence of a deletion of a file, an occurrence of an uploading of a file and an occurrence of a downloading of a file; said con
- a device for calibrating an evaluation of user behavior not compliant with an organization’s security policies including at least one processor, memory coupled to the processor, and computer instructions loaded into the memory that, when executed, cause the processor to implement a process that includes the actions of: configuring components of a user confidence or a risk score of a user, said user being assigned to a group within an organization, said configuring components being enabled via a cloud-based security system, said cloud-based security system being configured to assess a threat of anomalous computer network related behavior of said user towards said organization, said cloud-based security system being implemented as computer readable instructions being stored within a non-transitory computer readable storage medium, said computer readable instructions being executed via at least one central processing unit (CPU), said threat being detected via occurrences of one or more alerts, said alerts being activity examples, said alerts including at least one of an occurrence of a deletion of a file, an occurrence of an uploading of a file and an occurrence of a downloading of a file; said configuring components further comprising actions
- the device of clause 13 further including: causing display of controls for drill down into one or more activities of an individual example user in the time series; receiving a request to drill down; and causing display of details of activities requested by the drill down, including the example activities requested that appear in the time series.
- the device of clause 13 further including displaying the user confidence or risk score as a graph of activity example counts weighted by the categorical alert weights.
- an alert is defined as a sequence of events including at least two of an occurrence of a deletion of a file, an occurrence of an uploading of a file and an occurrence of a downloading of a file.
- an alert is defined as a sequence of events including a pairing of an occurrence of a downloading of a file followed by an occurrence of a deletion of said file in time sequence, and wherein said pairing occurs with respect to other files at least ten times, over a period of time equal to ten minutes.
- a method of reducing false detection of anomalous user behavior on a computer network including actions of; forming groups of users from identity and access management (abbreviated IAM) properties; assigning users into initially assigned groups based on respective IAM properties and recording individual user behavior in a statistical profile, including application usage frequency; dynamically assigning an individual user with a realigned group, different from the initially assigned group, based on comparing the recorded individual user behavior, with user behavior in statistical profiles of the users in the groups; and evaluating and reporting anomalous events among ongoing behavior of the individual user based on deviations from a statistical profile of the realigned group; and wherein said actions are enabled via a cloud-based security system, said cloud-based security system being implemented as computer readable instructions being stored within a non- transitory computer readable storage medium, said computer readable instructions being executed via at least one central processing unit (CPU).
- CPU central processing unit
- evaluating anomalous events further includes evaluating deviations of the events among ongoing behavior of the individual user based from their statistical profile.
- a tangible non-transitory computer readable storage medium including program instructions loaded into memory that, when executed on one or more processors, cause the processors to implement a method of reducing false detection of anomalous user behavior on a computer network, including: forming groups of users from identity and access management (abbreviated IAM) properties; assigning users into initially assigned groups based on respective IAM properties and recording individual user behavior in a statistical profile, including application usage frequency; dynamically assigning an individual user with a realigned group, different from the initial assigned group, based on comparing the recorded individual user behavior, with user behavior in statistical profiles of the users in the groups; and evaluating and reporting anomalous events among ongoing behavior of the individual user based on deviations from a statistical profile of the realigned group.
- IAM identity and access management
- evaluating anomalous events further includes evaluating deviations of the events among ongoing behavior of the individual user based from their statistical profile.
- IAM active directory
- a device for reducing false detection of anomalous user behavior on a computer network including at least one processor, memory coupled to the processor, and computer instructions loaded into the memory that, when executed, cause the processor to implement a process that includes: forming groups of users from identity and access management (abbreviated IAM) properties; assigning users into initially assigned groups based on respective IAM properties and recording individual user behavior in a statistical profile, including application usage frequency; dynamically assigning an individual user with a realigned group, different from the initial assigned group, based on comparing the recorded individual user behavior, with user behavior in statistical profiles of the users in the groups; and evaluating and reporting anomalous events among ongoing behavior of the individual user based on deviations from a statistical profile of the realigned group.
- IAM identity and access management
- evaluating anomalous events further includes evaluating deviations of the events among ongoing behavior of the individual user based from their statistical profile.
- a method of evaluating user compliance with an organization’s security policies including: generating sequence alerts to detect activity by a user that is not in compliance with security policies of an organization, the sequence alerts categorized by severity; generating a batch alert when anomalous user behavior of the user is detected based on deviations from historical user behavior patterns of a peer group of users in relation to the user, the batch alert categorized by severity; scoring user confidence scores or user risk scores, collectively referred to as the user confidence score, by repeatedly summing alert weights, applied by category of severity, and generated over time from the sequence alerts and the batch alerts, wherein the alert weights over time are subject to a decay factor that attenuates the alert weights as time passes; and reporting the user confidence score, comprising causing display of a time series of the user confidence scores over a predetermined time and/or a current user confidence score and/or at least some details of the activity by the user that contributed to the alert weights over time.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- General Engineering & Computer Science (AREA)
- Computer Hardware Design (AREA)
- Theoretical Computer Science (AREA)
- Computing Systems (AREA)
- Business, Economics & Management (AREA)
- Computer Networks & Wireless Communication (AREA)
- Strategic Management (AREA)
- Software Systems (AREA)
- Human Resources & Organizations (AREA)
- Entrepreneurship & Innovation (AREA)
- Economics (AREA)
- Physics & Mathematics (AREA)
- Signal Processing (AREA)
- General Physics & Mathematics (AREA)
- Game Theory and Decision Science (AREA)
- General Business, Economics & Management (AREA)
- Tourism & Hospitality (AREA)
- Quality & Reliability (AREA)
- Operations Research (AREA)
- Marketing (AREA)
- Educational Administration (AREA)
- Development Economics (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
La technologie divulguée enseigne un procédé d'évaluation de la conformité d'un utilisateur à l'aide de politiques de sécurité d'une organisation, de formulation d'une note de confiance ou de risque d'un utilisateur, consistant à noter chaque utilisateur d'une somme de pondérations d'alerte, catégorisée par gravité, et générée au cours du temps. Chaque contribution à une pondération d'alerte est générée en raison d'une activité par l'utilisateur que les politiques de sécurité de l'organisation considèrent comme à risque. Des pondérations d'alerte, au cours du temps, sont soumises à un facteur de décroissance qui atténue les pondérations d'alerte à mesure que le temps passe. Est également divulguée la signalisation de la note de confiance de l'utilisateur, consistant à provoquer l'affichage d'une série chronologique des notes de confiance ou de risque d'utilisateur sur un temps prédéterminé et/ou une note de confiance ou de risque d'utilisateur actuel et/ou au moins certains détails de l'activité par l'utilisateur qui ont contribué aux pondérations d'alerte dans le temps.
Applications Claiming Priority (5)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US17/326,253 US11444951B1 (en) | 2021-05-20 | 2021-05-20 | Reducing false detection of anomalous user behavior on a computer network |
US17/326,243 US11481709B1 (en) | 2021-05-20 | 2021-05-20 | Calibrating user confidence in compliance with an organization's security policies |
US17/326,240 US11310282B1 (en) | 2021-05-20 | 2021-05-20 | Scoring confidence in user compliance with an organization's security policies |
US17/723,345 US20220377111A1 (en) | 2021-05-20 | 2022-04-18 | Scoring confidence in user compliance with an organization's security policies |
PCT/US2022/030133 WO2022246131A1 (fr) | 2021-05-20 | 2022-05-19 | Notation de confiance dans la conformité d'un utilisateur à l'aide de politiques de sécurité d'une organisation |
Publications (1)
Publication Number | Publication Date |
---|---|
EP4352674A1 true EP4352674A1 (fr) | 2024-04-17 |
Family
ID=84141819
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
EP22805527.3A Pending EP4352674A1 (fr) | 2021-05-20 | 2022-05-19 | Notation de confiance dans la conformité d'un utilisateur à l'aide de politiques de sécurité d'une organisation |
Country Status (3)
Country | Link |
---|---|
EP (1) | EP4352674A1 (fr) |
JP (1) | JP2024521121A (fr) |
WO (1) | WO2022246131A1 (fr) |
Families Citing this family (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US11528279B1 (en) | 2021-11-12 | 2022-12-13 | Netskope, Inc. | Automatic user directory synchronization and troubleshooting |
Family Cites Families (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20120137367A1 (en) * | 2009-11-06 | 2012-05-31 | Cataphora, Inc. | Continuous anomaly detection based on behavior modeling and heterogeneous information analysis |
US9544321B2 (en) * | 2015-01-30 | 2017-01-10 | Securonix, Inc. | Anomaly detection using adaptive behavioral profiles |
US9699205B2 (en) * | 2015-08-31 | 2017-07-04 | Splunk Inc. | Network security system |
CN107645533A (zh) * | 2016-07-22 | 2018-01-30 | 阿里巴巴集团控股有限公司 | 数据处理方法、数据发送方法、风险识别方法及设备 |
US11310282B1 (en) * | 2021-05-20 | 2022-04-19 | Netskope, Inc. | Scoring confidence in user compliance with an organization's security policies |
-
2022
- 2022-05-19 JP JP2023571982A patent/JP2024521121A/ja active Pending
- 2022-05-19 EP EP22805527.3A patent/EP4352674A1/fr active Pending
- 2022-05-19 WO PCT/US2022/030133 patent/WO2022246131A1/fr active Application Filing
Also Published As
Publication number | Publication date |
---|---|
WO2022246131A1 (fr) | 2022-11-24 |
JP2024521121A (ja) | 2024-05-28 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
JP7279227B2 (ja) | コンピューティング環境における特権ユーザの監視および異常なアクティビティの検出の手法 | |
US11310282B1 (en) | Scoring confidence in user compliance with an organization's security policies | |
US11323484B2 (en) | Privilege assurance of enterprise computer network environments | |
US11736509B2 (en) | Malware spread simulation for cloud security | |
US11714906B2 (en) | Reducing threat detection processing by applying similarity measures to entropy measures of files | |
US11388186B2 (en) | Method and system to stitch cybersecurity, measure network cyber health, generate business and network risks, enable realtime zero trust verifications, and recommend ordered, predictive risk mitigations | |
US20200137097A1 (en) | System and method for securing an enterprise computing environment | |
US11907366B2 (en) | Introspection driven by incidents for controlling infiltration | |
EP4002176A2 (fr) | Couche de sécurité d'intergiciel pour services informatiques en nuage | |
US20220060507A1 (en) | Privilege assurance of enterprise computer network environments using attack path detection and prediction | |
US11856022B2 (en) | Metadata-based detection and prevention of phishing attacks | |
US20220060509A1 (en) | Privilege assurance of enterprise computer network environments using lateral movement detection and prevention | |
US8713674B1 (en) | Systems and methods for excluding undesirable network transactions | |
US20220368726A1 (en) | Privilege assurance of computer network environments | |
US20210409449A1 (en) | Privilege assurance of enterprise computer network environments using logon session tracking and logging | |
US11481709B1 (en) | Calibrating user confidence in compliance with an organization's security policies | |
US11444951B1 (en) | Reducing false detection of anomalous user behavior on a computer network | |
WO2022246131A1 (fr) | Notation de confiance dans la conformité d'un utilisateur à l'aide de politiques de sécurité d'une organisation | |
US20240106846A1 (en) | Approval Workflows For Anomalous User Behavior |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: THE INTERNATIONAL PUBLICATION HAS BEEN MADE |
|
PUAI | Public reference made under article 153(3) epc to a published international application that has entered the european phase |
Free format text: ORIGINAL CODE: 0009012 |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: REQUEST FOR EXAMINATION WAS MADE |
|
17P | Request for examination filed |
Effective date: 20231220 |
|
AK | Designated contracting states |
Kind code of ref document: A1 Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR |