FR3135335A1 - METHOD FOR ANALYZING THE IT RISK OF A NETWORK OF INTEREST LINKED TO EXCHANGES WITH AT LEAST ONE THIRD PARTY NETWORK - Google Patents

Abstract

The invention proposes to detect toxic flows generated on each third-party network connected to the network of interest and to analyze the nature of the toxic flows detected in order to only transmit an alert to an administrator of the network of interest when toxic flows detected are potentially harmful for the network of interest.

Description

METHOD FOR ANALYZING THE IT RISK OF A NETWORK OF INTEREST LINKED TO EXCHANGES WITH AT LEAST ONE THIRD PARTY NETWORK

The invention relates to a method making it possible to detect computer risks which could be generated on a network of interest due to network flows exchanged between this network of interest and at least one third-party network, the level of which is not necessarily known. IT security. For example, the network of interest may correspond to a network of a company, an administration or a university, and the third-party network may correspond to the network of a direct or indirect subcontractor, or a collaborating organization. with society, the administration or the university.

The network of interest may also correspond to the network of an operator or the network of a security solution provider. In this case, the method can be used to detect the propagation of toxic flows.

Nowadays, a large number of organizations now have an effective IT security policy. However, other organizations do not always have the financial means, the interest or even the motivation to ensure minimum IT security. However, the growing collaboration of organizations requires a large number of exchanges between companies, administrations and even universities. During these discussions, organizations using a strict IT security policy are concerned about the resilience of the information systems of their subcontractors or collaborators in the face of computer attacks.

In addition, with the deployment of advanced IT security tools, hackers are increasingly using indirect routes to attack an information system by propagating attacks across multiple networks.

In the context of the invention, it is possible to distinguish two types of networks, the network of interest and third-party networks. The network of interest typically corresponds to the network of an organization using a strict IT security policy and for which a network administrator wishes to estimate the IT risk linked to exchanges with external networks, called third-party networks. These third-party networks typically correspond to computer networks of direct or indirect subcontractors or employees.

Alternatively, in the context of detecting the propagation of toxic flows, the network of interest typically corresponds to an operator network or a security solution provider network. Third-party networks then correspond to customer networks belonging to the operator's network or the security solution provider's network.

To analyze the IT risk of a network, the company SERENICITY offers devices called “ Detoxio ”, “ Probio ” and “ Cymealog ” integrating a monitoring body for incoming and outgoing network flows from each device to and from the Internet. As described in patent FR2006068, by comparing the IP addresses of network flows with a database containing a list of toxic IP addresses, it is possible to detect toxic network flows.

This database comprising a list of toxic IP addresses can be obtained by a solution for capturing IP addresses by decoy servers, as described in patent FR 1852752.

Then, a vulnerability score for each device is calculated by applying a factor of ten to outgoing toxic flows relative to incoming toxic flows. This vulnerability score makes it possible to identify and classify the IT risk linked to each device on a network.

This innovation could be deployed directly on all third-party networks connected to a network of interest so that an administrator of the network of interest can verify that third-party networks present limited IT risk. However, with this solution, the administrator of the network of interest would receive a large number of alerts, especially when the network of interest is connected to several third-party networks.

Alternatively, this innovation could be deployed on all third-party networks connected to the same operator or security solution provider in order to visually alert and/or inform the networks affected by a computer attack.

The technical problem of the invention therefore consists of providing an alert to an administrator of a network of interest concerning the IT risk linked to at least one third-party network connected to the network of interest, while limiting the number of alerts and without degrading the relevance of the alerts.

The technical problem of the invention can therefore also consist of providing an alert to several third-party networks belonging to the same operator or the same security solution provider. This alert can contain several pieces of information, such as the type of attack, the extent of the propagation and the vectors of this propagation. This information may be transmitted to each third-party network affected by this attack and to the operator or security solution provider.

To solve this technical problem, the invention proposes to detect the toxic flows generated on each third-party network connected to the network of interest and to analyze the nature of the toxic flows detected in order to only transmit an alert to an administrator of the network of interest. when toxic flows detected are potentially harmful for the network of interest.

For example, if a third-party network suffers a denial of service attack on its website, this type of computer attack is detrimental to the commercial activities of the third-party network, but does not call into question the computer security of the network of interest.

On the contrary, if the third-party network suffers an attack by taking remote control of a station and this station is commonly used to exchange information with the network of interest, this type of attack can present a detrimental IT risk for the network of interest.

To limit such IT risk, an administrator of the network of interest can require the administrators of third-party networks to transmit to him, or to transmit to a trusted third party such as SERENICITY, the network flows captured by their firewalls. These firewalls are classically called “ firewalls ” in Anglo-Saxon literature.

In another example, if a third-party network suffers an attack by taking remote control of a station and this station is used for exchanges between third-party networks belonging to the same operator or to the same security solution provider, then this type The attack can spread to several other third-party networks and thus create a propagation of the toxic flow.

The invention proposes to analyze the network flows captured by the firewalls of third-party networks, to detect toxic flows among all of these network flows and the nature of the exchanges associated with these toxic flows in order to detect potentially toxic flows. detrimental to the network of interest.

Thus, the invention makes it possible to alert an administrator of the network of interest in the event that a computer attack detected on a third-party network may affect the security of the network of interest.

For the purposes of the invention, a toxic flow corresponds to a flow coming from or destined for a toxic IP address, that is to say an IP address referenced in a database and associated with a computer hacker or presenting a high risk of vulnerability. This database is typically created and regularly updated by IT security players. It can be downloaded periodically and stored internally or viewed on an external platform. This database is preferably obtained by decoy servers making it possible to capture toxic IP addresses, as described in patent FR 1852752.

There illustrates an example of network architecture in which the invention can be implemented. In this example, several networks 20 , 30 , 40 and 50 communicate with each other. More precisely, the network 20 exchanges network flows 11a with the networks 30 and 40 while the network 50 exchanges network flows 11b with the network 40 . Network 20 may correspond to the network of a large company, while networks 30 and 40 are the networks of direct subcontractors of this large company, and network 50 is a network of an indirect subcontractor. For the purposes of the invention, network 20 corresponds to the network of interest while networks 30 , 40 and 50 are third-party networks, direct or indirect.

For example, the third-party network 30 may correspond to the network of a service provider responsible for managing the various printers of the network of interest 20 , in particular to remotely deploy their updates.

To do this, the service provider uses a server 31 of the third-party network 30 to connect to a device 2 4 of the network of interest 20 . The invention aims in particular to verify that a computer attack carried out on the third-party network 30 cannot lead to a vulnerability of the network of interest 20 via the existing network flows 11a between the third-party network 30 and the network of interest 20 .

The third-party network 40 may correspond to the network of a service provider in charge of managing the telephone sets 25 of the different offices of the network of interest 20 .

To do this, the service provider uses a server 41 of the third-party network 40 to connect to the telephone sets 25 of the network of interest 20 .

The invention also aims to verify that a computer attack carried out on the third-party network 40 cannot lead to a vulnerability of the network of interest 20 via the existing network flows 11a between the third-party network 40 and the network of interest 20 .

The third-party network 50 may correspond to the network of a service provider responsible for managing air conditioning systems 44 connected to the third-party network 40 . To do this, network flows 11b are generated between a server 51 of the third-party network 50 and the air conditioning systems 44 of the third-party network 40 . With regard to indirect third-party networks, the invention can also be implemented to verify that a computer attack carried out on the third-party network 50 cannot cause a vulnerability of the third-party network 40 and propagate the vulnerability on the network of interest 20 , via network flows 11 a and 11 b .

Furthermore, each third-party network 30 , 40 and 50 is protected by a dedicated firewall 32 , 42 and 52 , conventionally managed by several separate network administrators. These firewalls 32 , 42 and 52 integrate control files 33 , 43 , 53 making it possible to trace a history of the network flows 11a , 11b crossing the firewall. These control files 33 , 43 , 53 are also called “logs” in the Anglo-Saxon literature.

As illustrated on the , the firewalls 32 , 42 , and 52 of the third-party networks 30 , 40 , 50 are further configured to transmit the control files 33 , 43 , 53 . These control files 33 , 43 , 53 can be transmitted to an administrator of the network of interest 20 or to a trusted third party. To do this, a direct secure message 12a can be transmitted between the firewalls 32 , 42 and an analysis unit 61 of a network 60 of the trusted third party.

For the indirect third-party network 50 , the firewall 52 can be configured to transmit the control file 53 directly to the trusted third party 60 , or indirectly through an administrator of the third-party network 40 to which it is connected.

In the example of the , a secure message 12b is transmitted between the firewall 52 and an analysis unit 61 of a network 60 of the trusted third party via the third party network 40 .

More precisely, this analysis unit 61 scans the control files 33 , 43 , 53 , detects toxic flows among all the network flows present in these control files 33 , 43 , 53 and searches for the nature of the exchanges associated with these toxic flows in order to detect toxic flows potentially harmful to the network of interest 20 .

When at least one toxic flow potentially harmful to the network of interest 20 is detected, the analysis unit 61 generates an alert 13 intended for an administrator of the network of interest 20 . This alert 13 may contain contextualized information according to the needs of the administrator of the network of interest 20 . An example of implementing the IT risk analysis method is described with reference to the . In a first step 10 0 , the trusted third party or an administrator of the network of interest 20 recovers the network flows captured by at least one firewall 32 , 4 2 , 5 2 belonging to a third party network 30 , 40 , 50 , for example by receiving the control files 33 , 43 , 53 from the firewalls 3 2 , 4 2 , 5 2 . These control files 33 , 43 , 53 conventionally contain a set of network flows with, for each network flow, at least:
- a source IP address;
- a destination IP address;
- a direction of traffic flow;
- a type of port used for the connection; And
- a timestamp of the network flow, typically the start and end date and time of the network flow.

When the network flows from third-party networks are retrieved, each destination and origin IP address is compared, one by one, to the database comprising the toxic IP addresses 64 , in a step 101 . Each network flow linked to a toxic IP address is then stored in a toxic flow file 63 integrating, for each period of time, for example for each day or for each hour, all of the toxic flows.

Then, in a step 102 , the identification of the nature of the risk is carried out to detect whether each toxic flow presents a risk for the IT security of the network of interest 20 or simply for the IT security of a third party network 30 , 40 , 50 .

To do this, the analysis unit 61 attempts to characterize each type of computer attack on the basis of scenarios using information obtained from the toxic flows detected.

For example, a “brute force” type attack can be characterized when several toxic flows are detected in very close time intervals, typically if the same toxic IP address communicated with the same IP address attacked more than two hundred times in the same day.

Additionally, attack times can be used as an index to characterize compromise attacks, for example the compromise of a door locking system. Typically, if a toxic IP address communicates with a door locking system outside of usual hours, then the analysis unit 61 can categorize a “compromise” type attack.

It is also possible to use known information about the detected toxic IP address, such as the type of attack typically associated with that detected toxic IP address. This information may be integrated into the toxic IP address database or accessible on an external server. For example, if it is known that the detected toxic IP address is based on a military complex, it is possible to characterize the type of computer attack as a “military” type attack. According to another example, if it is known that the detected toxic IP address hosts a node of the Tor network, allowing access to the internet network known as " DarkNet ", then it is possible to characterize the type of computer attack as a “masked” type attack.

As another example, if the detected toxic IP address is known to host a command-and-control server for data-encrypting malware, also known as " command-and-control " in the literature Anglo-Saxon, then it is possible to characterize the type of computer attack as a “command center” type attack.

Furthermore, the ports used for attacks can also help characterize the type of attack. Typically, TCP/IP port “22” corresponds to the SSH port, or “ Secure Shell ” in English literature.

This port “22” is used to take control of remote machines. Thus, if a hacker manages to take control of a device on a third-party network 30 , 40 , 50 , it is possible to characterize the type of computer attack as a “Trojan horse” type attack.

Thus, a large number of scenarios can be implemented to characterize each type of computer attack.

Using this characterization, a large number of computer attacks can be removed from the toxic flow file 63 because they are not potentially harmful to the network of interest 20 .

For toxic flows potentially harmful to the network of interest 20 , an alert 13 can be transmitted to the administrator of the network of interest 20 , in a step 103 . To limit the number of alerts received, the administrator of the network of interest 20 may have an interface allowing the types of attack to be selected, for example "brute force", "compromise", "military", "hidden", “command center” and “Trojan horse”, for which he wishes to receive an alert 13 .

Thus, if a “brute force” type attack is characterized in step 102 and the administrator does not wish to receive this type of information, then no alert will be transmitted to the administrator of the network of interest 20.

This alert 13 can take different forms depending on the needs of the administrator of the network of interest 20 . For example, the alert 13 can be displayed on a map using the geolocation of the detected toxic IP address, the attacked IP address or even an IP address of the network of interest 20 which communicated with the IP address attacked. In addition, each alert 13 may have a different form depending on the nature of the attack.

Thus, upon receipt of the alert 13 , the administrator of the network of interest 20 can easily see the third-party networks 30 , 40 , 50 directly or indirectly attacked, the type of attack that these networks have suffered and the meaning of traffic flow of these attacks.

To conclude, the invention makes it possible to provide an alert 13 to an administrator of a network of interest 20 concerning the IT risk linked to at least one third-party network 30 , 40 , 50 connected directly or indirectly to the network of interest 20 . Furthermore, the invention also proposes to limit the information transmitted to the administrator of the network of interest 20 in order to transmit only relevant alerts 13 to him. By receiving one or more IP addresses of the network of interest 20 for which there is an IT risk, the administrator can act accordingly. For example, it can investigate and possibly disconnect a device from the network.

The example of the illustrates a network architecture in which the invention can be implemented to detect the propagation of toxic flows.

In this example, several networks 30 , 40 and 50 correspond to third-party networks of clients belonging to the network of an operator or to the network of a security solution provider 20 . Thus, the network 20 illustrated on the does not correspond to a physical network but to several remote networks which use a similar box from the same operator or which integrate a hardware and/or software device from the same security solution provider. For third-party networks 30 , 40 , 50 , network flows 11a are transmitted to access the Internet, for example to access a server 71 of the external network 70 . More precisely, when a server 31 , 41 , 51 belonging to a third-party network 30 , 40 , 50 wishes to access the Internet, a network flow 11a passes through a firewall 32 , 42 , 52 of the third-party network 30 , 40 , 50 as well than a box 22 from an operator or a hardware and/or software device 22 from a security solution provider.

As illustrated on the , a trusted third party or an administrator of the network 20 can recover the control files 33 , 43 , 53 of the firewalls 32 , 42 , 52 of the third-party networks 30 , 40 , 50 or capture these network flows at the level of the boxes or the devices 22 .

To do this, as described above, a direct secure message 12a can be transmitted between the firewalls 32 , 42 , 52 , 72 and an analysis unit 61 of a network 60 of the trusted third party. Furthermore, one or more external networks 70 can also transmit their control files 73 of the firewalls 72 in a secure message 12c .

This analytical body61browse control files33,43,53,73, detects toxic flows among all the network flows present in these control files33,43,53,73, researches the nature of the exchanges associated with these toxic flows, and characterizes the toxic flows propagated in third-party networks30,40,50. When at least one toxic flow propagated in third-party networks30,40,50, is detected, the analysis organ61generates an alert13intended for the administrator of the network of interest20 and possibly third-party network administrators30,40,50, affected by this propagated attack. This alert13may contain contextualized information based on the needs of the network administrator of interest20.

An example of implementing the method for detecting the propagation of toxic flows is described with reference to the . In a first step 110 , the trusted third party or an administrator of the network of interest 20 recovers the network flows captured by at least one firewall 32 , 42 , 52 and 72 belonging to a third party network 30 , 40 , 50 , or to an external network 70 . For example by receiving control files 33 , 43 , 53 , 73 from firewalls 32 , 42 , 52 , 72 . These control files 33 , 43 , 53 , 73 conventionally contain a set of network flows.

In a step 111 , in the same way as in step 101 of the , when the network flows from third-party networks are retrieved, each destination and origin IP address is compared, one by one, to the database comprising the toxic IP addresses 64 . Each network flow linked to a toxic IP address is then stored in a toxic flow file 63 integrating, for each period of time, for example for each day or for each hour, all of the toxic flows.

Then, in a step 112 , the identification of the nature of the risk is carried out to investigate whether each toxic flow presents a risk of propagation in the network of interest 20 or simply for the IT security of a third party network 30 , 40 , 50 .

To do this, the analysis unit 61 attempts to characterize each type of computer attack on the basis of scenarios using information obtained from the toxic flows detected, such as the ports used for the attacks or the timestamp and the volume of data from attacks. These scenarios make it possible to search for attacks with a high risk of propagation and attack them with a low risk of propagation. At the end of this step 112 , the attacks with a low risk of propagation are deleted from the toxic flow file 63 .

Step 113 then aims to characterize whether these remaining attacks in toxic flow file 63 have actually propagated in the network of interest 20 . To do this, the body 61 searches if the toxic IP addresses of the different attacks remaining in the toxic flow file 63 have targeted several different attacked IP addresses. If this is the case, a propagation of an attack is characterized if several attacked IP addresses have suffered an attack of the same type and coming from the same toxic IP.

Propagation is therefore defined by a grouping of toxic flows including a toxic IP address, a type of computer attack, and a list of attacked IP addresses.

To more precisely identify the spread, it is possible to classify toxic flows based on their timestamps. The toxic flow which has the oldest timestamp can therefore be identified as the entry point for the propagation of the attack. From all the toxic flows, it is also possible to characterize the type of propagation, point to point if the timestamps are successive or multibroadcast if several simultaneous attacks are detected at very close time intervals and to a large number of IP addresses attacked.

Following the characterization of the propagation, an alert can be issued to the administrator of the network of interest 20 and to the administrators of the third-party networks 30 , 40 , 50 , in a step 114 . The alert can take the same form as the alert defined in the by adding a visual representation of the propagation of the toxic flow on the different networks concerned. For example, a timeline representation of the spread based on the timestamps of the toxic flows, the geolocation of the attacked IP addresses, and the toxic IP address of each spread can be generated.

Thus, upon receipt of the alert 13 , the administrator of the network of interest 20 and the administrators of the third-party networks 30 , 40 , 50 can easily identify the third-party networks 30 , 40 , 50 attacked, the type of attack that these networks suffered from the nature and speed of propagation.

Claims (1)

[none]