RU148692U1 - COMPUTER SECURITY EVENTS MONITORING SYSTEM - Google Patents

Abstract

1. A computer security event monitoring system containing means for collecting events, finding solutions, registering an incident and analyzing events, characterized in that an additional data management unit is introduced, including: a normalization module with selection that ensures that all signs of events are reduced to a single range of values; a module for classifying and clustering events, which, at the first stage, provides an analysis of the input stream of events in a computer system with the subsequent selection of a key feature in each event, which allows it to be assigned to a specific cluster using the filtering method of interference and noise; and then, based on preliminary training using the Lance-Williams algorithm with the Ward distance, which ensures the isolation from the whole stream of events that significantly destructively affect the security of the organization’s information resources. 2. The system according to claim 1, characterized in that the classification and clustering module provides additional filtering of interference and noise, rejecting a given percentage of noise.

Description

The technical field to which the utility model relates.

The utility model relates to information security systems and can be used to detect and identify destructive computer security events in real time.

State of the art

a ) Description of analogues

In the application US 20040260947 A1 (security incident detection system) describes a security incident detection system, which collects information in several stages: initial collection and additional. After the necessary information about the network and its components is collected, the analysis is performed and the presence of a destructive event is determined.

However, this system does not allow to determine the causes and source of danger.

US Pat. No. 7,159,237 describes a computer network security monitoring system.

This system is not able to generate solutions automatically without the participation of an analyst, which greatly slows down the response to the incident.

b) Description of the prototype

The closest in technical essence to the claimed and adopted as a prototype is a system for the automatic investigation of security incidents (Pat. 2481633 Russian Federation, IPC G06F 21/55. System and method for the automatic investigation of security incidents [Text] / Zaitsev OV: applicant and patent holder Kaspersky Lab Closed Joint-Stock Company. - No. 20111132618/08: announced 04.08.2011; published May 10, 2013. - 3 pp .: ill.), Which is implemented as an administration server with data collection, incident registration, analyzer in cidents and a means of finding solutions. The system for the automatic investigation of security incidents makes a decision to change the security policy or to update the software based on the registration of one of the events: violation of the security policy, malware detection, incorrect operation of the protection tool.

The disadvantages of the prototype should be noted:

The presence of only an event analyzer unit in the automatic security incident investigation system, designed to search for events preceding a registered security incident, does not allow real-time detection of computer attacks distributed by time and place. At the same time, many of the network intrusions are a chain of events, each of which individually may not carry dangerous consequences, but represent those in aggregate.

Utility Model Disclosure

a ) The technical result, to which the utility model is directed

The purpose of the claimed utility model is to increase the number of detected information security incidents in real time.

b) the Set of essential features

The specified technical result is achieved by the fact that in the known system for the automatic investigation of security incidents (Pat. 2481633 Russian Federation, IPC G06F 21/55. System and method for the automatic investigation of security incidents [Text] / Zaitsev OV: applicant and patentee Closed Joint-Stock Company Kaspersky Lab. - No. 20111132618/08: announced 04.08.2011; publ. 05/10/2013. - 3 pp., Ill.), Containing the blocks: collect data on security events (1), search for solutions (2), incident registration (4) and event analysis (3), and additionally entering The data control block is inserted into a utility model (6).

This allows you to expand the range of detected security incidents by conducting a generalized qualitative analysis of security events for the entire information system in near real-time mode.

Blocks 1, 2, 3, 4, 6 can be made in the form of sections of memory of a computing device, and are characterized by their logical circuit and providing the execution of the specified functions of the block. The data control unit (6) can be functionally independent.

Thus, the introduced data control unit (6), which includes the following modules: normalization (7), classification (10), and correlation (9), corresponds to the “significant differences” signs and ensures the achievement of a positive effect.

c) Causal relationship between the features and technical results

Thanks to a new set of essential features: introducing additional levels of processing security events in the data management unit (6), including modules: normalization (7), classification (10) and correlation (9), the computer security event monitoring system allows finding not only single destructive events , but to reveal the totality of such events, specially distributed by the attacker in time and nodes of the information system. This provides a better analysis of security events and the possibility of increasing the number of detected destructive events in the information system is achieved.

Search results for known solutions in this and related fields of technology in order to identify features that match the distinctive features of the prototype showed that they do not follow explicitly from the prior art. The prior art also did not reveal the popularity of the influence provided by the essential features of the claimed utility model to achieve the specified technical result. Therefore, the claimed utility model meets the condition of patentability "inventive step".

Brief Description of the Drawings

The claimed system for monitoring computer security events is illustrated by the drawings:

FIG. 1 shows an adopted block diagram of an automatic investigation of security incidents.

FIG. 2 shows a block diagram of a computer security event detection system.

FIG. 3 shows the operation of a data management tool.

Utility Model Implementation

a ) Technical means of implementing the utility model with the implementation of the destination specified in the application

The computer security event monitoring system shown in FIG. 2, consists of a data collection unit (1) about security events, a data management unit (6), a data analysis unit (3), a decision submission unit (2), and an incident registration unit (4).

Blocks 1, 2, 3, 4, 6 can be made in the form of sections of memory of a computing device, and are characterized by their logical circuit and providing the execution of the specified functions of the block.

The data collection unit (1) on security events (Fig. 3) provides a stream of data from sources (agents) (5), which can be: file servers, database servers, firewalls (ITUs), workstations, systems for detecting network attacks (intrusions), access control systems, systems for ensuring and monitoring integrity, anti-virus programs, etc.

In this case, two main methods can be used: direct (Pull) and feedback (Push). In the first case, the source itself sends the data of its logs to block (1), in the second - block (1) independently carries out the process of obtaining data about security events (5) from log-logs.

The data control unit (6) (Fig. 3) provides: data processing with special modules of normalization (7), filtering (8), correlation (9) and classification (10). The classification and clustering module (10), which analyzes the entire input stream of events (5), assigns a specific attribute to each event. Then, using the Lans-Williams training sample with the Ward distance, the event is assigned to a specific cluster. When classifying and clustering, it is possible to use the interference and noise filtering module (8), which discards a certain percentage of noise, as well as the use of the normalization and selection algorithm (7), which allows reducing all signs of events to a single numerical value in a segment from 0 to 1, using predefined weights of each feature;

storing data in a filtered and normalized form by placing them in a repository (11), which is based as a triplet repository (a specially created database optimized for storing and searching for statements of the form “subject - predicate - object”);

The event analysis block (4) (Fig. 3) provides: aggregation, prioritization and analysis of incidents and their consequences. In general, data analysis can be based on qualitative and quantitative estimates. Quantification is more accurate, but requires significantly more time, which is not always acceptable. Most often, there is a fairly quick qualitative analysis, the task of which is to distribute risk factors into groups.

Block search solutions (2) (Fig. 3) provides: support and decision-making to repel computer intrusions.

The incident registration unit (4) (Fig. 3) provides: visualization of the current situation, as well as generation of reports and warnings about computer attacks.

b) the possibility of obtaining the technical result indicated by the applicant

The computer security event monitoring system operates as follows.

A computer security event monitoring system, as a rule, contains a central part called a security server (SB), to which agents (sensors) are connected (5) to users' PCs. Moreover, the network topology does not matter.

When some events occur in the local area network that affect the security of the entire information system or its parts, specialized sources (5) transmit data about these events to the security server in a means of collecting data about security events.

The main purpose of the security event data collection unit (1) is to download data on system events from user devices connected to the security server. Downloadable data are records of program and system logs and reports that keep records of user actions, program requests, network requests, etc. Data can be loaded in several stages: first, high-level events can be loaded, and then, if necessary, low-level events. High-level events include actions such as actions with files, changing access rights, and launching programs. Low-level events include program commands and transmitted network packets, for example, accessing a process memory, blocking an incoming data packet, etc. In this case, two main methods can be used: direct (Pull) and feedback (Push). In the first case, the source (5) itself sends data from the records of its security event data collection logs, in the second case, the security event data collection unit (1) independently carries out the process of receiving data on security events from the logs of the main and applied software and hardware information system.

Data on the security events that have occurred is sent to the data management tool (6), where the entire input stream undergoes preliminary normalization and selection (7) of these events from the point of view of assessing the possible risk to the security of the information system.

The procedure for normalizing the input stream about events ensures that the data is reduced to a single form for subsequent processing by the filtration modules (8), correlation (9), and classification (10). This requirement is due to the presence of a wide range of tools used to protect information systems. In addition, each vendor (manufacturer) uses its own system of coding and description of events in the logs. Thus, the normalization module (7) allows you to bring the input data stream about security events to a uniform form for subsequent centralized processing.

Next, the normalized data stream is processed by the filtering module (8), which provides the required completeness of the presentation of data on all potential critical security events. The most important thing in filtering the incoming data stream is the ability to eliminate duplicate events, erroneous and redundant information. This allows you to reduce the burden associated with further processing of events, and facilitates the solution of problems of incident detection.

At the next stage, the flow of data on security events passes sequentially through the classification and clustering module (10), which ensures the identification of logical connections between the analyzed events.

At the same time, the filtered data in a normalized form is placed for storage in the triplet repository (11) for subsequent use in decision making. A repository can be created on the basis of a relational DBMS, an XML-oriented DBMS or a triple repository.

The classification and clustering module (10) first ensures that each event is assigned a special priority attribute that determines the degree (significance) of its threat. The priority assigned to the event determines how quickly it will be processed, investigated and what resources will be used. This procedure takes place on the basis of signs laid down or determined by the administrator of the information system.

Then, the classification and clustering module (10) splits multiple security events into clusters. Within each group there should be “similar” events, and the events of different groups should be different. The main feature of the performed clustering procedure is that the list of groups is not clearly defined and is determined during the operation of the algorithm. The boundaries of various categories (clusters) are often fuzzy, vague, and usually the category of events is not understood through a formal definition, but only in comparison with other categories (clusters).

The task of the classification and clustering module (11) is the formation of generalizing attributes in the aggregate of security events. With an increase in the number of examples of events, non-essential, random signs are smoothed out, and frequently occurring ones are amplified, while the category boundaries are gradually refined.

The classification and clustering module (11) uses hierarchical algorithms for its work, which build not one partition of the sample into disjoint clusters, but a system of nested partitions. Those. the output is a tree of clusters, the root of which is the entire sample, and the leaves are the smallest clusters.

The most suitable for the task of splitting multiple security events into clusters should be considered upstream algorithms in which objects (security events) are combined into more and more large clusters. The implementation of this approach can be represented by the Lance-Williams agglomerative algorithm described in the book of I.D. Mandel “Cluster analysis” (Mandel, ID Cluster analysis. [Text] / ID Mandel // M .: Finance and Statistics, 1988, pp. 69-74). In this case, it is proposed to calculate the distances between the clusters based on the Ward distance. (Mandel, I. D. Cluster analysis. [Text] / I. D. Mandel // M .: Finance and statistics, 1988, p. 70).

Further, information about the obtained clusters, their number, and the events included in their composition goes to the correlation module (9), which ensures the identification of hidden relationships between various security events occurring at different times and at different nodes of the information system, which allows real-time detection attack graphs including distributed events.

Using correlation module (9) of recurrent neural networks of Herolt-Jutten described in the book (Osovsky, S. Neural networks for information processing [Text] / S. Osovsky // M .: Finance and Statistics, 2002) significantly improves the quality of analysis main components (SAR), as such networks have an adaptive linear structure that processes signals in real time, and are used precisely in problems with poorly structured information.

The event data analysis unit (3) detects or records the occurrence of an incident, including by modeling events, attacks and their consequences, analyzing vulnerabilities and security of the system, determining the parameters of intruders, assessing risk, predicting events and incidents.

The event data analysis unit (3) provides prioritization, determining the significance and criticality of security events based on the rules defined in the system. In addition, the analysis of events, incidents and their consequences includes procedures for modeling events, attacks and their consequences, analysis of vulnerabilities and security of the system, determining the parameters of intruders, risk assessment, forecasting events and incidents.

The decision search block (2) determines the development of measures for reconfiguring security tools to prevent attacks or restoring infrastructure security, as well as generating reports and warnings with the formation, transmission and display or printing of the results of its operation.

The incident registration unit (4) provides visualization, i.e. graphical presentation of data characterizing the results of the analysis of security events and the state of the protected information system and its elements.

Thus, the use of a data management unit in the computer security event monitoring system (6) improves its design, allowing for detection of attacks to use not only data about individual events, but also data about incidents recognized by correlation of various events. This will allow more efficient identification of attack graphs, which include distributed events by time and nodes of the information system.

Claims (2)

1. A computer security event monitoring system containing means for collecting events, finding solutions, registering an incident and analyzing events, characterized in that an additional data management unit is introduced, including: a normalization module with selection that ensures that all signs of events are reduced to a single range of values; a module for classifying and clustering events, which, at the first stage, provides an analysis of the input stream of events in a computer system with the subsequent selection of a key feature in each event, which allows it to be assigned to a specific cluster using the filtering method of interference and noise; and then, on the basis of preliminary training using the Lance-Williams algorithm with Ward distance, which ensures the isolation from the entire stream of such events that significantly destructively affect the security of the organization’s information resources. 2. The system according to claim 1, characterized in that the classification and clustering module provides additional filtering of interference and noise, rejecting a given percentage of noise.

Images