RU193101U1 - System for analytical processing of information security events - Google Patents

Abstract

The information security event analytic processing system (ISS) is designed to detect information security incidents (ISS) based on a retrospective analysis of ISSs distributed over time, as well as timely warning of a possible ISS occurrence by predicting its occurrence. The technical result is to increase the likelihood of IIB detection in information systems (IS), which in turn leads to an increase in its security. The specified technical result is achieved by the fact that the operator sets the parameters of the system (temporary, quantitative, qualitative and combined) through the interface unit. The NIB receiving unit transmits the received NIB to the storage and labeling module of the NIB and the IIB, in which they are assigned unique labels. Then, in the NIB mark comparison blocks, the current NIB marks are processed according to the rules of the first and second level correlation directives, during which the current NIB marks are counted in the SIB mark counter until their maximum number is reached for the selected time interval, followed by the generation of an alarm in the alarm generation block , as well as their storage in the block buffer of the current NIB marks and calculation of the value of the probability indicator of the onset of IIB in the block for calculating the probability of the onset of IIB. Provided that the value of the current NIB mark does not meet the rules of the correlation directive of the first and second levels, they are moved to the block of delay of the NIB tags, which, in conjunction with the block for calculating the probability of occurrence of the IIB and the block of storage of the IIB labels, checks the value of the current NIB label elements of delayed NIB tag chains. The alarm warning unit receives from the NIB label delay block the incomplete NIB label chains, according to which the specified values of the probability of occurrence of the IIB are reached, and transmits them to the IIB forecasting unit, which analyzes them with the IIB labels that do not meet the rules of the first and second level correlation directives that do not which are subsequent elements of the delayed chains of NIB tags in the block of delay of the NIB tags and coming from the block for comparing the NIB tags with the rule of the first level correlation directive. Based on the results of the operation of the IIB forecasting unit and the signals received from the notification module, the operator, through the interface unit, makes a decision about the state of the IS and the discovery of a new IIB, which, through the block of updates of the IIB tags, enters the block of storage of the IIB tags. 4 ill.

Description

The proposed utility model relates to the field of computer technology, namely to information security (hereinafter referred to as IS), and can be used to implement the process of detecting information security incidents (hereinafter referred to as ISS) in information systems (hereinafter referred to as IS) using SIEM systems (from the English Security Information and Event Management).

The analogue is known, “Information Security Audit Device in Automated Systems,” according to RF patent No. 180789, IPC G06F 21/55 (2013.01), decl. 10/31/2017, publ. 06/22/2018, which consists in the fact that the device contains a data collection unit for information security events (hereinafter referred to as NIB), a data management unit, an NIB analysis unit, a risk assessment unit, a decision search unit, a decision analysis unit, a decision making unit and IIB registration unit. The data control unit contains a normalization module, a filter module, a correlation module, and a classification module.

The disadvantages of this device are:

the dependence of the process of functioning of the device on predefined correlation rules, allowing to detect ISS;

the inability to detect time-distributed ISS, which, in turn, does not allow the operator to respond in a timely manner to emerging IS threats.

Known analogue "Intrusion Detector Level Host Network" according to the patent of the Russian Federation No. 186198, IPC G06F 21/55 (2013.01), decl. 03/07/2018, publ. 01/11/2019, which consists in the fact that the tool is made in the form of an administration server on which a group of sensors is installed, such as an event analysis sensor, a traffic analysis sensor, an analysis of interaction with the operating system, a connection activity sensor, and a file integrity controller. The host-level intrusion detection tool also comprises an information and decision-making unit, which is connected to a group of sensors and a memory unit. The technical result of the intrusion detection tool is to reduce the risks of network node failures by analyzing information on various communication channels.

The disadvantages of this analogue are:

elements of the tool must be pre-installed on the network node;

the effectiveness of the functioning of the tool is directly dependent on the completeness and accuracy of the base of decision rules containing the signatures of known network attacks, which requires constant (systematic) updating;

the tool, being a source of ISS, does not provide timely detection of ISS, but detects signs of network attacks that can already exploit IP vulnerabilities.

The closest technical solution adopted for the prototype is the utility model “Device correlation of information security events”, according to the patent of the Russian Federation No. 166348, IPC G06F 21/55 (2013.01), the application. 08/01/2016, publ. 11/20/2016, Bull. Number 32. In this prototype, an approach to detecting computer attacks on IP using SIEM systems is proposed. The prototype model is that the system contains a NIB receiver whose output is connected to the first input of the NIB comparison unit with the rule of the first level correlation directive and to the first input of the NIB comparison unit with the rule of the second level correlation directive, the output of the NIB comparison unit with the rule of the first correlation directive the level is connected to the timer input and to the second input of the NIB comparison unit with the rule of the second level correlation directive, the output of the NIB comparison block with the rule of the second level correlation directive is connected to the first the input of the NIB counter, the second input of which is connected to the first timer output, and the output to the alarm generation unit, the output of which is connected to the second input of the NIB comparison unit with the rule of the first level correlation directive, the third input of which is connected to the second timer output.

The disadvantages of this device are:

lack of retrospective analysis of NIBs distributed over time;

the impossibility of forecasting new ISS and their prevention.

The purpose of the proposed utility model is to increase the likelihood of IIB detection due to a retrospective analysis of ISS distributed over time, as well as timely warning of a possible IIB occurrence due to prediction of its occurrence.

A new approach is proposed, based on the creation of an NIB analytical processing system containing an NIB receiving unit, a NIB label comparison unit with the rule of the first level correlation directive, a NIB label comparison unit with the second level correlation directive rule, timer No. 1, the NIB label counter and the alarm generation unit . Additionally, a module for storing and labeling NIB and IIB was added, consisting of a block for storing labels for IIB, a block for storing labels for NIB, and a block for assigning labels for NIB; module for comparing NIB marks of the third level, consisting of a block for buffering current NIB tags, a block for calculating the probability of occurrence of IIB and a block for delaying NIB tags; an alarm warning unit, which together with the alarm generation unit forms an alert module; interaction module with an information security specialist, consisting of an interface unit and an information security label update unit; timer No. 2 and the IIB forecasting unit.

The technical result is achieved in that the output of the NIB receiving unit is connected to the input of the NIB labeling unit, which interacts with the NIB label storage unit. The first output of the NIB labeling unit is connected to the first input of the NIB label comparison unit with the rule of the first level correlation directive interacting with the IIB label storage unit and the NIB label delay unit, interconnected with timer No. 2 and the IIB occurrence probability calculation unit that interacts with the storage unit IIB labels and the block for buffering current NIB labels. The second output of the NIB labeling unit is connected to the first input of the NIB label comparison unit with the rule of the second level correlation directive interacting with the IIB label storage unit and the NIB label delay unit. The first output of the unit for comparing NIB labels with the rule of the first level correlation directive is connected to the first input of timer No. 1 and with the second input of the unit for comparing NIB labels with the rule of the second level correlation directive. The second output of the unit for comparing NIB labels with the rule of the first level correlation directive is connected to the first input of the IIB prediction unit. The first output of the NIB tag comparison unit with the rule of the second level correlation directive is connected to the first input of the NIB tag counter. The second output of the block for comparing NIB labels with the rule of the second level correlation directive is connected to the first input of the block for buffering the current NIB labels. The third output of the NIB label comparison unit with the rule of the second level correlation directive is connected to the second input of the NIB label comparison unit with the rule of the first level correlation directive. The first output of timer No. 1 is connected to the second input of the NIB tag counter and to the second input of the current NIB label buffering unit, and the second output of timer No. 1 is connected to the third input of the NIB label comparison unit with the rule of the first level correlation directive. The output of the NIB tag counter is connected to the first input of the alarm generation unit, the first output of which is connected to the fourth input of the NIB label comparison unit with the rule of the first level correlation directive. The first output of the NIB mark delay block is connected to the input of the alarm warning block, and the second output is connected to the second input of the alarm generation block. The output of the alarm warning unit is connected to the first input of the interface unit and to the second input of the IIB forecasting unit, the output of which is connected to the third input of the interface unit. The second output of the alarm generation unit is connected to the second input of the interface unit, the first output of which is connected to the input of the IIB label update unit. The output of the IIB label update unit is connected to the input of the IIB label storage unit. The second output of the interface unit is connected to the second input of timer No. 1 and to the input of timer No. 2.

The technical result of the utility model is to increase the likelihood of detecting ISS in the IP, which in turn leads to an increase in its security.

This goal is achieved by creating a module for storing and assigning NIB and IIB labels, which allows approximating incoming NIBs to the corresponding labels; module for comparing NIB marks of the third level, which allows buffering and delaying the chains of NIB tags coming from the blocks for comparing NIB tags with the rule of the directive for correlation of the first and second levels, based on the calculation of the value of the probability indicator of the onset of the IIB; notification module, which allows to warn about a possible ISS based on the calculation of the probability of its occurrence indicator; IIB forecasting unit, which allows to determine a new IIB by analyzing incomplete chains of NIB tags coming from the notification module, and NIB tags that do not meet the rules of the correlation directive of the first and second levels, as well as from the block comparing NIB labels with the rule of the first level correlation directive; a module of interaction with an information security specialist, which allows displaying the results of the functioning of the ISS analytical processing system, on the basis of which the information security specialist carries out its training and decides on the state of the controlled information system; timer No. 2, which allows you to set and take into account the values of the time intervals of the delay of the chains of SIB labels in the module for comparing SIS labels of the 3rd level.

The claimed utility model is illustrated by drawings, which show:

FIG. 1 is a block diagram of a system for analytical processing of NIB;

FIG. 2 - the form of the table of storage of labels IIB;

FIG. 3 is a form of a table for storing NIB tags;

FIG. 4 is a form of a table for storing NIB tag chains.

The essence of the utility model is illustrated by the drawing (Fig. 1) "Block diagram of the system of analytical processing of NIB", which shows the modules and blocks: block receiving NIB (1); the NIB and IIB label storage and labeling module (2), which includes the IIB label storage unit (2.1), the NIB label storage unit (2.2) and the NIB labeling unit (2.3); block comparing NIB labels with the rule of the first level correlation directive (3); block comparing NIB labels with the rule of the second level correlation directive (4); timer No. 1 (5); module for comparing NIB marks of the third level (6), consisting of a block for buffering current NIB tags (6.1), a block for calculating the probability of occurrence of IIB (6.2), and a block for delaying NIB tags (6.3); NIB tag counter (7); warning module (8), consisting of an alarm warning unit (8.1) and an alarm generation unit (8.2); a module for interaction with an IS specialist (9), consisting of an interface unit (9.1) and an IIB label update unit (9.2); timer No. 2 (10); IIB forecasting unit (11).

The NIB analytical processing system operates as follows:

The operator through the interface unit (9.1) sets the parameters of the system:

temporary - in timer No. 1 (5) and timer No. 2 (10), which determine the allocated time intervals spent on processing the ISS;

quantitative - in the NIB tag counter (7), which determine the maximum number of NIB tags that occur during the selected time interval; in the block for calculating the probability of occurrence of ISS (6.2), determining the values of the indicator of the probability of occurrence of ISS, based on which, in cooperation with the block for storing labels of ISS (2.1), the system of analytical processing of ISS moves the chain of labels of ISS from the buffer block of current ISS labels (6.1) to the NIB label delay block (6.3), warning the alarm, or generating an alarm using the notification module (8);

high-quality - in blocks comparing NIB labels with the rules of the correlation directive of the first (3) and second levels (4), which determine the processing rules for incoming NIB labels;

combined - in the storage block of the IIB labels (2.1) in the form of a table for storing the labels of the IIB (Fig. 2) and in the block for storing the labels of the IIB (2.2) in the form of the table for the storage of the labels of the IIB (Fig. 3), which determine the type of the labels of the IIB and the IIB.

Next, the NIB arrives at the NIB receiving unit (1) and is transmitted to the input of the IIB labeling unit (2.3) of the NIB and IIB storage and labeling module (2), in which this NIB is assigned a unique label by interacting with the NIB label storage unit (2.2) . Moreover, if the received NIB is contained in the NIB label storage unit (2.2), then it is assigned the specified label from the NIB label storage table (Fig. 3). Otherwise, the incoming NIB is assigned the next NIB tag number from the NIB label storage table (Fig. 3). Then the NIB labeling unit (2.3) transfers the current NIB label to the first input of the NIB label comparing unit with the rule of the first level correlation directive (3) to check it according to the rule of the first level correlation directive.

The unit for comparing NIB labels with the rule of the first level correlation directive (3) in cooperation with the IIB label storage unit (2.1) checks the value of the current NIB label for the values of the first elements of the IIB labels stored in the IIB label storage table (Fig. 2) by enumerating the values all the first elements of the IIB labels based on the specified rule of the first level correlation directive.

If the value of the current NIB mark does not satisfy the rule of the first level correlation directive, then the block for comparing the NIB marks with the rule of the first level correlation directive (3) transfers the current NIB mark to the delay block of the NIB marks (6.3), which, in conjunction with the occurrence probability calculation unit The ISS (6.2) and the ISS label storage unit (2.1) checks whether the value of the current NIB mark corresponds to the values of the subsequent elements of the delayed NIB label chains stored in the NIB label chain storage table (Fig. 4) of the NIB label delay block (6.3) , by enumerating all subsequent elements of the IIB tags stored in the IIB label storage table (Fig. 2) of the IIB label storage unit (2.1).

If the current NIB tag is not the first element of the IIB labels stored in the IIB label storage table (Fig. 2), and the next element of the delayed NIB label chains stored in the NIB label chain storage table (Fig. 4) of the NIB label delay block ( 6.3), then the unit for comparing NIB labels with the rule of the first level correlation directive (3) sends its current NIB label to the first input of the IIB prediction block (11) through its second output for further analysis to determine a new IIB.

Provided that the current NIB tag is the next element of the delayed NIB tag chains stored in the storage table of the NIB tag chains (Fig. 4) of the NIB tag delay unit (6.3) interacting with timer No. 2 (10), then based on the values of time intervals delays of the NIB tag chains, the sequence of processing the delayed NIB tag chains is changed and the value of the probability indicator of the occurrence of the IIB is calculated by the NIB tag chains in which the current NIB tag is entered.

Provided that the value of the current NIB mark satisfies the rule of the first level correlation directive, then through the first output of the block for comparing NIB labels with the rule of the first level correlation directive (3) to the second input of the block for comparing NIB labels with the second level correlation directive rule (4) and the first the input of timer No. 1 (5) receives a signal that permits the recording of subsequent NIB marks in the block for comparing SIB labels with the rule of the second level correlation directive (4) and starts timer No. 1 (5). In this case, the unit for comparing NIB labels with the rule of the first level correlation directive (3) ceases to process subsequent NIB labels until an enabling signal arrives at its second, third, or fourth inputs.

If there is no enable signal at the second, third or fourth inputs of the NIB label comparing unit with the rule of the correlation directive of the first level (3), all subsequent NIB labels through the second output of the NIB label assignment unit (2.3) are sent to the first input of the NIB label comparing unit with the correlation directive rule the second level (4), which, in cooperation with the IIB label storage unit (2.1), checks whether the current NIB mark corresponds to the values of the subsequent IIB label elements stored in the IIB label storage table (Fig. 2) of the block identification of IIB labels (2.1), by enumerating all subsequent elements of IIB labels based on a given rule of the second level correlation directive.

If the value of the current NIB mark does not satisfy the rule of the second level correlation directive, then the block for comparing the NIB labels with the rule of the second level correlation directive (4) transfers the current NIB mark to the delay block of the NIB marks (6.3).

If the value of the current NIB mark is not the next element of the IIB labels stored in the IIB label storage table (Fig. 2) of the IIB label storage unit (2.1), and the next element of the delayed NIB label chains stored in the storage table of the IIB label chains (Fig. 4) the NIB tag delay block (6.3), then the NIB tag comparison unit with the second level correlation directive rule (4) through its third output to the second input of the NIB label comparison unit with the first level correlation directive rule (3) transmits the current NIB label and signal allowing bl In order to compare the NIB marks with the rule of the first level correlation directive (3), process subsequent NIB marks.

If the value of the current NIB tag does not satisfy the rule of the first level correlation directive, then re-checking the correspondence of the value of the current NIB tag to the values of the subsequent elements of the delayed NIB tag chains stored in the NIB tag chain storage table (Fig. 4) of the NIB tag delay block (6.3) not produced.

Current NIB marks that satisfy the rules of the first and second level correlation directive are transmitted through the second output of the NIB mark comparison unit with the second level correlation directive rule (4) to the first input of the current NIB mark buffer block (6.1) of the third-level NIB mark comparison module (6) for their storage and calculation of the value of the probability indicator of the onset of ISS through the operation of the unit for calculating the probability of the onset of ISS (6.2).

If the value of the current NIB mark satisfies the rule of the second level correlation directive, then a signal is sent to the first input of the NIB tag counter (7) through the first output of the NIB mark comparison unit with the rule of the second level correlation directive (7), which starts the counting of the NIB marks. When the maximum number of NIB marks is reached in the allotted time interval, through the output of the NIB tag counter (7), a signal about a computer attack on the IS is transmitted to the first input of the alarm generation block (8.2) of the notification module (8) (through the first and second outputs of the alarm generation block ( 8.2) is transmitted to the fourth input of the unit for comparing NIB labels with the rule of the first level correlation directive (3) to start it and to the second input of the interface unit (9.1) for deciding on the state of the controlled IP.

Moreover, the NIB tag counter (7) and the buffer unit for the current NIB tags (6.1) are reset to zero by the signal arriving at their second inputs from the first output of timer No. 1 (5), at the expiration of the time intervals allocated for processing the IIB, and upon receipt at the first input timer No. 1 (5) from the first output of the unit for comparing NIB labels with the rule of the correlation directive of the first level (3) of the signal that triggers it.

In addition, at the expiration of the time intervals allocated for processing the IIB, timer No. 1 (5) transmits a signal through its second output to the third input of the unit for comparing NIB labels with the rule of the first level correlation directive (3), which allows it to process subsequent NIB labels.

The block for calculating the probability of the occurrence of the IIB (6.2) in conjunction with the block for storing the labels of the IIB (2.1), the block for buffering the current labels of the IIB (6.1) and the block for the delay of the labels of the IIB (6.3) provides the calculation of the probability of the occurrence of the IIB, as a result of which, when the specified quantitative operation parameters of the NIB analytical processing system, the NIB tag chain is moved from the buffer block of the current NIB tags (6.1) to the NIB tag delay block (6.3), which through its first and second outputs to the warning block input anxiety Ia (8.1) and the second input of the alarm generation unit (8.2) transmits signals forming warning and generating an alarm about detection ISS.

Further, the alarm warning unit (8.1), through its output to the first input of the interface unit (9.1) and the second input of the IIB prediction block (11), transmits an incomplete NIB mark chain, over which the specified value of the probability of occurrence of the IIB is reached, and an alarm warning signal.

The IIB forecasting block (11) analyzes incomplete chains of NIB tags coming from the notification module (8) and NIB tags that do not meet the rules of the first and second level correlation directives, as well as those coming from the second output of the SIB label comparison unit with the rule of the first correlation directive level (3). The results of the analysis through the output of the prediction block (11) are transmitted to the third input of the interface block (9.1).

Based on the results of the operation of the IIB forecasting unit (11) and the signals received from the notification module (8), the operator, through the interface unit (9.1), makes a decision on the state of the monitored IP and the detection of a new IIB, which is transmitted through the IIB label update unit (9.2) to the input of the IIB label storage unit (2.1) with the subsequent updating of the IIB label storage table (Fig. 2), thereby training the NIB analytical processing system.

Thus, thanks to a new set of essential features in the claimed utility model, the probability of detecting ISS is increased due to a retrospective analysis of ISS distributed over time, as well as timely warning of a possible ISS due to prediction of its occurrence.

The NIB analytical processing system is industrially applicable, since it can be implemented in information security devices and can be used for real-time detection and identification of ISS.

Claims (1)

An information security event analytic processing system comprising an information security event receiving unit, an information security event label comparing unit with a rule of the first level correlation directive, an information security event label comparing unit with a second level correlation directive rule, a timer No. 1, an information security event label counter and alarm generation unit, characterized in that a module for storing and labeling events and incidents of information security is added clarity, consisting of a storage unit label information security incidents, the storage unit label information security events and block assigning labels of information security events; module for comparing information security event labels of the third level, consisting of a block for buffering the current information security event labels, a unit for calculating the probability of occurrence of information security incidents, and a block for delaying information security event labels; an alarm warning unit, which together with the alarm generation unit forms an alert module; interaction module with an information security specialist, consisting of an interface unit and an information security incident label update unit; timer No. 2 and information security incident forecasting unit; the output of the information security event receiving unit is connected to the input of the information security event labeling unit, which interacts with the information security event label storage unit; the first output of the information security event label assignment unit is connected to the first input of the information security event label comparison unit with the rule of the first level correlation directive interacting with the information security incident label storage unit and the information security event label delay unit, interconnected with timer No. 2 and the probability calculation unit the occurrence of information security incidents, which interacts with the information label incident storage unit security and block buffering current label information security events; the second output of the information security event label assignment unit is connected to the first input of the information security event label comparison unit with the rule of the second level correlation directive interacting with the information security incident label storage unit and the information security event label delay unit; the first output of the information security event label comparison unit with the rule of the first level correlation directive is connected to the first input of timer No. 1 and the second input of the information security event label comparison unit with the rule of the second level correlation directive; the second output of the information security event label comparison unit with the rule of the first level correlation directive is connected to the first input of the information security incident prediction unit; the first output of the information security event label comparison unit with the rule of the second level correlation directive is connected to the first input of the information security event label counter; the second output of the information security event label comparing unit with the rule of the second level correlation directive is connected to the first input of the buffering unit of the current information security event label; the third output of the information security event label comparison unit with the second level correlation directive rule is connected to the second input of the information security event label comparison unit with the rule of the first level correlation directive; the first output of timer No. 1 is connected to the second input of the information security event label counter and to the second input of the buffer block of current information security event labels, and the second output of timer No. 1 is connected to the third input of the information security event label comparison unit with the rule of the first level correlation directive; the output of the information security event label counter is connected to the first input of the alarm generation unit, the first output of which is connected to the fourth input of the information security event label comparison unit with the rule of the first level correlation directive; the first output of the information security event label delay block is connected to the input of the alarm warning unit, and the second output is connected to the second input of the alarm generation unit; the output of the alarm warning unit is connected to the first input of the interface unit and to the second input of the information security incident forecasting unit, the output of which is connected to the third input of the interface unit; the second output of the alarm generation unit is connected to the second input of the interface unit, the first output of which is connected to the input of the information security incident label update unit; the output of the information security incident label update unit is connected to the input of the information security incident label storage unit; the second output of the interface unit is connected to the second input of timer No. 1 and to the input of timer No. 2.

Images