WO2017058142A1 - Threat score determination - Google Patents

Threat score determination Download PDF

Info

Publication number
WO2017058142A1
WO2017058142A1 PCT/US2015/052650 US2015052650W WO2017058142A1 WO 2017058142 A1 WO2017058142 A1 WO 2017058142A1 US 2015052650 W US2015052650 W US 2015052650W WO 2017058142 A1 WO2017058142 A1 WO 2017058142A1
Authority
WO
WIPO (PCT)
Prior art keywords
linked
threat score
security object
resource
linked resource
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/US2015/052650
Other languages
French (fr)
Inventor
Tomas Sander
Brian Frederik Hosea Che HEIN
Nadav Cohen
Ted ROSS
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Hewlett Packard Enterprise Development LP
Original Assignee
Hewlett Packard Enterprise Development LP
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Hewlett Packard Enterprise Development LP filed Critical Hewlett Packard Enterprise Development LP
Priority to PCT/US2015/052650 priority Critical patent/WO2017058142A1/en
Priority to US15/763,253 priority patent/US10896259B2/en
Publication of WO2017058142A1 publication Critical patent/WO2017058142A1/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/577—Assessing vulnerabilities and evaluating computer system security
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/28—Databases characterised by their database models, e.g. relational or object models
    • G06F16/284—Relational databases
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/28—Databases characterised by their database models, e.g. relational or object models
    • G06F16/284—Relational databases
    • G06F16/285—Clustering or classification
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/03—Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms
    • G06F2221/034—Test or assess a computer or a system

Definitions

  • Systems may determine threat scores of certain items to prioritize among different pieces of threat intelligence and to decide which threat intelligence to act on. Computing accurate threat scores for severity, confidence or impact of threat intelligence may be important for using threat intelligence data effectively and at scale.
  • FIG. 1 is a block diagram of an example system for threat score determination
  • FIG. 2 is a flowchart of an example method for threat score determination
  • FIG. 3 is a flowchart of an example method for threat score adjustment
  • FIG. 4 is a block diagram of an example system for threat score determination
  • FIG. 5 is a block diagram of an example system for threat score determination.
  • a variety of problems in the field of threat intelligence have provided challenges for assigning threat scores in an accurate, meaningful way.
  • One problem in particular is the dynamic nature of cyber threats; a server that was malicious one day may no longer be malicious the next day, or vice versa. Accordingly, connections from IP address associated with the server may no longer pose a threat.
  • Example systems for threat score determination described herein determine threat scores based on known properties and scores of other objects to which these indicators are linked to in a database. In this manner, the example systems can determine precise and timely threat scores that accurately represent rapid changes in the threat landscape.
  • the example systems for threat score determination may raise the severity scores of some or all of the indicators in a database that are directly linked to that botnet, such as C&C domains, maiware species used, etc.
  • a similar technique may be applied when new links between objects in the database are discovered.
  • a method for threat score determination may include detecting a change in malicious activity for a security object and identifying an indicator that provides contextual information for the security object.
  • the method may include determining a linked resource that is associated with a database record of the security object and determining a first threat score associated with the security object.
  • the method may also include determining a relationship between the linked resource and the security object and determining a second threat score associated with the linked resource based on the indicator, the threat score of the linked object and the relationship between the linked resource and the security object.
  • FIG. 1 is a block diagram of an example system 100 for threat score determination.
  • system 100 may comprise various components, including a malicious activity detector 1 10, an indicator identifier 1 12, a linked resource determiner 1 14, a security object threat score determiner 1 16, a relationship determiner 1 18, a linked resource threat score determiner 120, a threat score adjuster 122, an external data source retriever 124, an historical security information retriever 126, a time period determiner 128, a linked level determiner 130, an influence adjuster 132, a graph database presenter 134 and/or other components.
  • threat score determination 100 may be implemented in hardware and/or a combination of hardware and programming that configures hardware.
  • FIG. 1 is a block diagram of an example system 100 for threat score determination.
  • FIG. 1 is a block diagram of an example system 100 for threat score determination.
  • system 100 may comprise various components, including a malicious activity detector 1 10, an indicator identifier 1 12, a linked resource determiner 1 14, a security object threat score determiner 1 16, a relationship determiner
  • Malicious activity detector 1 10 may detect a change in malicious activity for a security object. Malicious activity detector 1 10 may detect the change in malicious activity in a variety of ways. In one example, malicious activity detector 1 10 may detect the change by receiving information identifying the change.
  • the information may be received from, for example, a third party database, in another example, malicious activity detector 1 10 may detect the change by comparing connections and relationships of the security object and comparing the connections/relationships to known malicious actors.
  • the security object may be one or more objects belonging to a database and/or data model.
  • the security object may correspond to one or more lower level observables, such as an IP address, a domain name, a domain server, a mutex (mutual exclusion) a registry key data, an email header, a behavioral aspect of malware, etc.
  • the change may be detected in real time or near real time.
  • the change in maiicious activity may be a security object being identified as malicious or becoming associated with a malicious actor.
  • the change in malicious activity may be security object that was previous identified as malicious, no longer being identified as maiicious or no longer being associated with a malicious actor.
  • Indicator identifier 1 12 may identify an indicator that provides contextual information for the security object. Indicator identifier 1 12 may identify the indicator by analyzing the security object using, for example, meta-data of the security object, indicator identifier 1 12 may identify the indicator by retrieving information from a data source, such as a database, third party service, etc.
  • An "indicator,” as used herein, may refer to a detection guidance for a security threat and/or vulnerability.
  • the indicator may specify what to detect or look for (e.g., an observable) and/or what it means if detected. For example, the indicator may specify a certain Internet Protocol (IP) address to look for in the network traffic.
  • IP Internet Protocol
  • the indicator may include the information that the detection of that IP address in the network traffic can indicate a certain maiicious security threat such as a Trojan virus.
  • the indicator may provide context for the security objects. This context may include time stamps, a time period that the security object was active, severity scores, etc.
  • the indicator may belong to the same database and/or data model as the security object.
  • Linked resource determiner 1 14 may determine a linked resource that is associated with a database record of the security object. Linked resource determine 1 14 may, for example, query the database record of the security object and identify the linked resource that is linked or otherwise connected to the database record of the security object. In some aspects, linked resource determiner may determine ail linked resources that are associated with the database record of the security object. For example, a threat intelligence repository may use a database and/or data mode! including a broad range of data types. Each security object in the database and/or data model may be linked to other security objects and/or indicators based on various relationships. These relationships are discussed in further detail below, in reference to relationship determiner 1 18.
  • Security object threat score determiner 1 16 may determine a threat score associated with the security object.
  • Security object threat score determiner 1 16 may calculate a threat score associated with the security object and/or retrieve a previously determined threat score stored in, for example, a threat intelligence repository.
  • Security object threat score determiner 1 16 may also use a known technique for calculating threat scores, such as the technique presented in Application No. PCT/US2015/026585, entitled "Security indicator Scores,” and is herein incorporated by reference in its entirety.
  • the threat score may be represented numerically, such as a percentage, through words, such as different levels, etc.
  • the threat score may correspond to a severity of a perceived threat of a given security object, a confidence level of the severity, or an impact of the severity.
  • Relationship determiner 1 18 may determine a relationship between the linked resource (e.g., as discussed herein with respect to linked resource determiner 1 14) and the security object. Relationship determiner 1 18 may determine the relationship by analyzing a label describing the type of relationship, analyzing information reiated to the linked resource and/o security object retrieved from one or more data sources, such as a database record corresponding to the linked resource and/or security object, a third party data service, a web site, etc. The relationship may describe the extent of interaction between the linked resource and the security object. The relationship may contain information describing the type of relationship as well as the date when the relationship was determined.
  • Example relationships may include an "originates from source” label describing a relationship between a piece of threat intelligence and the contributor of the threat intelligence. Another example relationship is a "points to" level describing a relationship between a domain and an IP address. Another example relationship is a “command and control (C&C) server” describing a relationship between a domain name and a malware description. Yet another example relationship is a "has been associated with” label describing a relationship between an indicator and a threat actor. Another example relationship is a "collaborates with” label describing a relationship between two threat actors.
  • C&C command and control
  • Linked resource threat score determiner 120 may select a linked resource to determine a score for.
  • Linked resource threat score determiner 120 may determine certain conditions to contribute to the score computation.
  • the conditions may correspond to an indicator (e.g., as discussed herein with respect to indicator identifier 1 12), the relationship between the linked resource and the security object (e.g., as discussed herein with respect to relationship determiner 1 18), etc.
  • Conditions may also include a number of hops (i.e. path length) between the linked resource and another meta-object, a time variable, such as an acceptable time period for the information corresponding to the meta- objects. The time period may correspond to a recentness of the information.
  • Other conditions could include data linked to certain threat actors, such as botnets, countries, individuals, etc.
  • Linked resource threat score determiner 120 may determine meta-objects that fulfill the condition.
  • the meta-objects fulfilling the condition may be linked resources associated with a database record of the securit object.
  • Linked resource threat score determiner 120 may determine a threat score associated with the linked resource based on the indicator (e.g., as discussed herein with respect to indicator identifier 1 12), the threat score of the linked object (e.g., as discussed herein with respect to security object threat score determiner 1 16) and the relationship between the linked resource and the security object (e.g., as discussed herein with respect to relationship determiner 1 18).
  • linked resource threat score determiner 120 may compute an average severity score for each meta-object that fulfills the condition. As will discussed below with respect to influence adjuster 132, linked resource threat determiner 120 may adjust the weight of the average based on an influence. Linked resource threat score determiner 120 may determine a final threat score by computing the maximum of ail the averages for each node.
  • the 100 may determine a threat score for a security object (i.e. the linked resource) based on its relationships of other security objects and indicators in a threat intelligence repository, such as a database. Moreover, the components of the threat score determination system 100 may allow the threat scores to be updated based on a current status of the malicious activity of a given security object.
  • Threat score adjuster 122 may adjust a threat score, such as the threat score associated with a security object (e.g., as discussed herein with respect to security object threat score determiner 1 16) and/or a threat score associated with a linked resource (e.g., as discussed herein with respect to a linked resource threat score determiner 120).
  • the threat score may be adjusted by a variety of factors, including an external data source, historical security information, a time period, a linked level and an influence. Each of these will be discussed in further detail below.
  • Threat score adjuster 122 may adjust the threat score using the same techniques as discussed above in reference to the linked resource threat score determiner 120.
  • External data source retriever 124 may retrieve information from an external data source.
  • the information may be related to a security object, a linked resource, an indicator, etc.
  • the external data source may include a third party database, a subscription service, a publicly available database, a web page, etc.
  • the system 100 is not dependent solely on information internal to the database, but can enrich data based on information obtained from external sources, if the externa! web site has rated or scored the threat object under consideration, the threat score may be adjusted (e.g., as discussed herein with respect to the threat score adjuster 122).
  • Historical security information retriever 126 may retrieve historical security information.
  • the historical information may be received from a data source, such as a database, third party data source, website, etc.
  • the historical information may be related to a security object, a linked resource, an indicator, etc. and linked via a threat intelligence database.
  • Historical information may be more complete as it has been vetted by many iterations, and thus carries a higher confidence (represented, for example, by a confidence score).
  • the historical information may be used to adjust the threat score (e.g., as discussed herein with respect to the threat score adjuster 122).
  • time period determiner 128 may determine a time period for the historical information. The determined time period may also be compared to a threshold amount. If the determined time period is within the threshold amount, the historical information may be considered fresh, while if the determined time period is not within the threshold amount, the historical information may be considered stale.
  • the threshold period could be in seconds, minutes, days, months, years, etc. The time period may be used to adjust the threat score (e.g., as discussed herein with respect to the threat score adjuster 122).
  • the threat score adjuster 122 may consider the type of historical information in addition to the time period of the historical information when adjusting the threat score.
  • the type of historical information may include an IP address, a domain, a threat actor's Tactics, Techniques and Procedures (TTP), etc.
  • IP addresses and domains may be very easy to change, so the influence of this type of information may be lower over time.
  • TTP Techniques and Procedures
  • Influence is a representation of the importance of some information, influence is discussed in further detail below, in reference to influence adjuster 132.
  • Linked level determiner 130 may determine a linked level between two meta-objects.
  • a linked level is a number of links in a path between the two meta- objecfs.
  • Linked level determiner 130 may analyze the path between the two meta- objects and identify the number of the links between the two meta-objects.
  • the meta- objects may include linked resources, security objects, indicators, etc.
  • the linked level determiner 130 may determine a number of levels between the linked resource and the second linked resource.
  • the threat score of a meta-object may be based on the information it is linked to in the security database. For example a malware indicator may be connected to an actor.
  • meta-objects may have linked relationships that are more than one level deep.
  • the malware indicators may be connected to an actor, and the actor may, in turn, be connected to a documented case with a high seventy score in which similar malware was used. This is an example of considering influence along several links.
  • linked level determiner 130 may determine the linked level up to n links, where n is the length of the path. The linked level may be used to adjust the threat score (e.g., as discussed herein with respect to the threat score adjuster 122).
  • Influence adjuster 132 may adjust an influence.
  • an influence is a representation of the importance of some information. The influence can be represented numericai!y, alphabetically, etc.
  • Information based on meta- objects that are further away in terms of the number of links may affect the score less than information that is closer, influence adjuster 132 may adjust the influence by determining the number of links between two meta-objects and comparing the number of links to a threshold. For example, influence adjuster 132 may lower an influence of a first meta-object on a second meta-object when the number of levels between the meta-objects is more than 2 levels.
  • influence may also be used to adjust the threat score (e.g., as discussed herein with respect to the linked resource threat score adjuster 122).
  • Graph database presenter 134 may present various aspects of threat determination system 100 as a graph-database.
  • the graph database may include nodes and edges containing attributes.
  • the nodes may correspond to meta-objects, such as a security object, an indicator and a linked resource.
  • the attributes may correspond to key-value pairs.
  • the nodes and/or edges may be labeled with information that displays a role within the overall data structure. For example, nodes may be labeled as "Source name”, “Indicator”, “Threat Actor”, “Mitigation”, “Campaign”, “Attack,” “Target” and/or other components from a data model. Each label may capture a broad range of security and related data.
  • Attributes for an indicator may specify what type of indicator, a time stamp when the indicator was first and last seen and include scores for confidence, severity, authenticity, impact, etc.
  • the scores may be expressed numerically, alphabetically etc.
  • the links between the meta-objects may be represented by labeled edges.
  • the labeled edges may be labeled with various properties, including information describing relationships between the meta-objects (e.g., as discussed herein with respect to relationship determiner 1 18. Edges may also include a score representing the confidence strength of the linkage.
  • the scores may be expressed numerically, alphabetically etc. [0032]
  • the threat score may be determined via the graph database.
  • graph database presenter 134 may select a node to determine or update a score for.
  • Graph database presenter 134 may determine a type of node to contribute to the score computation. For example, a certain condition may be selected. Conditions may include how a number of hops (i.e. path length) between nodes, a minimum confidence score for the nodes and edges, including a time variable, such as an acceptable time period for the information corresponding to the nodes and edges. The time period may correspond to a recentness of the information. Other conditions could include data linked to certain threat actors, such as botnets, countries, individuals, etc.
  • Graph database presenter 134 may compute a set including ail of the nodes that fit the condition. The set may also include the paths between the nodes fitting the condition. Graph database presenter 134 may compute a weighted average of the severity score of each nodes on the path and/or adjust an influence of a node used in computing the weighted average. In some examples, a weight may be determined based on the path between the nodes. For example, the number of links between two nodes may be determined and compared to a threshold. Graph database presenter 134 may lower an influence of a first node on a node when the number of levels between the meta-objects is more than a threshold number of levels, for example 2 levels. Of course, this is only an example, and any number of levels may be used. Graph database presenter 134 may determine a threat score by computing the maximum of ail the weighted averages for each node.
  • Updates in the graph may also automatically trigger a re-computation of threat scores.
  • threat scores may be recomputed in regular time intervals, in some aspects, other tools may be used to implement the features of threat determination score determination system 100.
  • FIG. 2 is a flowchart of an example method 200 for threat score determination.
  • Method 200 may be described below as being executed or performed by a system, for example, system 100 of FIG. 1 , system 400 of FIG. 4 or system 500 of FIG. 5. Other suitable systems and/or computing devices may be used as well.
  • Method 200 may be implemented in the form of executable instructions stored on at least one machine-readable storage medium of the system and executed by at least one processor of the system.
  • method 200 may be implemented in the form of electronic circuitry (e.g., hardware).
  • at least one step of method 200 may be executed substantially concurrently or in a different order than shown in FIG. 2.
  • method 200 may include more or less steps than are shown in FIG. 2.
  • at least one of the steps of method 300 may, at certain times, be ongoing and/or may repeat.
  • Method 200 may start at step 202 and continue to step 204, where the method may include detecting a change in malicious activity for a security object.
  • the method may include identifying an indicator that provides contextual information for the security object.
  • the method may include determining a linked resource that is associated with a database record of the security object.
  • the method may include determining a first threat score associated with the security object.
  • the method may include determining a relationship between the linked resource and the security object.
  • the method may include determining a second threat score associated with the linked resource. The second threat score may be based on the indicator, the threat score of the linked object and the relationship between the linked resource and the security object.
  • Method 200 may eventually continue to step 216, where method 200 may stop.
  • FIG. 3 is a flowchart of an example method 300 for threat score adjustment.
  • Method 300 may be described below as being executed or performed by a system, for example, system 10(3 of FIG. 1 , system 400 of FIG. 4 or system 500 of FIG. 5. Other suitable systems and/or computing devices may be used as well.
  • Method 300 may be implemented in the form of executable instructions stored on at least one machine- readable storage medium of the system and executed by at least one processor of the system.
  • method 300 may be implemented in the form of electronic circuitry (e.g., hardware).
  • at least one step of method 300 may be executed substantially concurrently or in a different order than shown in FIG. 3.
  • method 3(30 may include more or less steps than are shown in FIG. 3.
  • at least one of the steps of method 300 may, at certain times, be ongoing and/or may repeat.
  • Method 300 may start at step 302 and continue to step 304, where the method may include retrieving information for the security object from an external data source.
  • the method may include determining all malicious linked resources that are associated with the database record of the security object.
  • the method may include retrieving historical security information for the security object.
  • the method may include determining a time period for the historical security information.
  • the method may include determining a date when the linked resource was determined.
  • the method may include determining a second linked resource that is associated with a second database record associated with the linked resource.
  • the method may include determining a number of links between the linked resource and the second linked resource.
  • the method may include adjusting a threat score associated with the security object.
  • the thread score may be adjusted based on: information retrieved from an external data source (e.g., as discussed herein with respect to step 304), a number of associated malicious linked resources (e.g., as discussed herein with respect to step 306), the historical security information (e.g., as discussed herein with respect to step 308), the time period (e.g., as discussed herein with respect to step 310), the date when the linked resource was identified as a linked resource (e.g., as discussed herein with respect to step 312), a number of links between the linked resource and the second linked resource (e.g., as discussed herein with respect to step 316).
  • Method 300 may eventually continue to step 320, where method 300 may stop.
  • FIG. 4 is a block diagram of an example threat score determination system 400.
  • System 400 may be similar to system 100 of FIG. 1 for example.
  • system 400 includes malicious activity determiner 402, time period identifier 404, security object threat score determiner 406, linked resource determiner 408 and linked resource threat score determiner 410.
  • Malicious activity determiner 402 may determine a change in malicious activity for a security object.
  • a security object may include IP addresses, domain names, domain servers, mutex (mutual exclusion), registry key data, behavior aspects of malware, email headers, etc.
  • Malicious activity determiner 402 may be implemented in the form of executable instructions stored on at least one machine-readable storage medium of system 400 and executed by at least one processor of system 400.
  • malicious activity determiner 402 may be implemented in the form of at least one hardware device including electronic circuitry for implementing the functionality of malicious activity determiner 402.
  • Time period identifier 404 may identify a time period of a change in malicious activity. The time period may be in seconds, minutes, hours, days, etc.
  • Time period identifier 404 may be implemented in the form of executable instructions stored on at least one machine-readable storage medium of system 400 and executed by at least one processor of system 400. Alternatively or in addition, time period identifier 404 may be implemented in the form of at least one hardware device including electronic circuitry for implementing the functionality of time period identifier 404.
  • Security object threat score determiner 406 may determine a first threat score associated with the security object.
  • Security object threat score determiner 406 may be implemented in the form of executable instructions stored on at least one machine-readable storage medium of system 400 and executed by at least one processor of system 400.
  • security object threat score determiner 406 may be implemented in the form of at least one hardware device including electronic circuitry for implementing the functionality of security object threat score determiner 406.
  • Linked resource determiner 408 may determine each linked resource in a security database that is associated with a database record of the security object.
  • Linked resource determiner 408 may be implemented in the form of executable instructions stored on at least one machine-readable storage medium of system 400 and executed by at least one processor of system 400.
  • linked resource determiner 408 may be implemented in the form of at least one hardware device including electronic circuitry for implementing the functionality of linked resource determiner.
  • Linked resource threat score determiner 410 may determine a threat score for each linked resource. The threat score may be based on a time period (e.g., as discussed herein with respect to the time period identifier 404), a first threat score (e.g., as discussed herein with respect to the security object threat score determiner 406), and a relationship between the linked resource and the security object.
  • Linked resource threat score determiner 410 may be implemented in the form of executable instructions stored on at least one machine-readable storage medium of system 400 and executed by at least one processor of system 400.
  • linked resource threat score determiner 410 may be implemented in the form of at least one hardware device including electronic circuitry for implementing the functionality of linked resource threat score determiner 410.
  • FIG. 5 is a block diagram of an example system 500 for threat score determination.
  • System 500 may be similar to system 100 of FIG. 1 , for example, in the example illustrated in FIG. 5, system 500 includes a processor 502 and a machine- readable storage medium 504.
  • processor 502 and a machine- readable storage medium 504.
  • the instructions may be distributed (e.g., stored) across multiple machine-readable storage mediums and the instructions may be distributed (e.g., executed by) across multiple processors.
  • Processor 502 may be one or more central processing units (CPUs), microprocessors, field programmable gate arrays (FPGAs) and/or other hardware devices suitable for retrieval and execution of instructions stored in machine-readable storage medium 504.
  • processor 502 may fetch, decode, and execute instructions 506, 508, 510, 512, 514, 516 and 518 to perform threat score determination.
  • processor 502 may include one or more electronic circuits comprising a number of electronic components for performing the functionality of at least one of the instructions in machine-readable storage medium 504.
  • executable instruction representations e.g., boxes
  • executable instructions and/or electronic circuits included within one box may, in alternate examples, be included in a different box shown in the figures or in a different box not shown.
  • Machine-readable storage medium 504 may be any electronic, magnetic, optical, or other physical storage device that stores executable instructions.
  • machine-readable storage medium 504 may be, for example, Random Access Memory (RAM), an Electrically-Erasable Programmable Read-Only Memory (EEPROM), a storage drive, an optical disc, and the like.
  • Machine-readable storage medium 504 may be disposed within system 500, as shown in FIG. 5. in this situation, the executable instructions may be "installed" on the system 500.
  • machine-readable storage medium 504 may be a portable, external or remote storage medium, for example, that allows system 500 to download the instructions from the portabie/external/remote storage medium. In this situation, the executable instructions may be part of an Installation package".
  • machine-readable storage medium 504 may be encoded with executable instructions for threat score determination.
  • malicious activity determine instructions 506 when executed by a processor (e.g., 502), may cause system 500 to determine a change in malicious activity for a security object
  • indicator identify instructions 508 when executed by a processor (e.g., 502), may cause system 500 to identify an indicator that provides contextual information for the security object.
  • Linked resources determine instructions 51 when executed by a processor (e.g., 502), may cause system 5(30 to determine a plurality of linked resources that are associated with a database record of the security object.
  • Relationship determine instructions 512 may determine, for each linked resource in the plurality, a relationship between the security object and the linked resource.
  • Linked resource threat score determine instructions 514 when executed by a processor (e.g., 502), may cause system 500 to determine a linked resource threat score for each linked resource in the plurality.
  • Number of linked resources determine instructions 516 when executed by a processor (e.g., 502), may cause system 500 to determine a number of linked resources in the plurality that are classified as malicious.
  • Security object threat score determine instructions 518 when executed by a processor (e.g., 502), may cause system 500 to determine a threat score associated with the security object based on the indicator, the relationship between the security object and each linked resource in the plurality and the number of linked resources in the plurality that are classified as malicious.
  • the foregoing disclosure describes a number of examples for threat score determination.
  • the disclosed examples may include systems, devices, computer- readable storage media, and methods for threat score determination.
  • certain examples are described with reference to the components illustrated in FIGS. 1 -5.
  • the functionality of the illustrated components may overlap, however, and may be present in a fewer or greater number of elements and components.
  • ail or part of the functionality of illustrated elements may co-exist or be distributed among several geographically dispersed locations.
  • the disclosed examples may be implemented in various environments and are not limited to the illustrated examples. [0052] Further, the sequence of operations described in connection with FIGS. 1 -

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Databases & Information Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • Data Mining & Analysis (AREA)
  • Computing Systems (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

In one example in accordance with the present disclosure, a method for threat score determination includes detecting a change in malicious activity for a security object. The method also includes identifying an indicator that provides contextual information for the security object and determining a linked resource that is associated with a database record of the security object. The method also includes determining a first threat score associated with the security object and determining a relationship between the linked resource and the security object. The method also includes determining a second threat score associated with the linked resource based on the indicator, the threat score of the linked object and the relationship between the linked resource and the security object.

Description

BACKGROUND
[0001 ] Systems may determine threat scores of certain items to prioritize among different pieces of threat intelligence and to decide which threat intelligence to act on. Computing accurate threat scores for severity, confidence or impact of threat intelligence may be important for using threat intelligence data effectively and at scale.
BREF DESCR!PTSO OF THE DRAWINGS
[0002] The following detailed description references the drawings, wherein:
[0003] FIG. 1 is a block diagram of an example system for threat score determination;
[0004] FIG. 2 is a flowchart of an example method for threat score determination;
[0005] FIG. 3 is a flowchart of an example method for threat score adjustment;
[00(36] FIG. 4 is a block diagram of an example system for threat score determination; and
[0007] FIG. 5 is a block diagram of an example system for threat score determination.
DETAILED DESCRIPTION
[0008] A variety of problems in the field of threat intelligence have provided challenges for assigning threat scores in an accurate, meaningful way. One problem in particular is the dynamic nature of cyber threats; a server that was malicious one day may no longer be malicious the next day, or vice versa. Accordingly, connections from IP address associated with the server may no longer pose a threat.
[0009] Example systems for threat score determination described herein determine threat scores based on known properties and scores of other objects to which these indicators are linked to in a database. In this manner, the example systems can determine precise and timely threat scores that accurately represent rapid changes in the threat landscape.
10010] For example, if a threat actor has been newly observed to utilize a known botnet for campaigns, the example systems for threat score determination may raise the severity scores of some or all of the indicators in a database that are directly linked to that botnet, such as C&C domains, maiware species used, etc. A similar technique may be applied when new links between objects in the database are discovered.
[001 1 ] A method for threat score determination may include detecting a change in malicious activity for a security object and identifying an indicator that provides contextual information for the security object. The method may include determining a linked resource that is associated with a database record of the security object and determining a first threat score associated with the security object. The method may also include determining a relationship between the linked resource and the security object and determining a second threat score associated with the linked resource based on the indicator, the threat score of the linked object and the relationship between the linked resource and the security object.
[0012] FIG. 1 is a block diagram of an example system 100 for threat score determination. In the example shown in FIG. 1 , system 100 may comprise various components, including a malicious activity detector 1 10, an indicator identifier 1 12, a linked resource determiner 1 14, a security object threat score determiner 1 16, a relationship determiner 1 18, a linked resource threat score determiner 120, a threat score adjuster 122, an external data source retriever 124, an historical security information retriever 126, a time period determiner 128, a linked level determiner 130, an influence adjuster 132, a graph database presenter 134 and/or other components. According to various implementations, threat score determination 100 may be implemented in hardware and/or a combination of hardware and programming that configures hardware. Furthermore, in FIG. 1 and other Figures described herein, different numbers of components or entities than depicted may be used. As is illustrated with respect to FIG. 5, the hardware of the various components of domain classification system 100, for example, may include one or both of a processor and a machine-readable storage medium, while the instructions are code stored on the machine-readable storage medium and executable by the processor to perform the designated function. [0013] Malicious activity detector 1 10 may detect a change in malicious activity for a security object. Malicious activity detector 1 10 may detect the change in malicious activity in a variety of ways. In one example, malicious activity detector 1 10 may detect the change by receiving information identifying the change. The information may be received from, for example, a third party database, in another example, malicious activity detector 1 10 may detect the change by comparing connections and relationships of the security object and comparing the connections/relationships to known malicious actors. The security object may be one or more objects belonging to a database and/or data model. The security object may correspond to one or more lower level observables, such as an IP address, a domain name, a domain server, a mutex (mutual exclusion) a registry key data, an email header, a behavioral aspect of malware, etc.
[0014] The change may be detected in real time or near real time. The change in maiicious activity may be a security object being identified as malicious or becoming associated with a malicious actor. The change in malicious activity may be security object that was previous identified as malicious, no longer being identified as maiicious or no longer being associated with a malicious actor.
[0015] Indicator identifier 1 12 may identify an indicator that provides contextual information for the security object. Indicator identifier 1 12 may identify the indicator by analyzing the security object using, for example, meta-data of the security object, indicator identifier 1 12 may identify the indicator by retrieving information from a data source, such as a database, third party service, etc. An "indicator," as used herein, may refer to a detection guidance for a security threat and/or vulnerability. The indicator may specify what to detect or look for (e.g., an observable) and/or what it means if detected. For example, the indicator may specify a certain Internet Protocol (IP) address to look for in the network traffic. The indicator may include the information that the detection of that IP address in the network traffic can indicate a certain maiicious security threat such as a Trojan virus. In other words, the indicator may provide context for the security objects. This context may include time stamps, a time period that the security object was active, severity scores, etc. The indicator may belong to the same database and/or data model as the security object.
[0016] Linked resource determiner 1 14 may determine a linked resource that is associated with a database record of the security object. Linked resource determine 1 14 may, for example, query the database record of the security object and identify the linked resource that is linked or otherwise connected to the database record of the security object. In some aspects, linked resource determiner may determine ail linked resources that are associated with the database record of the security object. For example, a threat intelligence repository may use a database and/or data mode! including a broad range of data types. Each security object in the database and/or data model may be linked to other security objects and/or indicators based on various relationships. These relationships are discussed in further detail below, in reference to relationship determiner 1 18.
[0017] Security object threat score determiner 1 16 may determine a threat score associated with the security object. Security object threat score determiner 1 16 may calculate a threat score associated with the security object and/or retrieve a previously determined threat score stored in, for example, a threat intelligence repository. Security object threat score determiner 1 16 may also use a known technique for calculating threat scores, such as the technique presented in Application No. PCT/US2015/026585, entitled "Security indicator Scores," and is herein incorporated by reference in its entirety. The threat score may be represented numerically, such as a percentage, through words, such as different levels, etc. The threat score may correspond to a severity of a perceived threat of a given security object, a confidence level of the severity, or an impact of the severity.
[0018] Relationship determiner 1 18 may determine a relationship between the linked resource (e.g., as discussed herein with respect to linked resource determiner 1 14) and the security object. Relationship determiner 1 18 may determine the relationship by analyzing a label describing the type of relationship, analyzing information reiated to the linked resource and/o security object retrieved from one or more data sources, such as a database record corresponding to the linked resource and/or security object, a third party data service, a web site, etc. The relationship may describe the extent of interaction between the linked resource and the security object. The relationship may contain information describing the type of relationship as well as the date when the relationship was determined. Example relationships may include an "originates from source" label describing a relationship between a piece of threat intelligence and the contributor of the threat intelligence. Another example relationship is a "points to" level describing a relationship between a domain and an IP address. Another example relationship is a "command and control (C&C) server" describing a relationship between a domain name and a malware description. Yet another example relationship is a "has been associated with" label describing a relationship between an indicator and a threat actor. Another example relationship is a "collaborates with" label describing a relationship between two threat actors.
[0019] Linked resource threat score determiner 120 may select a linked resource to determine a score for. Linked resource threat score determiner 120 may determine certain conditions to contribute to the score computation. The conditions may correspond to an indicator (e.g., as discussed herein with respect to indicator identifier 1 12), the relationship between the linked resource and the security object (e.g., as discussed herein with respect to relationship determiner 1 18), etc. Conditions may also include a number of hops (i.e. path length) between the linked resource and another meta-object, a time variable, such as an acceptable time period for the information corresponding to the meta- objects. The time period may correspond to a recentness of the information. Other conditions could include data linked to certain threat actors, such as botnets, countries, individuals, etc.
[0020] Linked resource threat score determiner 120 may determine meta-objects that fulfill the condition. The meta-objects fulfilling the condition may be linked resources associated with a database record of the securit object. Linked resource threat score determiner 120 may determine a threat score associated with the linked resource based on the indicator (e.g., as discussed herein with respect to indicator identifier 1 12), the threat score of the linked object (e.g., as discussed herein with respect to security object threat score determiner 1 16) and the relationship between the linked resource and the security object (e.g., as discussed herein with respect to relationship determiner 1 18).
[0021 ] For example, linked resource threat score determiner 120 may compute an average severity score for each meta-object that fulfills the condition. As will discussed below with respect to influence adjuster 132, linked resource threat determiner 120 may adjust the weight of the average based on an influence. Linked resource threat score determiner 120 may determine a final threat score by computing the maximum of ail the averages for each node.
[0022] In this manner, the components of the threat score determination system
100 may determine a threat score for a security object (i.e. the linked resource) based on its relationships of other security objects and indicators in a threat intelligence repository, such as a database. Moreover, the components of the threat score determination system 100 may allow the threat scores to be updated based on a current status of the malicious activity of a given security object.
[0023] Threat score adjuster 122 may adjust a threat score, such as the threat score associated with a security object (e.g., as discussed herein with respect to security object threat score determiner 1 16) and/or a threat score associated with a linked resource (e.g., as discussed herein with respect to a linked resource threat score determiner 120). The threat score may be adjusted by a variety of factors, including an external data source, historical security information, a time period, a linked level and an influence. Each of these will be discussed in further detail below. Threat score adjuster 122 may adjust the threat score using the same techniques as discussed above in reference to the linked resource threat score determiner 120.
[0024] External data source retriever 124 may retrieve information from an external data source. The information may be related to a security object, a linked resource, an indicator, etc. The external data source may include a third party database, a subscription service, a publicly available database, a web page, etc. In this manner, the system 100 is not dependent solely on information internal to the database, but can enrich data based on information obtained from external sources, if the externa! web site has rated or scored the threat object under consideration, the threat score may be adjusted (e.g., as discussed herein with respect to the threat score adjuster 122).
[0025] Historical security information retriever 126 may retrieve historical security information. The historical information may be received from a data source, such as a database, third party data source, website, etc. The historical information may be related to a security object, a linked resource, an indicator, etc. and linked via a threat intelligence database. Historical information may be more complete as it has been vetted by many iterations, and thus carries a higher confidence (represented, for example, by a confidence score). The historical information may be used to adjust the threat score (e.g., as discussed herein with respect to the threat score adjuster 122).
[0026] Historical information, however, may not necessarily contribute to a higher score if there is a high likelihood it is out of date. Accordingly, time period determiner 128 may determine a time period for the historical information. The determined time period may also be compared to a threshold amount. If the determined time period is within the threshold amount, the historical information may be considered fresh, while if the determined time period is not within the threshold amount, the historical information may be considered stale. The threshold period could be in seconds, minutes, days, months, years, etc. The time period may be used to adjust the threat score (e.g., as discussed herein with respect to the threat score adjuster 122).
[0027] Moreover, the threat score adjuster 122 may consider the type of historical information in addition to the time period of the historical information when adjusting the threat score. The type of historical information may include an IP address, a domain, a threat actor's Tactics, Techniques and Procedures (TTP), etc. For example, an attacker's IP addresses and domains may be very easy to change, so the influence of this type of information may be lower over time. In contrast, a threat actor's TTP may be much harder to change over time and thus may have a higher degree of influence even for extended time periods. Influence is a representation of the importance of some information, influence is discussed in further detail below, in reference to influence adjuster 132.
[0028] Linked level determiner 130 may determine a linked level between two meta-objects. A linked level is a number of links in a path between the two meta- objecfs. Linked level determiner 130 may analyze the path between the two meta- objects and identify the number of the links between the two meta-objects. The meta- objects may include linked resources, security objects, indicators, etc. For example, the linked level determiner 130 may determine a number of levels between the linked resource and the second linked resource. As described above with respect to the security object threat score determiner 1 16 and the linked resource threat score determiner 120, the threat score of a meta-object may be based on the information it is linked to in the security database. For example a malware indicator may be connected to an actor.
[0029] However, meta-objects may have linked relationships that are more than one level deep. Using the above example, the malware indicators may be connected to an actor, and the actor may, in turn, be connected to a documented case with a high seventy score in which similar malware was used. This is an example of considering influence along several links. Although the previous example uses influence of two links, linked level determiner 130 may determine the linked level up to n links, where n is the length of the path. The linked level may be used to adjust the threat score (e.g., as discussed herein with respect to the threat score adjuster 122).
[0030] Influence adjuster 132 may adjust an influence. As used herein, an influence is a representation of the importance of some information. The influence can be represented numericai!y, alphabetically, etc. Information based on meta- objects that are further away in terms of the number of links (i.e. the length of the path) may affect the score less than information that is closer, influence adjuster 132 may adjust the influence by determining the number of links between two meta-objects and comparing the number of links to a threshold. For example, influence adjuster 132 may lower an influence of a first meta-object on a second meta-object when the number of levels between the meta-objects is more than 2 levels. Of course, this is only an example, and any number of levels may be used, influence may also be used to adjust the threat score (e.g., as discussed herein with respect to the linked resource threat score adjuster 122).
[0031 ] Graph database presenter 134 may present various aspects of threat determination system 100 as a graph-database. The graph database may include nodes and edges containing attributes. The nodes may correspond to meta-objects, such as a security object, an indicator and a linked resource. The attributes may correspond to key-value pairs. The nodes and/or edges may be labeled with information that displays a role within the overall data structure. For example, nodes may be labeled as "Source name", "Indicator", "Threat Actor", "Mitigation", "Campaign", "Attack," "Target" and/or other components from a data model. Each label may capture a broad range of security and related data. Attributes for an indicator may specify what type of indicator, a time stamp when the indicator was first and last seen and include scores for confidence, severity, authenticity, impact, etc. The scores may be expressed numerically, alphabetically etc. The links between the meta-objects (represented in the graph database by the nodes) may be represented by labeled edges. The labeled edges may be labeled with various properties, including information describing relationships between the meta-objects (e.g., as discussed herein with respect to relationship determiner 1 18. Edges may also include a score representing the confidence strength of the linkage. The scores may be expressed numerically, alphabetically etc. [0032] In some examples, the threat score may be determined via the graph database. Specifically, graph database presenter 134 may select a node to determine or update a score for. Graph database presenter 134 may determine a type of node to contribute to the score computation. For example, a certain condition may be selected. Conditions may include how a number of hops (i.e. path length) between nodes, a minimum confidence score for the nodes and edges, including a time variable, such as an acceptable time period for the information corresponding to the nodes and edges. The time period may correspond to a recentness of the information. Other conditions could include data linked to certain threat actors, such as botnets, countries, individuals, etc.
[0033] Graph database presenter 134 may compute a set including ail of the nodes that fit the condition. The set may also include the paths between the nodes fitting the condition. Graph database presenter 134 may compute a weighted average of the severity score of each nodes on the path and/or adjust an influence of a node used in computing the weighted average. In some examples, a weight may be determined based on the path between the nodes. For example, the number of links between two nodes may be determined and compared to a threshold. Graph database presenter 134 may lower an influence of a first node on a node when the number of levels between the meta-objects is more than a threshold number of levels, for example 2 levels. Of course, this is only an example, and any number of levels may be used. Graph database presenter 134 may determine a threat score by computing the maximum of ail the weighted averages for each node.
[0034] Updates in the graph may also automatically trigger a re-computation of threat scores. Alternatively, threat scores may be recomputed in regular time intervals, in some aspects, other tools may be used to implement the features of threat determination score determination system 100.
[0035] FIG. 2 is a flowchart of an example method 200 for threat score determination. Method 200 may be described below as being executed or performed by a system, for example, system 100 of FIG. 1 , system 400 of FIG. 4 or system 500 of FIG. 5. Other suitable systems and/or computing devices may be used as well. Method 200 may be implemented in the form of executable instructions stored on at least one machine-readable storage medium of the system and executed by at least one processor of the system. Alternatively or in addition, method 200 may be implemented in the form of electronic circuitry (e.g., hardware). In alternate examples of the present disclosure, at least one step of method 200 may be executed substantially concurrently or in a different order than shown in FIG. 2. In alternate examples of the present disclosure, method 200 may include more or less steps than are shown in FIG. 2. In some examples, at least one of the steps of method 300 may, at certain times, be ongoing and/or may repeat.
[0036] Method 200 may start at step 202 and continue to step 204, where the method may include detecting a change in malicious activity for a security object. At step 206, the method may include identifying an indicator that provides contextual information for the security object. At step 208, the method may include determining a linked resource that is associated with a database record of the security object. At step 210, the method may include determining a first threat score associated with the security object. At step 212, the method may include determining a relationship between the linked resource and the security object. At step 214, the method may include determining a second threat score associated with the linked resource. The second threat score may be based on the indicator, the threat score of the linked object and the relationship between the linked resource and the security object. Method 200 may eventually continue to step 216, where method 200 may stop.
[0037] FIG. 3 is a flowchart of an example method 300 for threat score adjustment. Method 300 may be described below as being executed or performed by a system, for example, system 10(3 of FIG. 1 , system 400 of FIG. 4 or system 500 of FIG. 5. Other suitable systems and/or computing devices may be used as well. Method 300 may be implemented in the form of executable instructions stored on at least one machine- readable storage medium of the system and executed by at least one processor of the system. Alternatively or in addition, method 300 may be implemented in the form of electronic circuitry (e.g., hardware). In alternate examples of the present disclosure, at least one step of method 300 may be executed substantially concurrently or in a different order than shown in FIG. 3. in alternate examples of the present disclosure, method 3(30 may include more or less steps than are shown in FIG. 3. In some examples, at least one of the steps of method 300 may, at certain times, be ongoing and/or may repeat.
[0038] Method 300 may start at step 302 and continue to step 304, where the method may include retrieving information for the security object from an external data source. At step 306, the method may include determining all malicious linked resources that are associated with the database record of the security object. At step 308, the method may include retrieving historical security information for the security object. At step 310, the method may include determining a time period for the historical security information. At step 312, the method may include determining a date when the linked resource was determined. At step 314, the method may include determining a second linked resource that is associated with a second database record associated with the linked resource. At step 316, the method may include determining a number of links between the linked resource and the second linked resource.
[0039] At step 318, the method may include adjusting a threat score associated with the security object. The thread score may be adjusted based on: information retrieved from an external data source (e.g., as discussed herein with respect to step 304), a number of associated malicious linked resources (e.g., as discussed herein with respect to step 306), the historical security information (e.g., as discussed herein with respect to step 308), the time period (e.g., as discussed herein with respect to step 310), the date when the linked resource was identified as a linked resource (e.g., as discussed herein with respect to step 312), a number of links between the linked resource and the second linked resource (e.g., as discussed herein with respect to step 316). Method 300 may eventually continue to step 320, where method 300 may stop.
[0040] FIG. 4 is a block diagram of an example threat score determination system 400. System 400 may be similar to system 100 of FIG. 1 for example. In FIG. 4, system 400 includes malicious activity determiner 402, time period identifier 404, security object threat score determiner 406, linked resource determiner 408 and linked resource threat score determiner 410.
[0041 ] Malicious activity determiner 402 may determine a change in malicious activity for a security object. A security object may include IP addresses, domain names, domain servers, mutex (mutual exclusion), registry key data, behavior aspects of malware, email headers, etc. Malicious activity determiner 402 may be implemented in the form of executable instructions stored on at least one machine-readable storage medium of system 400 and executed by at least one processor of system 400. Alternatively or in addition, malicious activity determiner 402 may be implemented in the form of at least one hardware device including electronic circuitry for implementing the functionality of malicious activity determiner 402. [0042] Time period identifier 404 may identify a time period of a change in malicious activity. The time period may be in seconds, minutes, hours, days, etc. Time period identifier 404 may be implemented in the form of executable instructions stored on at least one machine-readable storage medium of system 400 and executed by at least one processor of system 400. Alternatively or in addition, time period identifier 404 may be implemented in the form of at least one hardware device including electronic circuitry for implementing the functionality of time period identifier 404.
[0043] Security object threat score determiner 406 may determine a first threat score associated with the security object. Security object threat score determiner 406 may be implemented in the form of executable instructions stored on at least one machine-readable storage medium of system 400 and executed by at least one processor of system 400. Alternatively or in addition, security object threat score determiner 406 may be implemented in the form of at least one hardware device including electronic circuitry for implementing the functionality of security object threat score determiner 406.
[0044] Linked resource determiner 408 may determine each linked resource in a security database that is associated with a database record of the security object. Linked resource determiner 408 may be implemented in the form of executable instructions stored on at least one machine-readable storage medium of system 400 and executed by at least one processor of system 400. Alternatively or in addition, linked resource determiner 408 may be implemented in the form of at least one hardware device including electronic circuitry for implementing the functionality of linked resource determiner.
10045] Linked resource threat score determiner 410 may determine a threat score for each linked resource. The threat score may be based on a time period (e.g., as discussed herein with respect to the time period identifier 404), a first threat score (e.g., as discussed herein with respect to the security object threat score determiner 406), and a relationship between the linked resource and the security object. Linked resource threat score determiner 410 may be implemented in the form of executable instructions stored on at least one machine-readable storage medium of system 400 and executed by at least one processor of system 400. Alternatively or in addition, linked resource threat score determiner 410 may be implemented in the form of at least one hardware device including electronic circuitry for implementing the functionality of linked resource threat score determiner 410.
[0046] FIG. 5 is a block diagram of an example system 500 for threat score determination. System 500 may be similar to system 100 of FIG. 1 , for example, in the example illustrated in FIG. 5, system 500 includes a processor 502 and a machine- readable storage medium 504. Although the following descriptions refer to a single processor and a single machine-readable storage medium, the descriptions may also apply to a system with multiple processors and multiple machine-readable storage mediums. In such examples, the instructions may be distributed (e.g., stored) across multiple machine-readable storage mediums and the instructions may be distributed (e.g., executed by) across multiple processors.
[0047] Processor 502 may be one or more central processing units (CPUs), microprocessors, field programmable gate arrays (FPGAs) and/or other hardware devices suitable for retrieval and execution of instructions stored in machine-readable storage medium 504. In the example illustrated in FIG. 5, processor 502 may fetch, decode, and execute instructions 506, 508, 510, 512, 514, 516 and 518 to perform threat score determination. As an alternative or in addition to retrieving and executing instructions, processor 502 may include one or more electronic circuits comprising a number of electronic components for performing the functionality of at least one of the instructions in machine-readable storage medium 504. With respect to the executable instruction representations (e.g., boxes) described and shown herein, it should be understood that part or all of the executable instructions and/or electronic circuits included within one box may, in alternate examples, be included in a different box shown in the figures or in a different box not shown.
[0048] Machine-readable storage medium 504 may be any electronic, magnetic, optical, or other physical storage device that stores executable instructions. Thus, machine-readable storage medium 504 may be, for example, Random Access Memory (RAM), an Electrically-Erasable Programmable Read-Only Memory (EEPROM), a storage drive, an optical disc, and the like. Machine-readable storage medium 504 may be disposed within system 500, as shown in FIG. 5. in this situation, the executable instructions may be "installed" on the system 500. Alternatively, machine-readable storage medium 504 may be a portable, external or remote storage medium, for example, that allows system 500 to download the instructions from the portabie/external/remote storage medium. In this situation, the executable instructions may be part of an Installation package". As described herein, machine-readable storage medium 504 may be encoded with executable instructions for threat score determination.
[0049] Referring to FIG. 5, malicious activity determine instructions 506, when executed by a processor (e.g., 502), may cause system 500 to determine a change in malicious activity for a security object, indicator identify instructions 508, when executed by a processor (e.g., 502), may cause system 500 to identify an indicator that provides contextual information for the security object. Linked resources determine instructions 51 (3, when executed by a processor (e.g., 502), may cause system 5(30 to determine a plurality of linked resources that are associated with a database record of the security object.
[0050] Relationship determine instructions 512 may determine, for each linked resource in the plurality, a relationship between the security object and the linked resource. Linked resource threat score determine instructions 514, when executed by a processor (e.g., 502), may cause system 500 to determine a linked resource threat score for each linked resource in the plurality. Number of linked resources determine instructions 516, when executed by a processor (e.g., 502), may cause system 500 to determine a number of linked resources in the plurality that are classified as malicious. Security object threat score determine instructions 518, when executed by a processor (e.g., 502), may cause system 500 to determine a threat score associated with the security object based on the indicator, the relationship between the security object and each linked resource in the plurality and the number of linked resources in the plurality that are classified as malicious.
[0051 ] The foregoing disclosure describes a number of examples for threat score determination. The disclosed examples may include systems, devices, computer- readable storage media, and methods for threat score determination. For purposes of explanation, certain examples are described with reference to the components illustrated in FIGS. 1 -5. The functionality of the illustrated components may overlap, however, and may be present in a fewer or greater number of elements and components. Further, ail or part of the functionality of illustrated elements may co-exist or be distributed among several geographically dispersed locations. Further, the disclosed examples may be implemented in various environments and are not limited to the illustrated examples. [0052] Further, the sequence of operations described in connection with FIGS. 1 -
5 are examples and are not intended to be limiting. Additional or fewer operations or combinations of operations may be used or may vary without departing from the scope of the disclosed examples. Furthermore, implementations consistent with the disclosed examples need not perform the sequence of operations in any particular order. Thus, the present disclosure merely sets forth possible examples of implementations, and many variations and modifications may be made to the described examples.

Claims

1 . A method for threat score determination, the method comprising:
detecting a change in malicious activity for a security object;
identifying an indicator that provides contextual information for the security object;
determining a linked resource that is associated with a database record of the security object;
determining a first threat score associated with the security object;
determining a relationship between the linked resource and the security object; and
determining a second threat score associated with the linked resource based on the indicator, the threat score of the linked object and the relationship between the linked resource and the security object.
2. The method of claim 1 further comprising:
determining ail linked resources that are associated with the database record of the security object; and
adjusting a threat score for each linked resource based on the indicator, the threat score of the linked object and the relationship between the security indicator and the linked object.
3. The method of claim 1 further comprising:
retrieving information for the security object from an external data source; and adjusting the first threat score associated with the security object based on the information for the security object retrieved from the external data source.
4. The method of claim 1 further comprising:
determining ail malicious linked resources that are associated with the database record of the security object; and
adjusting the threat score for the linked database record based on the number of associated malicious linked resources.
5. The method of claim 1 further comprising: retrieving historical security information for the security object;
determining a time period for the historical security information; and adjusting the threat score based on the historical security information and the time period.
6. The method of claim 1 further comprising:
determining a date when the linked resource was determined; and determining a threat score associated with the linked resource based on the date when the linked resource was identified as a linked resource,
7. The method of claim 1 further comprising:
determining a second linked resource that is associated with a second database record associated with the linked resource.
8. The method of claim 7 further comprising:
determining a number of links between the linked resource and the second linked resource; and
adjusting an influence based on the number of links, wherein the influence is lower for information when the number of levels is lower.
9. The method of claim 1 wherein the threat score is determined via a graph database and wherein the security object, the indicator and linked resource are represented by nodes on a graph and links between the linked resources are represented by labeled edges.
10. A system for threat score determination comprising:
a malicious activity determiner to determine a change in malicious activity for a security object;
a time period identifier to identify a time period of the change;
a security object threat score determiner to determine a first threat score associated with the security object;
a linked resource determiner to determine each linked resource in a security database that is associated with a database record of the security object; and a linked resource threat score determiner to determine, for each linked resource, a threat score based on the time period, the first threat score, and a relationship between the linked resource and the security object.
1 1 . The system of claim 10 further comprising:
a linked level determiner to determine a number of links between the linked resource and a second linked resource; and
an influence adjuster to adjust an influence of the second linked resource based on the number of links, wherein the influence is lower for information when the number of levels is lower.
12. The system of claim 10 further comprising:
a time period determiner to determine a date when each linked resource was determined; and
a threat score adjuster to adjust the threat score associated with the linked resource based on the date.
13. A non-transitory machine-readable storage medium comprising instructions executable by a processor of a computing device for threat score determination, the machine-readable storage medium comprising instructions to:
determine a change in malicious activity for a security object;
identify an indicator that provides contextual information for the security object;
determine a plurality of linked resources that are associated with a database record of the security object;
determine, for each linked resource in the plurality, a relationship between the security object and the linked resource;
determine a linked resource threat score for each linked resource in the plurality;
determine a number of linked resources in the plurality that are classified as malicious; and
determine a threat score associated with the security object based on the indicator, the relationship between the security object and each linked resource in the plurality and the number of linked resources in the plurality that are classified as malicious.
14. The non-transitory machine-readable storage medium of claim 13 further comprising instructions to:
determine each malicious linked resource that is associated with the database record of the security object; and
determine a confidence score for the linked database record based on the number of associated malicious linked resources
15. The non-transitory machine-readable storage medium of claim 13 further comprising instructions to
determine all linked resources that are associated with the database record of the security object; and
adjust a threat score for each linked resource based on the indicator, the threat score of the linked object and a relationship between the security indicator and the linked resource.
PCT/US2015/052650 2015-09-28 2015-09-28 Threat score determination Ceased WO2017058142A1 (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/US2015/052650 WO2017058142A1 (en) 2015-09-28 2015-09-28 Threat score determination
US15/763,253 US10896259B2 (en) 2015-09-28 2015-09-28 Threat score determination

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/US2015/052650 WO2017058142A1 (en) 2015-09-28 2015-09-28 Threat score determination

Publications (1)

Publication Number Publication Date
WO2017058142A1 true WO2017058142A1 (en) 2017-04-06

Family

ID=58424220

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/US2015/052650 Ceased WO2017058142A1 (en) 2015-09-28 2015-09-28 Threat score determination

Country Status (2)

Country Link
US (1) US10896259B2 (en)
WO (1) WO2017058142A1 (en)

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10902114B1 (en) * 2015-09-09 2021-01-26 ThreatQuotient, Inc. Automated cybersecurity threat detection with aggregation and analysis
US10192058B1 (en) * 2016-01-22 2019-01-29 Symantec Corporation System and method for determining an aggregate threat score
US10902124B2 (en) 2017-09-15 2021-01-26 Webroot Inc. Real-time JavaScript classifier
US11431745B2 (en) * 2018-04-30 2022-08-30 Microsoft Technology Licensing, Llc Techniques for curating threat intelligence data
US11201890B1 (en) 2019-03-29 2021-12-14 Mandiant, Inc. System and method for adaptive graphical depiction and selective remediation of cybersecurity threats
US11194905B2 (en) * 2019-04-09 2021-12-07 International Business Machines Corporation Affectedness scoring engine for cyber threat intelligence services
US11843513B2 (en) 2020-02-24 2023-12-12 Google Llc Heterogeneous graph clustering using a pointwise mutual information criterion
JPWO2024127749A1 (en) * 2022-12-13 2024-06-20

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2012167056A2 (en) * 2011-06-01 2012-12-06 Mcafee, Inc. System and method for non-signature based detection of malicious processes
US20130125239A1 (en) * 2010-01-26 2013-05-16 Bank Of America Corporation Insider threat correlation tool
US20130247205A1 (en) * 2010-07-14 2013-09-19 Mcafee, Inc. Calculating quantitative asset risk
US20140137257A1 (en) * 2012-11-12 2014-05-15 Board Of Regents, The University Of Texas System System, Method and Apparatus for Assessing a Risk of One or More Assets Within an Operational Technology Infrastructure
US20140283055A1 (en) * 2013-03-15 2014-09-18 Pinkerton Consulting And Investigations, Inc. Providing alerts based on unstructured information methods and apparatus

Family Cites Families (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060064740A1 (en) 2004-09-22 2006-03-23 International Business Machines Corporation Network threat risk assessment tool
WO2006071985A2 (en) 2004-12-29 2006-07-06 Alert Logic, Inc. Threat scoring system and method for intrusion detection security networks
US8863288B1 (en) 2011-12-30 2014-10-14 Mantech Advanced Systems International, Inc. Detecting malicious software
US8661538B2 (en) * 2012-05-09 2014-02-25 Nice-Systems Ltd. System and method for determining a risk root cause
US8813228B2 (en) 2012-06-29 2014-08-19 Deloitte Development Llc Collective threat intelligence gathering system
US8813236B1 (en) 2013-01-07 2014-08-19 Narus, Inc. Detecting malicious endpoints using network connectivity and flow information
US10686819B2 (en) 2013-02-19 2020-06-16 Proofpoint, Inc. Hierarchical risk assessment and remediation of threats in mobile networking environment
WO2014138115A1 (en) 2013-03-05 2014-09-12 Pierce Global Threat Intelligence, Inc Systems and methods for detecting and preventing cyber-threats
US9324119B2 (en) 2013-03-15 2016-04-26 Alert Enterprise Identity and asset risk score intelligence and threat mitigation
EP3053074A4 (en) 2013-09-30 2017-04-05 Hewlett-Packard Enterprise Development LP Hierarchical threat intelligence
US20150278729A1 (en) * 2014-03-28 2015-10-01 International Business Machines Corporation Cognitive scoring of asset risk based on predictive propagation of security-related events
US9210185B1 (en) * 2014-12-05 2015-12-08 Lookingglass Cyber Solutions, Inc. Cyber threat monitor and control apparatuses, methods and systems
US9100430B1 (en) * 2014-12-29 2015-08-04 Palantir Technologies Inc. Systems for network risk assessment including processing of user access rights associated with a network of devices
US9578042B2 (en) * 2015-03-06 2017-02-21 International Business Machines Corporation Identifying malicious web infrastructures

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130125239A1 (en) * 2010-01-26 2013-05-16 Bank Of America Corporation Insider threat correlation tool
US20130247205A1 (en) * 2010-07-14 2013-09-19 Mcafee, Inc. Calculating quantitative asset risk
WO2012167056A2 (en) * 2011-06-01 2012-12-06 Mcafee, Inc. System and method for non-signature based detection of malicious processes
US20140137257A1 (en) * 2012-11-12 2014-05-15 Board Of Regents, The University Of Texas System System, Method and Apparatus for Assessing a Risk of One or More Assets Within an Operational Technology Infrastructure
US20140283055A1 (en) * 2013-03-15 2014-09-18 Pinkerton Consulting And Investigations, Inc. Providing alerts based on unstructured information methods and apparatus

Also Published As

Publication number Publication date
US10896259B2 (en) 2021-01-19
US20180314834A1 (en) 2018-11-01

Similar Documents

Publication Publication Date Title
US10896259B2 (en) Threat score determination
US11388198B2 (en) Collaborative database and reputation management in adversarial information environments
US12495076B2 (en) System and method for internet activity and health forecasting and internet noise analysis
US10574681B2 (en) Detection of known and unknown malicious domains
US20190065738A1 (en) Detecting anomalous entities
US10686759B2 (en) Network threat prediction and blocking
US10262132B2 (en) Model-based computer attack analytics orchestration
US11968239B2 (en) System and method for detection and mitigation of data source compromises in adversarial information environments
US20160226893A1 (en) Methods for optimizing an automated determination in real-time of a risk rating of cyber-attack and devices thereof
US11070572B2 (en) Methods, systems, articles of manufacture and apparatus for producing generic IP reputation through cross-protocol analysis
CN110677380A (en) Network threat indicator extraction and response
US11470110B2 (en) Identifying and classifying community attacks
US10425436B2 (en) Identifying bulletproof autonomous systems
CN113711559B (en) Systems and methods for detecting anomalies
US20190050563A1 (en) Visualization of associations among data records in a security information sharing platform
Nguyen et al. DGA botnet detection using collaborative filtering and density-based clustering
CN105141573A (en) Security protection method and security protection system based on WEB access compliance auditing
Sree et al. HADM: detection of HTTP GET flooding attacks by using Analytical hierarchical process and Dempster–Shafer theory with MapReduce
Ali et al. Firewall policy reconnaissance: Techniques and analysis
Laštovička et al. Situational awareness: Detecting critical dependencies and devices in a network
US20190028516A1 (en) Strength of associations among data records in a security information sharing platform
US10242318B2 (en) System and method for hierarchical and chained internet security analysis
US20230269267A1 (en) Systems and methods for external detection of misconfigured systems
US20170318100A1 (en) Smart location determination
Li et al. Detection of variations of local irregularity of traffic under DDOS flood attack

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15905538

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 15763253

Country of ref document: US

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15905538

Country of ref document: EP

Kind code of ref document: A1