Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
  • H04L41/06—Management of faults, events, alarms or notifications
  • H04L41/0604—Management of faults, events, alarms or notifications using filtering, e.g. reduction of information by using priority, element types, position or time
  • H04L41/0609—Management of faults, events, alarms or notifications using filtering, e.g. reduction of information by using priority, element types, position or time based on severity or priority
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
  • H04L41/12—Discovery or management of network topologies
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/40—Network security protocols

Definitions

• the present invention relates to computer and network security and, more particularly, to integrated discovery of node community and role in such networks.
• Enterprise networks are key systems in corporations and they carry the vast majority of mission-critical information. As a result of their importance, these networks are often the targets of attack. Communications on enterprise networks are therefore frequently monitored and analyzed to detect anomalous network communication as a step toward detecting attacks.
• Multiple detectors are used in enterprise networks to monitor the computers and other devices. These detectors generate different kinds of alerts based on the monitoring data. However, different detectors may generate reports with different semantics. For example, network detectors monitor the topology of network connections and generate alerts if a suspicious client connects to a stable server. Process-file detectors generate alerts if an unseen process access a sensitive file. Managing these heterogeneous alerts is a challenge. [0005] Furthermore, a real security incident is likely to cause multiple alerts across different detectors. However, the alerts may not be reported at the same time or by the same host, representing temporal and spatial differences.
• a method for reporting anomalous events includes intra-host clustering a set of alerts based on a process graph that models states of process-level events in a network.
• Hidden relationship clustering is performed on the intra-host clustered alerts based on hidden relationships between alerts in respective clusters.
• Inter-host clustering is performed on the hidden relationship clustered alerts based on a topology graph that models source and destination relationships between connection events in the network. Inter-host clustered alerts that exceed a threshold level of trustworthiness are reported.
• a system for reporting anomalous events includes a clustering module having a processor configured to perform intra-host clustering on a set of alerts based on a process graph that models states of process-level events in a network, to perform hidden relationship clustering on the intra-host clustered alerts based on hidden relationships between alerts in respective clusters, and to perform inter-host clustering on the hidden relationship clustered alerts based on a topology graph that models source and destination relationships between connection events in the network.
• a user interface is configured to report inter-host clustered alerts that exceed a threshold level of trustworthiness.
• FIG. 1 is a block/flow diagram directed to an automatic security intelligence system architecture in accordance with the present principles
• FIG. 2 is a block/flow diagram directed to an intrusion detection engine architecture in accordance with the present principles
• FIG. 3 is a block/flow diagram directed to a network analysis module architecture
• FIG. 4 is a block/flow diagram of a method of building a topology blue print graph in accordance with one embodiment of the present invention
• FIG. 5 is a block/flow diagram of a method of building a process blue print graph in accordance with one embodiment of the present invention
• FIG. 6 is a block/flow diagram of a method of clustering alerts in accordance with one embodiment of the present invention.
• FIG. 7 is a block/flow diagram of a method of intra-host alert clustering in accordance with one embodiment of the present invention.
• FIG. 8 is a block/flow diagram of a method of discovering hidden relationships between alerts in accordance with one embodiment of the present invention.
• FIG. 9 is a block/flow diagram of a method of inter-host alert clustering in accordance with one embodiment of the present invention.
• FIG. 10 is a block/flow diagram of a method for computing the trustworthiness of a cluster of alerts in accordance with one embodiment of the present invention.
• FIG. 11 is a block diagram of a network analysis system in accordance with one embodiment of the present invention.
• FIG. 12 is a block diagram of a processing system in accordance with one embodiment of the present invention.
• the present embodiments detect provide alert fusion and management using a graph-based alert fusion engine that integrates alerts in a large security system.
• the present embodiments employ a blue print graph model that includes two kinds of blue print graphs: a topology graph records the network connection state among hosts in an enterprise and a process graph records the relationship between a process and its objects (e.g., files, another process, or an internet socket). Both graphs are constructed via streaming data and are maintained dynamically.
• the present embodiments attempt to cluster the new alert with existing recent alerts based on the blue print graph information.
• the present embodiments compute a trustworthiness score for each alert and ranks the alerts based on the score. The present embodiments then filter out false alerts and perform a security management action responsive to the reports.
• the present embodiments thereby integrate heterogeneous alerts, having different semantics and coming from different kinds of detectors, in real time and can be operated without any pre-defined models or training data sets. Alerts are integrated in a streaming fashion, with alerts being categorized and assessed as they arrive. The present embodiments also reduce the false alert rate and increase the accuracy in intrusion/anomaly detection tasks.
• an automatic security intelligence system (ASI) architecture is shown.
• the ASI system includes three major components: an agent 10 is installed in each machine of an enterprise network to collect operational data; backend servers 200 receive data from the agents 10, pre-process the data, and sends the pre-processed data to an analysis server 30; and an analysis server 30 that runs the security application program to analyze the data.
• Each agent 10 includes an agent manager 11, an agent updater 12, and agent data 13, which in turn may include information regarding active processes, file access, net sockets, number of instructions per cycle, and host information.
• the backend server 20 includes an agent updater server 21 and surveillance data storage.
• Analysis server 30 includes intrusion detection 31, security policy compliance assessment 32, incident backtrack and system recovery 33, and centralized threat search and query 34.
• intrusion detection 31 There are five modules in an intrusion detection engine: a data distributor 41 that receives the data from backend server 20 and distributes the corresponding to network level module 42 and host level module 43; network analysis module 42 that processes the network communications (including TCP and UDP) and detects abnormal communication events; host level analysis module 43 that processes host level events, including user-to-process events, process-to-file events, and user-to-registry events; online alert fusion module 44 that integrates network level anomalies and host level anomalies and refines the results for trustworthy intrusion events; and visualization module 45 that outputs the detection results to end users.
• a data distributor 41 that receives the data from backend server 20 and distributes the corresponding to network level module 42 and host level module 43
• network analysis module 42 that processes the network communications (including TCP and UDP) and detects abnormal communication events
• host level analysis module 43 that processes host level events, including user-to-process events, process-to-file events, and user-to-registry events
• online alert fusion module 44 that integrates
• the network analysis module 42 includes at least two major components: a blue print graphs 52 that are heterogeneous graphs constructed from streaming events 51 of the communications in the enterprise network, with the nodes of the graph representing machines on the enterprise network and edges representing the normal communication patterns among the nodes; and an online alert fusion and ranking module 54 that takes alerts from a variety of heterogeneous sources input, conducts analysis based on the blueprint graphs, and outputs trustworthy alert reports.
• the blue print graphs 52 include, in particular, a topology graph and a process graph.
• the topology graph may also be used by network analysis module 42 for online anomaly detection.
• ASI agents 10 are installed on the hosts of the enterprise network and collect all network connection events for analysis by the analytic server 30.
• the agent 10 may be a lightweight piece of software to reduce the workload and maintain privacy, such that the agent 10 does not collect information on the content and traffic size of network connections.
• src-ip and src-port refer to the IP address and port of the source host for a network event
• dst-ip and dst-port refer to the IP address and port of the destination host
• connecting-process is the process that initializes the connection
• protocol-num indicates the protocol of the connection
• timestamp records the connection time.
• Table 1 shows an exemplary list of network event samples from a period of time beginning at 11 :30AM and ending at 12:05PM on February 29, 2016.
• the network events can be classified into two categories based on the dst-ip. If the dst-ip is in the range of the local network's IP addresses (e.g., 10.15.xx.xx), then the network event can be considered an inside connection between two hosts of the network. If the dst-ip is not in the network's range, it can be considered an outside connection between an internal host and an external host.
• e ⁇ , e 3 , e 5 , and e 6 are inside connections and e 2 and e 4 are outside connections.
• the dst-ip values of the outside connections can be very diverse, but the dst-ip values of inside connections are regular and follow a pattern.
• the hosts belonging to the same group all connect to the private servers of the group and rarely connect to other groups' private servers.
• the present embodiments model normal event states using the blue print graphs 52.
• the topology graph in particular is used to model the source and destination relationship of the connection events inside the network.
• the term last- connection-time records the timestamp of the latest network connection on the node/edge. This measurement is used to update the blue print graphs 52. If a node/edge has no connection event for a predetermined period of time (e.g., two months), the system will remove such nodes/edges to keep the blue print graphs 52 up to date.
• an edge is added to the topology graph between the two host nodes.
• the last-connection- time of both nodes and edges are updated as the timestamp of the connection event.
• the topology graph need not store the total count of connection events between a pair of nodes. Because the ASI agent 10 does not monitor the contents and traffic of the network connections, the total count of the connections is not meaningful and can even be misleading. In practical applications, processes may initialize thousands of network connection events in one second via the same edge. A large number in the total count would not indicate high traffic along that edge.
• Block 402 receives a new network connection event from one of the ASI agents 10.
• Block 404 determines whether the topology graph already includes both the source and destination host nodes and block 406 adds these nodes to the topology graph if they are not already present.
• Block 408 determines whether the topology graph already includes an edge between the source and destination nodes and block 410 adds the edge to the topology graph if it is not already present.
• Block 412 updates the last-connection-time value for any affected nodes and edges and block 413 removes any nodes or edges that have a last-connection-time that is far enough in the past that it exceeds a predetermined maximum lifetime.
• Block 414 outputs the updated topology graph.
• the blue print graphs 52 can be saved in non-volatile storage and may also be loaded by different analysis engines to take advantage of the up-to-date topology information. For example, users may construct blue print graphs 52 from one enterprise network and then load the saved blue print graphs 52 on another enterprise network.
• the topology graph will automatically be updated during operation and does not need user intervention to provide any particular information about the network, making the present embodiments appropriate for rapid deployment in real networks.
• the ASI agents 10 collect process- level events, such as when a process accesses a file, opens a socket, or forks another process.
• the object can be, e.g., a file, another process, or a socket that contains connection information.
• the process-level events can be classified into three categories: the process-file events, the process-socket events, and the process-process events.
• Table 2 shows an exemplary list of process-level events between the time 11 :30AM and 12:05PM on a given date.
• the IP address is used as the identifier for hosts.
• events e ⁇ and e 5 are process-file events
• e 3 and e 4 are process-socket events
• e 2 is a process-process event.
• the node-id value represents the identity information. For example, if the node is a file, the node-id stores the file path.
• the last- event-time value records the timestamp of the latest event on the node/edge. This measurement is used to remove outdated nodes and edges.
• the process graph is built for each host. When an agent 10 is installed on the host, it continually sends all process-level events that occur on the host and the system constructs the process graph as soon as the first event is received from that host.
• Block 502 receives a process-level event p.
• Block 504 determines whether the host of the process-level event already has a process graph G p associated with it. If not, block 506 creates a new process graph for the host.
• Block 508 determines whether G p includes a node for the process identified by the process-level event. If not, block 510 adds a new process node to G p .
• Block 512 determines whether G p includes a node for the process's object. If not, block 514 adds an appropriate object node to G p .
• Block 516 determines whether G p includes an edge for the process event. If not, block 518 adds such an edge to G p .
• the topology graph G t and the process graph G p together represent the blue print graphs 52.
• These blue print graph models are used by network analysis module 42 and host level analysis module 43 to detect abnormal events.
• the blue print graphs 52 are also used by only alert fusion module 44, which maintains a set of historical alert candidates in memory.
• the historical alert candidates are previous alerts that have been reported to the alert fusion system but are not output due to low trustworthiness.
• the fusing module 44 takes both newly reported alerts and historical alert candidates as input.
• Block 602 performs intra-host clustering based on graph information. In this step, block 602 clusters related alerts reported by each individual host. Intra-host clustering makes use of a distance measurement between two alerts.
• the process distance between e and e 2 is defined by the equation below, where SP ⁇ p t ⁇ p 2
• This equation has three different conditions: 1. If ⁇ and e 2 are from different hosts, the distance is infinite; 2. If e ⁇ and e 2 are from the same host and the same process, the distance is zero; and 3. If e ⁇ and e 2 are from the same host and different processes, the process distance is the length of the shortest path from to /3 ⁇ 4. The details of intra-host clustering will be described in greater detail below.
• Block 604 discovers the relationships between alerts. Besides explicit relationships, the alerts may also have hidden relationships. For example, if the process distance between two alerts is large, but the alerts are reported in a short time period, or if the user-id of both alerts is the same, then the alerts may be related.
• e 1 and e 2 may be defined as having a hidden relationship if and only if they satisfy the following conditions:
• block 606 performs inter-host clustering to integrate the alerts from different hosts.
• e and e 2 may be designated as having an inter-host relationship if and only if x ⁇ h 2 , if 1 — t 2
• An inter-host relationship does not require both alerts to have the same host-id or user-id. However, such alerts should be reported in a short period of time and the hosts of the alerts should be connected in the topology graph. In addition, the latest connection timestamp of the edge between the two hosts should be close to the alert timestamp, such that the two hosts have network connections in the time period when the alerts are reported. Additional detail regarding inter-host relationship is provided below.
• block 608 computes trustworthiness for each cluster. Every alert in each inter-host cluster has an abnormality score when reported by the detectors in network analysis module 42 or host-level analysis module 43. The trustworthiness of an alert e, reported by detector d t is determined as:
• the value range of the detector's weight w t is [0, 1]. This parameter is computed in a feedback look, where the weight is first initialized for every detector as 1. If a user deems a particular alert to be a "false alarm,” that fact can be recorded. The weight of w t is calculated as:
• c is defined to be an inter-host cluster
• p is defined to be a process, where c has at least one alert with process p
• e p is a representative alert of p in cluster c.
• the alert e p is considered representative if there does not exist another alert e, in c where the process of e, is also p and where ⁇ ( ⁇ ) > a(e).
• the representative alert of the process is therefore the alert with the highest alert trustworthiness.
• the cluster trustworthiness is defined as:
• P is the set of all processes that are related to the alerts in c.
• the trustworthiness of an inter-host cluster is the sum of all processes' representative alert trustworthiness. A large cluster that includes many processes would therefore have a relatively high trustworthiness.
• Block 610 filters the clusters according to a threshold, comparing each cluster's trustworthiness score to that threshold. If a cluster's trustworthiness score exceeds the thereshold, then its alerts are reported.
• Block 702 receives a set of historical alert candidates E h .
• Block 704 removes any alerts from E h that are outdated (e.g., that were issued more than a threshold time in the past).
• Block 706 adds a new alert e new and all of the remaining historical candidates E h to a new set e.
• Block 708 selects an alert e from the new set E (this may be performed randomly) and moves the selected alert e to a newly initialized cluster c.
• a loop begins, where block 710 selects a new alert e, from within the new cluster c.
• Block 712 checks every alert e, remaining in the new set E and determines dist p ⁇ ei,ej). If dist p (ei,ef) is less than the process distance threshold ⁇ 5, block 712 moves e, from the new set E to the new cluster c.
• Block 714 determines whether all of the alerts in the new cluster c have been visited.
• processing returns to block 710 and a new, unvisited alert e, is selected from the cluster c. If all of the alerts in c have been visited, processing returns to block 708, where another new cluster is initialized and an initial alert is moved from the new set E to the new cluster. This process continues until block 716 determines that there are no alerts remaining in the new set E.
• Block 802 receives as an input a set of intra-host clusters.
• Block 804 begins by moving a cluster from the input set to a set of clusters that include hidden relationships.
• Block 806 considers every alert in the moved cluster c to determine if any such alert shares a hidden relationship with an alert in any cluster still in the input set. If so, the cluster is merged with c and removed from the input set.
• Block 808 determines if any clusters remain in the input set. If so, processing returns to block 804 where a new cluster is moved from the input set to the hidden relationship cluster set. If not, the hidden relationship cluster set is output.
• Block 902 receives the hidden relationship cluster set as an input.
• Block 904 moves a cluster c from the input set to an inter-host cluster set.
• Block 906 considers every alert in the moved cluster c to determine if any such alert shares an inter-cluster relationship with an alert in any cluster still in the input set. If so, block 906 merges the cluster with c and removes the cluster from the input set.
• Block 908 determines if any clusters remain in the input set. If so, processing returns to block 904 where a new cluster is moved from the input set to the inter-host cluster set. If not, the inter-host cluster set is output.
• Embodiments described herein may be entirely hardware, entirely software or including both hardware and software elements.
• the present invention is implemented in software, which includes but is not limited to firmware, resident software, microcode, etc.
• Embodiments may include a computer program product accessible from a computer-usable or computer-readable medium providing program code for use by or in connection with a computer or any instruction execution system.
• a computer-usable or computer readable medium may include any apparatus that stores, communicates, propagates, or transports the program for use by or in connection with the instruction execution system, apparatus, or device.
• the medium can be magnetic, optical, electronic, electromagnetic, infrared, or semiconductor system (or apparatus or device) or a propagation medium.
• the medium may include a computer-readable storage medium such as a semiconductor or solid state memory, magnetic tape, a removable computer diskette, a random access memory (RAM), a read-only memory (ROM), a rigid magnetic disk and an optical disk, etc.
• Each computer program may be tangibly stored in a machine-readable storage media or device (e.g., program memory or magnetic disk) readable by a general or special purpose programmable computer, for configuring and controlling operation of a computer when the storage media or device is read by the computer to perform the procedures described herein.
• the inventive system may also be considered to be embodied in a computer-readable storage medium, configured with a computer program, where the storage medium so configured causes a computer to operate in a specific and predefined manner to perform the functions described herein.
• a data processing system suitable for storing and/or executing program code may include at least one processor coupled directly or indirectly to memory elements through a system bus.
• the memory elements can include local memory employed during actual execution of the program code, bulk storage, and cache memories which provide temporary storage of at least some program code to reduce the number of times code is retrieved from bulk storage during execution.
• I/O devices including but not limited to keyboards, displays, pointing devices, etc. may be coupled to the system either directly or through intervening I/O controllers.
• Network adapters may also be coupled to the system to enable the data processing system to become coupled to other data processing systems or remote printers or storage devices through intervening private or public networks.
• Modems, cable modem and Ethernet cards are just a few of the currently available types of network adapters.
• the network analysis system 1100 includes a hardware processor 1102 and a memory 1104.
• a user interface 1100 provides a visual, textual, and/or audio interface by which a user receives network alerts, including fused alerts.
• the network analysis system 1100 includes one or more functional modules that may, in some embodiments, be implemented as software that is stored in the memory 1104 and executed by hardware processor 1102.
• the functional module may be implemented as one or more discrete hardware components in the form of, e.g., application specific integrated chips or field programmable gate arrays.
• a blue print graph update module 1108 builds and updates blue print graphs 1106 as events arrive. Based on the blue print graphs 1106, the clustering module 1110 clusters the alerts into clusters having, e.g., intra-host, inter-host, and/or hidden relationships and determines a trustworthiness of said clusters. If the trustworthiness of a cluster exceeds a threshold level, the alerts in the cluster are provided to the user through the user interface 1112.
• the processing system 1200 includes at least one processor (CPU) 1204 operatively coupled to other components via a system bus 1202.
• a first storage device 1222 and a second storage device 1224 are operatively coupled to system bus 1202 by the I/O adapter 1220.
• the storage devices 1222 and 1224 can be any of a disk storage device (e.g., a magnetic or optical disk storage device), a solid state magnetic device, and so forth.
• the storage devices 1222 and 1224 can be the same type of storage device or different types of storage devices.
• a speaker 1232 is operatively coupled to system bus 1202 by the sound adapter 1230.
• a transceiver 1242 is operatively coupled to system bus 1202 by network adapter 1240.
• a display device 1262 is operatively coupled to system bus 1202 by display adapter 1260.
• a first user input device 1252, a second user input device 1254, and a third user input device 1256 are operatively coupled to system bus 1202 by user interface adapter 1250.
• the user input devices 1252, 1254, and 1256 can be any of a keyboard, a mouse, a keypad, an image capture device, a motion sensing device, a microphone, a device incorporating the functionality of at least two of the preceding devices, and so forth. Of course, other types of input devices can also be used, while maintaining the spirit of the present principles.
• the user input devices 1252, 1254, and 1256 can be the same type of user input device or different types of user input devices.
• the user input devices 1252, 1254, and 1256 are used to input and output information to and from system 1200.
• processing system 1200 may also include other elements (not shown), as readily contemplated by one of skill in the art, as well as omit certain elements.
• various other input devices and/or output devices can be included in processing system 1200, depending upon the particular implementation of the same, as readily understood by one of ordinary skill in the art.
• various types of wireless and/or wired input and/or output devices can be used.
• additional processors, controllers, memories, and so forth, in various configurations can also be utilized as readily appreciated by one of ordinary skill in the art.

Landscapes

• Engineering & Computer Science (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Computer Security & Cryptography (AREA)
• Data Exchanges In Wide-Area Networks (AREA)
• Debugging And Monitoring (AREA)

Priority Applications (1)

Applications Claiming Priority (4)

Publications (1)

Family

ID=60001443

Family Applications (1)

Country Status (2)

Cited By (2)

Families Citing this family (1)

Citations (4)

• 2017
  • 2017-04-04 JP JP2019502545A patent/JP6616045B2/ja active Active
  • 2017-04-04 WO PCT/US2017/025846 patent/WO2017176676A1/en active Application Filing

Patent Citations (4)

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events