Classifications

• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
  • G06F21/55—Detecting local intrusion or implementing counter-measures
  • G06F21/552—Detecting local intrusion or implementing counter-measures involving long-term monitoring or reporting
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
  • G06F21/55—Detecting local intrusion or implementing counter-measures
  • G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
  • G06N5/00—Computing arrangements using knowledge-based models
  • G06N5/02—Knowledge representation; Symbolic representation
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
  • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
  • H04L63/1416—Event detection, e.g. attack signature detection
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
  • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
  • H04L63/1425—Traffic logging, e.g. anomaly detection

Definitions

• a computer-implemented method comprises, in response to receiving an indication of an occurrence of a target event on a target client system, employing at least one hardware processor of a computer system to assemble an event sequence including the target event, all events of the event sequence having occurred on the target client system, wherein members of the event sequence are arranged according to a time of occurrence of each event of the event sequence.
• the method further comprises, in response to receiving the indication, employing at least one processor of the computer system to select a parameter value from a plurality of parameter values according to the target client system.
• FIG. 4 shows exemplary software components executing on a protected client system according to some embodiments of the present invention.
• Fig. 8-A shows an exemplary training of an event encoder according to some embodiments of the present invention.
• Fig 17-A shows results of an experiment comprising employing some embodiments of the present invention to detect actual computer security threats.
• Fig. 17-B shows other experimental results of using some embodiments to detect actual computer security threats.
• the illustrated client systems are connected by local networks 12a-b, and further to an extended network 14, such as a wide area network (WAN) or the Internet.
• client systems lOa-d represent a family’s electronic devices, interconnected by a home network 12a.
• client systems lOe-g may denote individual computers and/or a corporate mainframe inside an office building.
• Local network 12-b may then represent a section of a corporate network (e.g., a local area network - LAN).
• Fig.1 further shows a security server 16 connected to extended network 14.
• Server 16 generically represents a set of communicatively coupled computer systems, which may or may not be in physical proximity to each other.
• Server 16 protects client systems lOa-h against computer security threats such as malicious software and intrusion.
• such protection comprises security server 16 detecting suspicious activity occurring at a client system, for instance an action of an attacker controlling the respective client system.
• Examples of such events include the launch of a process/thread (e.g., a user launches an application, a parent process creates a child process, etc.), an attempt to access an input device of the respective client system (e.g., camera, microphone), an attempt to access a local or remote network resource (e.g., a hypertext transfer protocol - HTTP request to access a particular URL, an attempt to access a document repository over a local network), a request formulated in a particular uniform resource identifier scheme (e.g., a mailto: or a ftp: request), an execution of a particular processor instruction (e.g., system call), an attempt to load a library (e.g., a dynamic linked library - DLL), an attempt to create a new disk file, an attempt to read from or write to a particular location on disk (e.g., an attempt to overwrite an existing file, an attempt to open a specific folder or document), and an attempt to send an electronic message (e.g., email, short
• 1 may be collectively represented by a single client profile which captures a normal or baseline behavior of the members of a particular family.
• one client profile is used to represent all computers in the accounting department of a corporation, while another client profile represents all computers used by the respective corporation’s research and development team.
• a cloud computing embodiment such as a virtual desktop infrastructure (VDI) environment wherein a physical machine may execute a plurality of virtual machines for various distributed users, one client profile may be attached to multiple virtual machines executing on the respective physical machine.
• VDI virtual desktop infrastructure
• Fig.3-A shows an exemplary hardware configuration of a client system according to some embodiments of the present invention.
• Client system 10 may represent any of client systems lOa-h in Fig.1.
• the illustrated client system is a computer system.
• Other client systems such as mobile telephones, tablet computers, and wearable devices may have slightly different configurations.
• Processor 32 comprises a physical device (e.g. microprocessor, multi-core integrated circuit formed on a semiconductor substrate) configured to execute computational and/or logical operations with a set of signals and/or data. Such signals or data may be encoded and delivered to processor 32 in the form of processor instructions, e.g., machine code.
• Memory unit 34 may comprise volatile computer-readable media (e.g.
• Event harvester 52 is configured to detect various events occurring during execution of software by client system 10. Some embodiments may timestamp each detected event to record a time of occurrence of the respective event. Monitored events may be machine and/or operating system-specific. Exemplary events include, among others, a process launch, a process termination, the spawning of child processes, an access requests to peripherals (e.g., hard disk, network adapter), a command entered by the user into a command-line interface, etc. Such hardware and/or software events may be detected using any method known in the art of computer security, for instance by hooking certain functions of the operating system, detecting system calls, employing a file system minifilter, changing a memory access permission to detect an attempt to execute code from certain memory addresses, etc.
• Fig. 5 shows exemplary software executing on security server 16 according to some embodiments of the present invention.
• the illustrated software includes a profiling engine 60 and an anomaly detector 62 further connected to an alert manager 64.
• profiling engine 60 may execute on a dedicated cluster of processors, while instances of anomaly detector 62 may run on other machines/processors.
• profiling engine 60 is configured to analyze events occurring on a set of client systems (e.g., a subset of clients lOa-h in Fig.1) and to construct a plurality of client profiles representing a baseline, normal, and/or legitimate manner of operating the respective client systems.
• a subset of event indicators 20a-b received from clients may be used to assemble a training event corpus, denoted as corpus 18 in Figs.1, 5, and 6.
• Profiles are then determined according to event corpus 18. Determining a client profile may include, among others, representing events in an abstract multi-dimensional event space and carrying out data clustering procedures, as shown in more detail below. Constructed profiles may then be stored as entries in profile database 19.
• An exemplary profile database entry comprises a set of profile parameters such as a set of coordinates of a cluster centroid, a measure of the cluster’s diameter and/or eccentricity, etc.
• Fig.6 illustrates exemplary components and operation of profiling engine 60.
• engine 60 comprises an event encoder 70, an event clustering engine 72, and a client clustering engine 74 connected to event encoder 70 and event clustering engine 72.
• An exemplary sequence of steps performed by profiling engine is illustrated in Fig.7.
• An exemplary embedding space is spanned by a set of axes, wherein each axis represents a distinct event feature.
• Exemplary features may include, in the case of a network event, a source IP address, a source port, a destination IP address, a destination port, and an indicator of the transport protocol, among others.
• each axis of the embedding space corresponds to a linear combination of event features (for instance, in a principal component/singular value decomposition embodiment).
• events are analyzed in the context of other events, which precede and/or follow the respective event.
• encoder 70 is configured to represent events as vectors in an embedding space of contexts, wherein two events that occur predominantly in similar contexts are located relatively close together.
• Some embodiments choose the dimensionality of the embedding space according to a size of the event vocabulary N, i.e., the count of distinct event types that the respective security system is monitoring (for more on the event vocabulary, see below).
• the dimensionality of the event space may of the order of the quadratic root of N, or of a logarithm of N.
• a typical embodiment of the present invention uses an embedding context space having several hundred to several thousand dimensions.
• Event encoder 70 may be constructed using any method known in the art of automated data processing.
• encoder 70 comprises an artificial intelligence system, for instance a multilayer artificial neural network (e.g., a recurrent and/or feed-forward neural network).
• parameters of encoder 70 may be tuned until some performance condition is satisfied. Such tuning is herein referred to as training and is represented by step 208 in Fig. 7.
• exemplary tunable parameters of event encoder 70 include a set of synapse weights, among others.
• training encoder 70 amounts to constructing the embedding space itself.
• the embedding space is not pre-determined, but instead depends on the composition of event corpus 18 and on the selected training procedure.
• Exemplary training procedures are shown in Figs. 8-A-B and comprise versions of the word2vec algorithm, such as a skip-gram algorithm and a continuous bag-of-words algorithm.
• events are not analyzed in isolation, but as constituents of an event sequence 25 consisting of multiple events ordered according to a time of occurrence or detection.
• all events of the respective sequence are selected so that they occur on the same client system.
• Event sequence 25 comprises a central event Eo and an event context consisting of a subset of events E ⁇ .- .E i (k3 0) preceding the central event and/or a subset of events E ...E p (p3 0) following the central event.
• the encoder-decoder pair may then be trained by adjusting parameters of encoder 70b and/or decoder 76b in an effort to reduce the prediction error, i.e., the mismatch between the“predicted” central event and the actual central event of the respective training sequences.
• a step 222 retrieves a set of event records from event corpus 18 and identifies an event sequence 25 according to event timestamps and according to a source of the respective events (i.e., client systems where the respective events have occurred).
• a step 224 then executes event encoder 70a to produce an embedding-space representation of event Eo (event vector 28c in Fig. 8-A).
• profiling engine 60 executes event decoder 76a to produce a set of predictions or“guesses” for events preceding and/or following central event Eo within sequence 25.
• some embodiments further transform the generated embedding space to reduce its dimensionality.
• This operation may comprise any data dimensionality reduction algorithm, for instance a principal component analysis (PCA) or a singular value decomposition (SVD).
• PCA principal component analysis
• SVD singular value decomposition
• profiling engine 60 may employ any data clustering algorithm known in the art, for instance a variant of a k-means algorithm.
• Another exemplary embodiment may train a set of perceptrons to carve the embedding space into distinct regions and assign event vectors located within each region to a distinct event cluster.
• the number of clusters and/or regions may be pre-determined (e.g., according to a count of protected client systems and/or monitored event types) or may be dynamically determined by the clustering algorithm itself.
• An outcome of event clustering comprises a set of event cluster parameters 54 (Fig.
• client clustering engine 74 assign client systems lOa-h to clusters according to an event profile indicative of a typical distribution of events occurring on the respective client systems.
• an event profile of a client system comprises a vector of numbers, each determined according to a count of events occurring on the respective client system and belonging to a distinct event cluster previously determined by event clustering engine 72.
• each component of the event profile is determined according to a cluster allegiance measure indicative of a proportion of events belonging to the respective event cluster Q, determined as a fraction of a total count of events available from the respective client system.
• Fig. 13 illustrates exemplary components and operation of anomaly detector 62 according to some embodiments of the present invention (see also Fig. 5).
• Anomaly detector 62 is configured to receive an event stream 24 comprising event indicators indicative of events occurring on various client systems, and in response, to output a security label 88 indicating whether the respective events are indicative of a security threat such as intrusion or execution of malicious software.
• anomaly detector 62 comprises a profile manager 84 configured, in response to receiving an event notification indicative of an event occurring on a protected client system, to select a client profile according to the respective event.
• Profile manager 84 is further connected to a behavior model 86 configured to determine whether the respective event fits a pattern of normal/baseline behavior represented by the respective profile. When no, the respective event may be considered an anomaly, thus indicative of a possible attack on the respective client system.
• Fig. 14 shows an exemplary sequence of steps performed by anomaly detector 62 during a training procedure according to some embodiments of the present invention.
• a step 242 selects one such client profile from profile database 19.
• each such client profile comprises a set of client clusters, for instance cluster 82a in Fig. 11.
• Each client cluster further includes a selected subset of protected client systems.
• a step 244 may select a training set of events registered as occurring on any client system associated with the respective profile/cluster.
• step 244 may comprise selected the training set of events from training corpus 18 already used for constructing client profiles as shown above.
• a further step 246 may use the respective training set of events as training corpus to train behavior model 86.
• Fig. 17-B shows profile-specific average detection rates achieved for three distinct types of attacks. Event sequences collected from the test machine during each type of attack were analyzed using each of the 11 profile-specific trained behavior models. The detection rate differs among models and types of attack, which further attests to the specificity of some of the systems and methods described herein.

Landscapes

• Engineering & Computer Science (AREA)
• Computer Security & Cryptography (AREA)
• Theoretical Computer Science (AREA)
• General Engineering & Computer Science (AREA)
• Software Systems (AREA)
• Computer Hardware Design (AREA)
• Computing Systems (AREA)
• General Physics & Mathematics (AREA)
• Physics & Mathematics (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Artificial Intelligence (AREA)
• Computational Linguistics (AREA)
• Data Mining & Analysis (AREA)
• Evolutionary Computation (AREA)
• Mathematical Physics (AREA)
• Computer And Data Communications (AREA)
• Data Exchanges In Wide-Area Networks (AREA)
• Radar Systems Or Details Thereof (AREA)
• Ultra Sonic Daignosis Equipment (AREA)

Priority Applications (9)

Applications Claiming Priority (2)

Publications (1)

Family

ID=68841136

Family Applications (1)

Country Status (11)

Families Citing this family (20)

Citations (2)

Family Cites Families (49)

• 2018
  • 2018-12-10 US US16/215,251 patent/US11153332B2/en active Active
• 2019
  • 2019-12-10 CN CN201980081446.2A patent/CN113168469B/zh active Active
  • 2019-12-10 JP JP2021533157A patent/JP7389806B2/ja active Active
  • 2019-12-10 KR KR1020217017510A patent/KR102403629B1/ko active Active
  • 2019-12-10 WO PCT/EP2019/084312 patent/WO2020120429A1/en not_active Ceased
  • 2019-12-10 AU AU2019400060A patent/AU2019400060B2/en active Active
  • 2019-12-10 ES ES19817694T patent/ES2946062T3/es active Active
  • 2019-12-10 CA CA3120423A patent/CA3120423C/en active Active
  • 2019-12-10 SG SG11202105054UA patent/SG11202105054UA/en unknown
  • 2019-12-10 EP EP19817694.3A patent/EP3895048B1/en active Active
  • 2019-12-10 IL IL283698A patent/IL283698B2/en unknown

Patent Citations (2)

Also Published As

Similar Documents

Legal Events