Automated mitigation of electronic message based security threats

Patent metadata

Field	Value
Publication number	US-10158677-B1
Application number	US-201815939676-A
Country	US
Kind code	B1
Filing date	Mar 29, 2018
Priority date	Oct 2, 2017
Publication date	Dec 18, 2018
Grant date	Dec 18, 2018

Abstract

An example embodiment may include a security enforcement point device disposed within a managed network and a security decision point device disposed within a computational instance of a remote network management platform. The security decision point device may be configured to: receive a message by way of the managed network; parse the message to identify observable indicators of one or more of the security threats, where the observable indicators include at least one of a network addresses, a hyperlink, or a representation of an attached file; remotely query a security threat database for the observable indicators; receive, from the security threat database, an indication that the observable indicators are associated with a particular security threat, and transmit, to the security enforcement point device, a command to update its associated security policy such that the particular security threat is mitigated.

First claim

What is claimed is:

1. An application Platform as a Service (aPaaS) system configured to detect and mitigate phishing attacks for a managed network, the system comprising:
a spam filter disposed within the managed network, wherein the spam filter applies filtering rules to detect unsolicited messages and prevent the unsolicited messages from reaching one or more client computing devices of the managed network; and
a security decision point application disposed within a computational instance of a remote network management platform, wherein the computational instance is dedicated to serving the managed network and protecting the one or more client computing devices of the managed network from the phishing attacks, and wherein the security decision point application is configured to:
receive a message by way of the managed network, wherein the message was obtained by a particular client computing device of the one or more client computing devices, not classified as spam by the spam filter, and forwarded to the security decision point application by the managed network as a potential phishing attack;
parse the message to identify observable indicators of one or more of the phishing attacks, wherein the identified observable indicators include at least one of a network address, a hyperlink, or a representation of an attached file;
query a security threat database for the identified observable indicators, wherein the security threat database includes an application programming interface configured to respond to the query by determining a comparison of the identified observable indicators against observable indicators known to be associated with the phishing attacks;
receive, from the security threat database, a result of the comparison being that the identified observable indicators are not associated with any of the phishing attacks; and
in response to the result of the comparison being that the identified observable indicators are not associated with any of the phishing attacks, control the spam filter to update the filtering rules applied to future messages that are received at the spam filter and that have the identified observable indicators such that the future messages having the identified observable indicators are classified as spam and not forwarded to the security decision point application.

2. The system of claim 1 , wherein the security threat database is disposed within the computational instance, and wherein the security threat database comprises one or more feature vectors, each feature vector representing an array of one or more observable indicators, and wherein determining the comparison of the identified observable indicators against the observable indicators known to be associated with the phishing attacks comprises determining a comparison of the identified observable indicators to the one or more feature vectors to determine whether the identified observable indicators are associated with any of the phishing attacks.

3. The system of claim 1 , wherein the security decision point application is further configured to:
provide, to a computing device of the managed network, a graphical user interface configurable to search observable indicators;
receive, from the computing device via the graphical user interface, a query for a particular observable indicator;
determine whether the particular observable indicator is maintained in the security threat database; and
based on determining that the particular observable indicator is maintained in the security threat database, control the computing device to display information representing one or more configuration items that received at least one message having the particular observable indicator.

4. The system of claim 1 , wherein the message is selected from the group consisting of a Short message service (SMS) message, an instant messaging (IM) message, and a group chat message.

5. The system of claim 1 , wherein the message is an email message containing the network address and the hyperlink, wherein the network address is contained within a header of the email message and is an Internet Protocol (IP) address from which the email message was sent, and wherein the hyperlink is a uniform resource locator (URL) contained within a body of the email message.

6. The system of claim 1 , wherein the message is an email message containing the network address and the hyperlink, wherein the network address is contained within a header of the email message and is a source email address, and wherein the hyperlink is a uniform resource locator (URL) contained within a body of the email message.

7. The system of claim 1 , wherein the representation of the attached file is a hash computed by applying a one-way function to the attached file.

8. The system of claim 1 , wherein the representation of the attached file is a name of the attached file.

9. The system of claim 1 , wherein the message is an email message that contains the attached file, wherein the email message was received by an email server device associated with the managed network, and wherein the security decision point application is further configured to:
query the email server device to determine a number of times that the attached file has been received by the email server device, a number of email accounts to which the attached file was delivered, or the email accounts to which the attached file was delivered.

10. A method comprising:
receiving, by a security decision point application disposed within a computational instance of a remote network management platform, a message by way of a managed network, wherein the message was obtained by a particular client computing device of the managed network, not classified as spam by a spam filter of the managed network, and forwarded to the security decision point application by the managed network as a potential phishing attack, wherein the spam filter applies filtering rules to detect unsolicited messages and prevent the unsolicited messages from reaching one or more client computing devices of the managed network, and wherein the computational instance is dedicated to serving the managed network and protecting the one or more client computing devices of the managed network from phishing attacks;
parsing, by the security decision point application, the message to identify observable indicators of one or more of the phishing attacks, wherein the identified observable indicators include at least one of a network address, a hyperlink, or a representation of an attached file;
querying, by the security decision point application, a security threat database for the identified observable indicators, wherein the security threat database includes an application programming interface configured to respond to the query by determining a comparison of the identified observable indicators against observable indicators known to be associated with the phishing attacks;
receiving, by the security decision point application, from the security threat database, a result of the comparison being that the identified observable indicators are not associated with any of the phishing attacks; and
in response to the result of the comparison being that the identified observable indicators are not associated with any of the phishing attacks, controlling, by the security decision point application, the spam filter to update the filtering rules applied to future messages that are received at the spam filter and that have the identified observable indicators such that the future messages having the identified observable indicators are classified as spam and not forwarded to the security decision point application.

11. The method of claim 10 , wherein the security t

Assignees

• Servicenow Inc

Inventors

• Dicorpo Phillip
• Bernal Jose
• Watson Eun-Sook

Classifications

• G06F21/56

  Computer malware detection or handling, e.g. anti-virus arrangements · CPC title

• G06F16/951

  Indexing; Web crawling techniques · CPC title

• H04L51/08

  Annexed information, e.g. attachments · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/1416

  Event detection, e.g. attack signature detection · CPC title