Automated intelligence graph construction and countermeasure deployment

Patent metadata

Field	Value
Publication number	US-10162970-B2
Application number	US-201815888600-A
Country	US
Kind code	B2
Filing date	Feb 5, 2018
Priority date	Feb 25, 2014
Publication date	Dec 25, 2018
Grant date	Dec 25, 2018

Abstract

Techniques for providing information security threat assessment and amelioration are disclosed. The techniques may include obtaining fundamental data, obtaining document data, preparing fundamental instance nodes from the fundamental data, preparing document nodes from the document data, preparing edges between at least some of the nodes, storing the nodes and the edges in a manner that reflects a graph structure, and causing to be displayed at least a portion of a graph defined by at least one node and at least one edge.

First claim

What is claimed is:

1. A method comprising:
obtaining, by one or more devices and via a computer network, computer-readable data that includes fundamental data and document data;
preparing, by the one or more devices, a plurality of nodes and a plurality of edges, between the plurality of nodes, by extracting information from the computer-readable data;
storing, by the one or more devices and in a memory, the plurality of nodes and the plurality of edges as a graph;
identifying, by the one or more devices, a subgraph, of the graph, that includes a match to a pattern of attack,
identifying the subgraph comprising:
identifying the subgraph after a traversal of at least a portion of the graph is triggered due to data being added to the graph, and

the plurality of nodes including a node associated with common vulnerability and exposure information;

obtaining, by the one or more devices and based on identifying the subgraph, a countermeasure corresponding to the subgraph; and
performing, by the one or more devices and based on the countermeasure, one or more actions for one or more computers impacted by the attack.

2. The method of claim 1 ,
where the plurality of nodes further include one or more nodes that represent malicious activity,
where the method further comprises:
traversing the graph starting from the one or more nodes that represent malicious activity, and

where identifying the subgraph comprises:
identifying the subgraph based on traversing the graph starting from the one or more nodes that represent malicious activity.

3. The method of claim 1 , further comprising:
inspecting time data associated with the subgraph,
where performing the one or more actions based on the countermeasure comprises:
performing the one or more actions based on the countermeasure and based on inspecting the time data.

4. The method of claim 3 , further comprising:
determining that the time data is within a fixed interval of a current time,
where performing the one or more actions based on the countermeasure comprises:
performing the one or more actions based on the countermeasure and based on determining that the time data is within the fixed interval of the current time.

5. The method of claim 1 , further comprising:
providing, for display, information identifying the countermeasure; and
determining a selection of the countermeasure after providing the information identifying the countermeasure,
where performing the one or more actions based on the countermeasure comprises:
activating the countermeasure based on the selection of the countermeasure.

6. The method of claim 1 ,
where the node is a first node, and
where the plurality of nodes further include:
a second node associated with one of:
an internet protocol (IP) address,
a domain name,
a uniform resource locator,
a file system path,
a software vulnerability,
an account handle,
an email address,
a malware family,
an attack campaign,
a network,
a file, or
an autonomous system number, and

a third node that is a document node associated with an intelligence report.

7. The method of claim 1 , where the fundamental data includes a malware sample.

8. A system comprising:
a memory; and
one or more processors to:
obtain, via a computer network, computer-readable data that includes fundamental data and document data;
prepare a plurality of nodes and a plurality of edges, between the plurality of nodes, by extracting information from the computer-readable data;
store the plurality of nodes and the plurality of edges as a graph;
identify a subgraph, of the graph, that includes a match to a pattern of attack,
when identifying the subgraph, the one or more processors are to:
identify the subgraph after a traversal of at least a portion of the graph is triggered due to data being added to the graph;

obtain, based on identifying the subgraph, a countermeasure corresponding to the subgraph; and
perform, based on the countermeasure, one or more actions for one or more computers impacted by the attack.

9. The system of claim 8 , where the plurality of nodes include one or more nodes that represents malicious activity.

10. The system of claim 8 ,
where the one or more processors are further to:
inspect time data associated with the subgraph; and
determine that the time data is within a fixed interval of a current time, and

where, when performing the one or more actions action based on the countermeasure, the one or more processors are to:
perform the one or more actions based on the countermeasure and based on determining that the time data is within the fixed interval of the current time.

11. The system of claim 8 ,
where the one or more processors are further to:
provide, for display, information identifying the countermeasure; and
determine a selection of the countermeasure after providing the information identifying the countermeasure, and

where, when performing the one or more actions, the one or more processors are to:
activate the countermeasure based on the selection of the countermeasure.

12. The system of claim 8 , where the plurality of nodes include:
a first node associated with common vulnerability and exposure information,
a second node associated with one of:
an internet protocol (IP) address,
a domain name,
a uniform resource locator,
a file system path,
a software vulnerability,
a software,
a name of a person,
an account handle,
an email address,
a malware family,
an attack campaign,
an event,
an organization,
a network,
a file,
a country,
a region, or
an autonomous system number, and

a third node that is a document node associated with one of:
an intelligence report,
a communication,
an analysis, or
a context.

13. The system of claim 8 , where the document data includes one or more of:
intelligence reports,
communication documents,
context documents, or
analysis documents.

14. A non-transitory computer-readable medium storing instructions, the instructions comprising:
one or more instructions that, when executed by at least one processor, cause the at least one processor to:
obtain, via a computer network, computer-readable data that includes fundamental data and document data;
prepare a plurality of nodes and a plurality of edges, between the plurality of nodes, by extracting information from the computer-readable data;
store the plurality of nodes and the plurality of edges as a graph;
identify, after a traversal of at least a portion of the graph is triggered due to data being added to the graph, a subgraph, of the graph, that includes a match to a pattern of attack;
obtain, based on identifying the subgraph, a countermeasure corresponding to the subgraph; and
perform, based on the countermeasure, one or more actions for one or more computers impacted by the attack.

15. The non-transitory computer-readable medium of claim 14 , where the plurality of nodes include one or more nodes that represents malicious activity.

16. The non-transitory computer-readable medium of claim 14 ,
where the one or more instructions further cause the at least one processor to:
inspect time data associated with the subgraph; and
determine that the time data is within a fixed interval of a current time, and

where the one or more actions are performed further based on determining that the time data is within the fixed interval of the current time.

17. The non-transitory computer-readable medium of claim 14 ,
where the one or more instructions further cause t

Assignees

• Accenture Global Solutions Ltd

Inventors

• Olson Ryan
• Tonn Trevor

Classifications

• H04L63/1433

  Vulnerability analysis · CPC title

• G06F2221/033

  Test or assess software · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title