Threat intelligence system

Patent metadata

Field	Value
Publication number	US-10397273-B1
Application number	US-201715668627-A
Country	US
Kind code	B1
Filing date	Aug 3, 2017
Priority date	Aug 3, 2017
Publication date	Aug 27, 2019
Grant date	Aug 27, 2019

Abstract

Systems are provided for collecting threat intelligence to use in monitoring network activity in computing environments for malicious activity. The systems load sensors into compute resources associated with particular users of a compute resource virtualization platform. The systems receive network activity information sent by first and second sensors, identify an IP address as being a suspected source of malicious computing activity using aggregated the first and second network activity, and generate threat information that includes the IP address as a suspected source of malicious computing activity.

First claim

What is claimed is:

1. A system, comprising:
one or more hardware computing devices in communication with a first electronic data store and configured to execute specific computer-executable instructions that upon execution cause the system to:
receive a request from a first user to deploy a sensor;
use information describing virtual machine images used by the first user to configure a first sensor;
cause the first sensor to be launched within a virtual network of the first user with a first network connection that facilitates communication between the first sensor and one or more remote endpoints outside of the virtual network;
receive first activity information sent by the first sensor;
combine the first activity information with activity information from a second sensor associated with a second user into third activity information;
identify an Internet Protocol (“IP”) address as being a suspected source of malicious computing activity using the third activity;
create threat information that includes the IP address as a suspected source of malicious computing activity; and
make the threat information available to the first user.

2. The system of claim 1 , wherein the one or more hardware computing devices are further configured to execute specific computer-executable instructions that upon execution cause the system to:
receive information describing a configuration of one or more network connections between at least a first virtual machine in the virtual network corresponding to a first virtual machine image used by the first user and a second virtual machine in the virtual network corresponding to a second virtual machine image used by the first user;
use the information describing the virtual machine images used by the first user to configure a second sensor;
cause the second sensor to be launched within the virtual network of the first user;
cause the first sensor and the second sensor to be connected by one or more network connections in the same configuration of the one or more network connections between the first virtual machine and the second virtual machine.

3. The system of claim 1 , wherein the one or more hardware computing devices are further configured to execute specific computer-executable instructions that upon execution cause the system to:
configure at least a first port of the first sensor to be unprotected by a firewall associated with the first sensor, wherein the first port of a virtual machine instance implemented in the virtual network is protected by a firewall associated with the virtual machine instance; and
configure the firewall associated with the virtual machine instance to inhibit communications from the first sensor.

4. The system of claim 1 , wherein the one or more hardware computing devices are further configured to execute specific computer-executable instructions that upon execution cause the system to:
cause a user interface to be presented by a computing device associated with the first user that prompts the first user to provide information about a type of industry for which the first user utilizes first compute resources in the virtual network;
receive information about the type of industry for which the first user utilizes the first compute resources provided through the user interface; and
configure the first sensor using the information about the type of industry for which the first user utilizes the first compute resources.

5. A system, comprising one or more hardware computing devices configured to execute specific computer-executable instructions that upon execution cause the one or more hardware computing devices to:
cause a first sensor to be implemented by first compute resources associated with a first user of a compute resource virtualization platform;
cause the first sensor to be associated with a first network connection that facilitates communication between the first sensor and one or more remote endpoints outside of the first compute resources associated with the first user;
receive first activity information sent by the first sensor;
aggregate the first activity information and second activity information;
identify an Internet Protocol (“IP”) address as being a suspected malicious IP address using aggregated activity information; and
generate threat information that includes the IP address.

6. The system of claim 5 , wherein the first activity information includes first network activity information comprising a plurality of IP addresses that have communicated with the first sensor, and first file system activity comprising one or more files accessed from a first IP address of the plurality of IP addresses.

7. The system of claim 5 , wherein execution of the specific computer-executable instructions further causes the one or more hardware computing devices to:
transmit a software image corresponding to the first sensor to the first compute resources; and
cause the first compute resources to implement the first sensor using the software image.

8. The system of claim 5 , wherein execution of the specific computer-executable instructions further causes the one or more hardware computing devices to:
cause a user interface to be presented by a computing device associated with the first user that prompts the first user to provide information about a type business in which the first compute resources are being used; and
cause the first compute resources to load a file system with a plurality of files, wherein the plurality of files includes types of files based on the type of business provided using the user interface.

9. The system of claim 5 , wherein the first sensor is executed by a first virtual machine instance in a subnet isolated from one or more other virtual machine instances of the first user by a security rule inhibiting communications from the first virtual machine instance to the one or more other virtual machine instances.

10. The system of claim 5 , wherein execution of the specific computer-implemented instructions further causes the one or more hardware computing devices to:
create an entry in a data structure associated with the first sensor, wherein the entry indicates that the first sensor is associated with the first user;
receive a message from the first sensor indicating a status of the first sensor; and
modify the entry based on the status of the first sensor.

11. The system of claim 5 , wherein execution of the specific computer-executable instructions further causes the one or more hardware computing devices to:
cause a second sensor to be implemented by second compute resources associated with a service provider of the compute resource virtualization platform;
receive third activity information sent by the second sensor; and
identify the IP address using the aggregated activity information and the third activity information.

12. A method, comprising:
aggregating first activity information from a first sensor in a virtual network of a first user account with second activity information from a second sensor in a second network of a second user account, wherein the first sensor is associated with a first network connection that facilitates communication between the first sensor and one or more remote endpoints outside of the virtual network of the first user account, and the second sensor is associated with a second network connection that facilitates communication between the second sensor and the one or more remote endpoints outside of the virtual network of the second user account;
identifying an Internet Protocol (“IP”) address as being a suspected malicious IP address using aggregated activity information; and
generating threat information that

Assignees

• Amazon Tech Inc

Inventors

• Stickle Thomas Charles
• Pereira Shane Anil

Classifications

• H04L63/1491 Primary

  using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title