Server drift monitoring

Patent metadata

Field	Value
Publication number	US-10447708-B2
Application number	US-201816019086-A
Country	US
Kind code	B2
Filing date	Jun 26, 2018
Priority date	Dec 15, 2014
Publication date	Oct 15, 2019
Grant date	Oct 15, 2019

Abstract

Threat detection is improved by monitoring variations in observable events and correlating these variations to malicious activity. The disclosed techniques can be usefully employed with any attribute or other metric that can be instrumented on an endpoint and tracked over time including observable events such as changes to files, data, software configurations, operating systems, and so forth. Correlations may be based on historical data for a particular machine, or a group of machines such as similarly configured endpoints. Similar inferences of malicious activity can be based on the nature of a variation, including specific patterns of variation known to be associated with malware and any other unexpected patterns that deviate from normal behavior. Embodiments described herein use variations in, e.g., server software updates or URL cache hits on an endpoint, but the techniques are more generally applicable to any endpoint attribute that varies in a manner correlated with malicious activity.

First claim

What is claimed is:

1. A method comprising:
configuring a plurality of servers in a group of similarly configured servers with one or more executables in a known configuration, each one of the plurality of servers configured to provide services across a network to remote clients;
instrumenting each of the plurality of servers to detect changes in a number of network connections by the plurality of servers, and to periodically or continuously provide updates with information about the changes;
receiving the changes in the number of network connections at a threat management facility for an enterprise network that includes the plurality of servers;
detecting a drift in a first one of the plurality of servers, the drift including a deviation of the changes in the number of network connections by the first one of the plurality of servers relative to the changes in the number of network connections by other ones of the plurality of servers, wherein detecting includes detecting by a number of classes of changes each specifying an actor initiating one of the changes; and
initiating a remedial action when the drift in the first one of the plurality of servers deviates beyond a predetermined threshold, wherein the predetermined threshold is a different threshold for each of the number of classes of changes.

2. The method of claim 1 , wherein the actor is selected from a group consisting of an application, a user of the application, a passive authorized user, an active authorized user, and a trusted updater.

3. The method of claim 1 , wherein the one or more executables include at least one of a native executable file, an interpreted file, a script, a dynamic linked library, and a flash file.

4. The method of claim 1 , wherein the remedial action includes at least one of a quarantine, a deactivation, and a notification.

5. The method of claim 1 , further comprising filtering at least one change initiated by a trusted updater.

6. A computer program product comprising non-transitory computer executable code embodied in a non-transitory computer readable medium that, when executing on one or more computing devices, performs the steps of:
configuring a plurality of servers in a group of similarly configured servers with one or more executables in a known configuration, each one of the plurality of servers configured to provide services across a network to remote clients;
instrumenting each of the plurality of servers to detect changes in a volume of network connections by the plurality of servers, and to periodically or continuously update a database with information about the changes;
receiving the changes in the volume of network connections at a threat management facility for an enterprise network that includes the plurality of servers;
detecting a drift in a first one of the plurality of servers, the drift including a deviation of the changes in the volume of network connections by the first one of the plurality of servers relative to the changes in the volume of network connections by other ones of the plurality of servers, wherein detecting includes detecting by a number of classes of changes; and
initiating a remedial action when the drift in the first one of the plurality of servers deviates beyond a predetermined threshold, wherein the predetermined threshold is a different threshold for each of the number of classes of changes.

7. The computer program product of claim 6 , wherein the number of classes of changes specify one or more actors.

8. The computer program product of claim 7 , wherein the one or more actors are selected from a group consisting of an application, a user of the application, a passive authorized user, an active authorized user, and a trusted updater.

9. The computer program product of claim 8 , wherein the one or more executables include at least one of a native executable file, an interpreted file, a script, a dynamic linked library, and an Adobe flash file.

10. The computer program product of claim 8 , further comprising filtering at least one change initiated by a trusted updater.

11. The computer program product of claim 6 , wherein the number of classes of changes specify one or more actors initiating changes selected from a group consisting of an application, a user of the application, a passive authorized user, an active authorized user, and a trusted updater.

12. A system comprising:
a server farm including a plurality of similarly configured servers with one or more executables in a known configuration, each one of the plurality of servers configured to provide services across a network to remote clients, and each one of the plurality of servers including a processor and associated memory, the memory storing instructions which, when executed by the processor, detect a local drift including a change in a number of network connections by the respective one of the plurality of servers; and
a threat management facility coupled in a communicating relationship with each one of the plurality of servers, the threat management facility including a processor and associated memory, the memory storing instructions which, when executed by the processor, monitor periodic or continuous updates of local drift corresponding to each one of the plurality of servers, to detect a deviation of the local drift in a first one of the plurality of servers relative to the local drift in other ones of the plurality of servers, and to initiate a remedial action when the deviation in the local drift in the first one of the plurality of servers exceeds a predetermined threshold.

13. The system of claim 12 , wherein the one or more executables include at least one of a native executable file, an interpreted file, a script, a dynamic linked library, and a flash file.

14. The system of claim 12 , wherein the remedial action includes at least one of a quarantine, a deactivation, and a notification.

15. The system of claim 12 , wherein the one or more executables include at least one of a native executable file, an interpreted file, a script, a dynamic linked library, and an Adobe flash file.

16. The system of claim 12 , wherein detecting includes detecting by a number of classes of changes, wherein the predetermined threshold is a different threshold for each of the number of classes of changes.

17. The system of claim 16 , wherein the number of classes of changes specify one or more actors initiating changes selected from a group consisting of an application, a user of the application, a passive authorized user, an active authorized user, and a trusted updater.

18. The system of claim 12 , wherein detecting includes detecting by a number of classes of changes, and the predetermined threshold is a different threshold for each of the number of classes of changes.

19. The system of claim 18 , wherein the number of classes of changes specify one or more actors.

20. The system of claim 19 , wherein the one or more actors are selected from a group consisting of an application, a user of the application, a passive authorized user, an active authorized user, and a trusted updater.

Assignees

• Sophos Ltd

Inventors

• Thomas Andrew J
• Ray Kenneth D
• Harris Mark D

Classifications

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/1408 Primary

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• H04L63/145

  the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms · CPC title